risk · 知识库活文档
- 更新：R109 · 8 件增量(4 paper 全承接 + 4 repo 净新)· 首次出现防守侧工具面与攻击侧证据同量级;PHP2Shell 双 CVE 入轴(引擎级 UAF · CVSS 9.2 · 已确认在野)。
0. 范围与定调
R108 evening 沿用 + 本轮清单 8 件增量(4 paper_card + 4 repo_card)。
核心判断:本轮是本主轴开篇以来第一次出现「防守侧具象件与攻击侧证据同量级」的批次 ⚠⚬⚬。前 108 轮是单向事故链(MaxKB CVE-2026-77521 族、SSMS 审批绕过、CVE-2026-39419、opencode MCP OAuth RCE、HF 入侵)—— 全是「出事之后」才被记录;本轮首次出现事故之前的防守工具形态:人工审批闸门、CVE 情报工具面、应急缓解+检测合一、per-workspace 隔离的 MCP 后端。这是 2026 Q4 中段风险工程的可观察转折:防守侧开始以「可被 Agent 调用的工具面」交付 ⚠⚬⚬。
反向信号同时记录:本轮 4 篇 paper 全部承接,arXiv 净增 = 0 件 ⚠⚬(2410.21276/R106、2603.15031/R104、2605.13831/R107、2606.06090/R107 —— mtime 变动来自 S2/OpenAlex 元数据回灌,非新发现)。paper 侧连续两日归零、repo 侧连续两日放量(10-23:6+1 → 10-24:0+4),指向上游采集重心漂移(#121)。增量密度 = 中高:2 件 CVE 净增 + 3 件 CVE 细节经 web_search 补齐到可核查级 + 4 件 repo 各挂到主轴层级 + 一条元层论断。
SOTA 综述(R109 10-24)
1. 现状全景:从「单向事故链」转入「攻防双向可观测」
R108 立了两层结构(训练期对齐 / 运行时失守),本轮补上第三维度:控制面层 —— 失守点与权限之间的人工或工具化闸门。此前 108 轮只记录「闸门失效」的证据(R107 四元链),从未记录「闸门存在」;本轮 4 件 repo 全落此层。
核心论断:当防守控制面第一次以「Agent 可调用的工具面」形态交付时,它同时进入两条风险路径 —— 降低既有失守点发生率,同时其自身输入面成为新的注入点 ⚠⚬⚬。这不是修辞,是 4 件工具的共同结构:审批预览由 Agent 生成(预览即载荷)、情报源由工具拉取(拉取即信任边界)、阻断规则由配置表达(规则即攻击面)、隔离由宿主权限边界定义(宿主即边界)。这一层比攻击面更难审计,因为控制面是「善意」的 —— 审计清单假设攻击者伪装成工具输出或配置;而控制面组件的身份是「我们自己写的防护代码」。R108 已把「防御性重复遍历 / 二次校验路径」列为一级审计目标 —— 本轮从代码模式扩到组件类别:被 Agent 直接调用的安全控制件必须按攻击面标准审计 ⚠⚬⚬。
2. 关键工作脉络(本轮增量)
2.1 syhunt/php2shell-protection —— 本轮唯一 CVE 硬资产,且是引擎级而非应用级
76 Star · PHP · MIT · trending · experimental · 待LLM分类=是(实质属 risk)。本轮 web_search 补齐到可核查级:CVSS v4.0 9.2(六源一致)、PHP 核心请求引擎 use-after-free、受影响可追溯至 PHP 5.4.0(2012)、AWS 观测 10-17 即有在野利用尝试 + watchTowr 蜜罐确认、应用层认证无法阻止(源清单见文末段)。读法:PHP2Shell 在语言运行时内部,WAF、应用鉴权、业务校验全是下游 —— 「把 Agent 放在 WAF 后面就安全了」在引擎级缺陷面前不成立(#134);核心缓解 multipart POST 阻断 + 请求体大小限制 是攻击面转移的第 3 个证据(#135);在野(10-17)→ 补丁(10-21)有 4 天窗口(#119)。
2.2 Fazmin/cve-intel —— CVE 情报首次以「本地优先 + Agent 可调用工具面」形态进入主轴
92 Star · 周增 +21(本批增速最高)· Rust · trending · experimental。读法:① 填补了主轴长期缺的巡检侧 ⚠ —— R100–R108 的 60+ 件 CVE 全是事后事故记录,R108 的 Q231/Q230 停在问题层;本篇是巡检层首个具象实现。② 「CVE 情报 → Agent 可调用工具面」的形态迁移本身即新注入面 ⚠⚬⚬ —— 情报源被污染 = 直接的策略投毒;39 数据源 = 39 信任边界 ⚠。③ ⚠ 「Private by default」+ 全本地 Rust 的双向读法系推断。
