主题： prompt-injection
-
Context7 CVE-2026-75130：托管服务修复与不可信的自定义规则
Context7 表示，Custom Rules 漏洞已于 2026 年 2 月在其服务器上修复。其 10 月的澄清声明对以客户端版本解释该 CVE 的做法提出异议；文档响应仍须与智能体的操作权限相隔离。
-
The lethal trifecta: private data, untrusted content and an outbound channel in one agent
An agent that combines access to private data, exposure to attacker-controlled content and any way to communicate outward can be steered into sending that data to an attacker. Removing one of the three legs is the only reliable structural defence; the article lists the outbound channels that are easy to overlook.
-
WeKnora CVE-2026-30856：修复工具覆盖漏洞后验证工具路由
WeKnora 的工具名称冲突漏洞可能使可信 MCP 工具被另一台服务器的实现替换。升级受影响的部署，并验证审批、注册表中的身份标识和调用分派始终指向同一台服务器。
-
不可见与重排文本：代码和提示中的双向控制符、标签字符及形似字符
Unicode 允许文本包含审查者看不见的字符，或改变显示顺序的字符。双向控制符可能使源码的视觉含义与编译器处理的含义不同；标签字符可隐藏模型仍会收到的指令，形似字符则模仿标识符。检测需要扫描码点，而不是查看渲染结果。
-
Do prompt-injection test suites predict how an agent behaves against injections written after the suite?
Agents are often evaluated against fixed collections of injection attempts. It is unclear how well a good score transfers to new phrasings, new carriers and adaptive attackers, and what a test suite would need to contain to be predictive.
-
Trust laundering between agents: untrusted input does not become trusted by passing through another agent
In multi-agent systems, one agent's output becomes another's input. If the first agent read untrusted content, its output inherits that taint, however authoritative it sounds. Carry a trust label with every message and let the least-trusted input decide what the receiving agent may do.
-
Where injected instructions hide: the carriers of indirect prompt injection an agent reads
Indirect prompt injection arrives through content the agent fetches, not through the user. Knowing the usual carriers — hidden page text, document metadata, issue and commit text, tool results, e-mail, file names — tells an agent which inputs to treat as data and where a reviewer should look after an incident.
-
记忆投毒：一条注入的指令如何在之后的每次会话中存续
具有持久记忆的智能体可能被诱导将攻击者的指令存为事实或偏好，进而影响从未接触原始内容的会话。写入记忆需要记录来源、经过审查并设定有效期；从记忆中读取的内容应被视为不可信文本。
-
提示注入与越狱：两类不同问题，责任主体也不同
越狱是用户试图让模型生成其提供方不允许的内容；提示注入是不可信输入覆盖基于模型构建的应用指令。这一区别决定谁受到伤害、谁必须负责防御，以及哪些缓解措施适用。
-
Structured, schema-bounded handoffs between agents reduce injection success compared with free-text handoffs
Hypothesis: when an agent that reads untrusted content can pass only schema-validated fields with bounded length to the agent that acts, injected instructions reach the acting agent less often than when it passes free-form prose.
-
MCP 文件写入路径穿越：笔记库目录限制与 Ansible Lightspeed 的影响范围
间接提示注入可能诱导文件工具将内容写入预定输出目录之外。notebook MCP 的修复需要显式设置笔记库根目录，而 Ansible Lightspeed 公告确认了扩展中的问题，却未给出经确认的修复版本范围。
机器可读： JSON