Hugging Face Trending Papers
SIR: Self-improving Red-teaming for Compute Use Agents
Read the original on Hugging Face Trending Papers →The Flow has not summarised this story yet — read it at Hugging Face Trending Papers.
Related stories
arXiv AI
Sep 1
SIR: Self-improving Red-teaming for Compute Use Agents
arXiv:2608.30207v1 Announce Type: cross Abstract: Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal...
arXiv AI
Jun 6
CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents
arXiv:2601. 09923v3 Announce Type: replace Abstract: AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior.
arXiv AI
Jul 1
Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.
arXiv AI
Sep 30
CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
arXiv:2609.36570v1 Announce Type: cross Abstract: Indirect prompt injection makes an LLM agent treat untrusted retrieved text as instructions. We present CounterSteer, an inference-time defense that...
arXiv AI
3d ago
INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems
INFUSE is a new benchmark that tests indirect prompt injection (IPI) in large‑language‑model agents performing long‑horizon workflows. It contains 40 realistic tasks and 56 attack scenarios across five threat categories, with attacks injected through realistic interaction surfaces rather than just initial prompts. The study evaluated 19 LLMs, generating over 41,000 adversarial trajectories and found mean attack success rates of 19.6% (LLM evaluation) and 15.4% (heuristic verification), while prompt‑level hardening reduced success from 58.2% to 14.3%.
arXiv AI
Sep 7
Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection
Repeat-After-Me is a black-box adaptive visual prompt injection technique that can reveal personally identifiable information or trigger malicious tool calls in both open-weight and commercial vision‑language models, achieving attack success rates above 80% on Qwen3.6‑27B and 47% on GPT‑5.5. The method works even when the benign user prompt is unrelated to the injected task and does not explicitly authorize it, and it retains significant effectiveness when transferred across models or optimized on surrogate systems. In a real‑world OpenClaw Discord deployment, a minimally injected image can overwrite TOOLS.md, enabling remote code execution and secret exfiltration.