2.3 Daniel221287/mcp-human-approval-gate —— 审批层从「失守证据」到「存在设计样本」的第一例
Stars 0 · 周增 +0 · JavaScript · MIT · skill · experimental。设计为三段式:Agent 产出动作预览 → 人类逐条批准该预览 → Agent 只执行一次。与 R107 审批层证据的直接对照 ⚠⚬⚬ —— R107 的 Copilot in SSMS 只读模式块名单可被正则绕过(AGENTS.md 载体),低权限用户以受害者身份执行任意 SQL 直至 sysadmin;绕过成立,正是因为审批只检查「只读模式」这一类别标签,而不检查具体动作。 本篇恰好堵住该手法:「approves the exact preview」 把审批对象从类别绑到具体动作内容;「runs it once」 消除批准/执行间改写窗口(TOCTOU)—— 即审批可信度取决于审批对象绑定的粒度(#136)。但必须降级表述 ⚠⚬⚬:① 这是设计构想(design artifact),不是被验证有效的实证 ⚠ —— Stars 0、首次采集当日即 0 star、experimental、无 README/测试/issue/负面结论;按 R108 趋势四采信下限连负面结论都没提供,故只记为「方向性样本」,不得写成「已验证方案」;反例有一等实证,正例仅设计意图 ⚠。② 「预览由 Agent 生成」引入自指风险 ⚠⚬ —— 若 Agent 已被注入,人类审的是被攻击者影响过的摘要;本篇不解决(#122)。
2.4 soporte-defontsoft/delphi-ide-remote-mcp —— 「MCP server 的真实权力 = 被代理主机的完整权限」
21 Star · 周增 +0 · Pascal · MIT · skill · experimental。读法:① 这是 R107 协议层论断的具体化 —— 「Agent 的权力还包括它写下的文件,以及日后信任这些文件的主机组件」;推到工具宿主层后,MCP server 接入 IDE,Agent 获得的不是「读写代码」,而是整条 构建→部署→运行→设备控制→凭据 链。② 与 R107 interrupt_on 漏配 execute 是同一类错误的放大版 ⚠⚬⚬ —— 审批清单按 tool 名枚举,真实权力按被代理主机的权限枚举;审批清单与权限清单是两个不同的清单,主轴此前只审了前者(#137)。③ 「vault」意味着触及凭据面、Pascal / Windows RAD Studio 属遗留/垂直栈,把 R108 趋势三巡检范围再扩一格:IDE/开发工具链是第四类宿主环境 ⚠。⚠ 「per-workspace security」是作者主张,非已验证能力 —— 无隔离实现、威胁模型或负面结论,未达 R108 采信线。
3. 共识与争议
3.1 共识(本轮新增 #134–#137) —— #134 ⚠⚬⚬ 引擎级缺陷使应用层安全控制整体失效 —— 本主轴首次出现「下游控制面对上游引擎缺陷无效」结论。#135 ⚠⚬ 攻击面转移在 HTTP 层的重演 —— 缓解须在「移动攻击面」框架下评估 ⚠⚬⚬。#136 ⚠⚬ 审批可信度取决于审批对象绑定的粒度 —— 反例有一等实证,正例仅设计意图 ⚠。#137 ⚠⚬⚬ MCP server 的真实权力 = 被代理主机的完整权限,不是它声明的 tool 列表 —— 审批清单与权限清单是两个不同清单。
3.2 争议(本轮新增 #119–#122) —— #119 ⚠⚬⚬ 协调披露机制的实际成本 —— 在野尝试(10-17)→ 补丁(10-21)共 4 天窗口,原定 10-22 的披露因公开泄露提前。#120 ⚠⚬ 「应急缓解件」的风险转移是否被正确披露 —— 检测逻辑未公开,无法判定 ⚠。#121 ⚠⚬⚬ 上游采集重心漂移 —— 会把风险主轴的证据密度从「有 CVE 与论文的实证」滑向「有人点赞的仓库」 ⚠⚬;本轮 4 件 repo 中 3 件 experimental、1 件 Stars 0,不足以支撑「趋势已确立」。#122 ⚠ Agent 生成的安全预览是否可作为审批依据 —— 「预览绑定」解决「对象错位」,未解决「来源可信」 ⚠⚬。
4. 开放问题与工程清单
Q234-Q241(本轮新增 8 条 P1) —— Q234 ⚠⚬⚬ 盘点全部 PHP 部署资产版本是否落在受影响区间(5.4.0 起;修复版 8.5.12/8.4.27/8.3.36/8.2.35);注意「已修复版本」与「各分支末版」的混淆风险 ⚠。Q235 ⚠⚬⚬ 审计所有「在 WAF/应用鉴权之后即认为安全」的部署假设 —— #134 的可执行化。Q236 ⚠⚬ 为应急缓解件建「攻击面转移评估」模板。Q237 ⚠⚬ 审计所有 Agent 可直接调用的安全控制件,按攻击面标准审计其输入面 —— 把 R108 规则从代码模式扩到组件类别 ⚠⚬⚬。Q238 ⚠⚬⚬ 审计所有 MCP server 的「声明 tool 列表」与「宿主实际权限」差集。Q239 ⚠⚬ 审计审批闸门:审批对象是否为逐次具体内容;批准/执行间是否有可改写窗口(TOCTOU)。Q240 ⚠⚬⚬ 审计审批预览的来源可信性(#122)。Q241 ⚠ 评估 CVE 情报工具 39 个数据源构成与可信度分层(⚠ 推断)。
5. 趋势判断与工程建议
趋势一-八十五(R109) ⚠⚬⚬ 防守控制面首次以「Agent 可调用工具面」形态交付,并同时进入攻击面清单;审计规则从代码模式扩到组件类别 ⚠⚬⚬。趋势二(R109) ⚠⚬ 「缓解」重列为「攻击面转移」在 HTTP 层的第三个证据;验收应含「转移到哪里」⚠⚬。趋势三(R109) ⚠⚬ 「缓解件 + 检测件」合一成为应急期交付形态。趋势四(R109) ⚠ 宿主环境巡检范围第 4 次扩格:服务器侧 Agent 平台(R100–R107)→ 消费设备/嵌入式 WebView(R108)→ IDE/开发工具链。趋势五(R109) ⚠ 协调披露的「泄露降级」路径需正式化(#119)。趋势六(R109) ⚠ 主轴自身的证据结构风险:连续两日 paper 侧净增归零 + repo 侧放量,需保住「有 CVE 与论文的实证」这层(#121)。
7. 自评、修订与问题清单
准确性:来自宿主机清单 8 份 materials 逐份实读 + 活文档 R108 全文 + inbox/flyp/2026-10-24-risk-e1prep.md + 2 次 web_search(PHP2Shell 多源核实 / approval-gate 检索)。未全库扫描,未把采集时间或被引变化当新观点;4 篇 paper 核对确认全承接。
CVE 细节可信度分层 ⚠⚬:PHP2Shell 的 CVSS 9.2、UAF 性质、受影响版本、在野利用(10-17 AWS / watchTowr 蜜罐)、披露时间线(10-21 提前)均有 6 个独立来源交叉一致,标为高可信;但「利用需特定服务器条件」来自 Sansec 单源,与 Abstract「无在野利用」有时间差 —— 采信更早的 AWS 时间戳 ⚠⚬。
深度与遗漏:实质增量是一条元层论断(防守控制面工具化 = 同时成为新的注入面),把 4 件 repo 收进一个结构,并把 R108「防御性代码路径是攻击面」推广到组件类别。不是栖位堆叠。遗漏清单 ⚠(7 项,全列于文末「本次变更」段):① approval-gate Stars 0 且无 README/测试/issue,效果判断全从简介 4 个短语推断 ⚠⚬;② cve-intel 39 数据源清单与 risk score 算法未知 ⚠;③ delphi-ide-remote-mcp 隔离实现与 vault 路径未知 ⚠;④ php2shell-protection multipart 检测逻辑未公开,#120/Q240 无法判定 ⚠⚬;⑤ 2 次 web_search 配额已尽,后两件 repo 未获第三方核实 ⚠;⑥ PS5 项目 2 个新 bug 编号与内核 Tier-1 候选仍不可得 ⚠;⑦ 2603.15031 编号/标题错配未获原文核实 ⚠⚬。
SOTA 综述(R100–R108 · 凝写索引)
历轮叙事随 pre-repair 全量归档,硬资产完整保留于文末清单。以下为可核查索引:
R107 10-21 · 四元链 ⚠⚬⚬ —— ①沙箱层 CVE-2026-77521(MaxKB,Critical 10.0)SandboxShellBackend 暴露 execute 却未列入 interrupt_on → 审批静默绕过;同族 CVE-2026-77523(7.4)/CVE-2026-77522(4.3)同日 = 系统性审计释放。②审批层 Copilot in SSMS 只读模式块名单可被正则绕过(AGENTS.md 载体)→ 低权限用户以受害者身份执行任意 SQL 直至 sysadmin。③出口层 CVE-2026-39419 帧内省读 UUID 绕过 stdout 重定向 → 向 fd 1 写伪造工具结果。④协议层 Pillar《Open and Shut: RCE in opencode via MCP OAuth》:Agent 的权力还包括它写下的文件,以及日后信任这些文件的主机组件。另:arXiv:2606.06090 MAGE + arXiv:2605.13831 MMProLong + yunqing-me/AttackVLM + ZigZagBoi1/PS5-14.10-Research(负面披露采信下限模板)。
R106 ——(详 pre-repair 归档;硬资产见文末清单)
R104 ——(详 pre-repair 归档;硬资产见文末清单)
R103 ——(详 pre-repair 归档;硬资产见文末清单)
R102 ——(详 pre-repair 归档;硬资产见文末清单)
R100 10-12 · 三项结构性前提 ⚠⚬⚬ —— 前提一 frontier lab 治理公开化 + 反方档化辩论(Interconnects《The Cyber Risk Discourse is Broken》批评 Anthropic《GLM-5.3 and the Spread of Advanced Cyber Capabilities》;三方立场:frontier lab + 美国国安社群「开源权重风险不可承受」/ Nathan + HF + Joshua Saxe「开源权重是防御必需」/ 中国公司持续发布强 cyber 能力权重)。前提二 HF 7 月入侵时间线 = 真实生产事故 anchor(Bruce Schneier《The Genie Is Out of the Bottle》;CSA Lab Space 量化「企业严重高估对 Agent 可见性」)。前提三 涌现合谋栖位第 1 例 anchor arXiv:2609.24967(+ DeepMind arXiv:2609.04170 100 Gemini swarm 自发作弊 + Cournot arXiv:2601.11369);关键张力:涌现合谋 ≠ 单 Agent 对齐。另立五层攻击面分层(① 模型 ② 协议 ③ 工具 ④ 系统 ⑤ 治理)、争议 #82–#90、Q1–Q185、P0 警示级 6 件。
历史硬资产保全清单
arXiv(主轴既有集合 + R100 早棒 10-12 续补 + R108 续补)
+ 1705.08045 1901.02672 2004.07213 2402.03578 2409.10102 2501.09136 2502.12152 2504.21668 2505.11548 2506.02548 2506.07671 2506.14245 2507.21504 2508.08438 2508.09442 2508.10991 2508.13220 2508.14925 2509.01809 2509.06572 2509.24272 2510.04618 2510.07775 2510.11977 2510.16558 2510.23673 2511.02230 2511.14136 2511.17332 2512.15163 2601.04043 2601.07395 2601.07504 2601.10338 2601.10971 2601.17549 2601.21557 2602.01129 2602.02450 2602.06176 2602.07962 2602.09305 2602.11510 2602.15763 2602.16666 2602.16901 2602.23368 2603.00195 2603.00873 2603.03781 2603.04428 2603.04474 2603.07670 2603.10726 2603.11768 2603.12201 2603.20397 2603.20432 2603.27918 2603.28583 2603.29231 2604.01647 2604.01707 2604.03081 2604.05546 2604.06268 2604.11978 2604.12312 2604.15149 2604.16548 2604.24564 2604.24971 2605.01280 2605.01604 2605.06760 2605.10834 2605.11086 2605.12480 2605.14678 2605.16045 2605.16147 2605.19769 2605.20173 2605.27744 2605.30104 2606.02643 2606.03811 2606.05608 2606.05670 2606.05679 2606.06036 2606.08367 2606.09084 2606.09498 2606.10749 2606.11470 2606.13141 2606.14061 2606.14470 2606.14589 2606.17114 2606.17846 2606.19348 2606.19803 2606.22388 2606.24322 2606.25161 2606.25533 2606.25721 2606.26479 2606.26511 2606.27786 2606.28733 2606.31227 2607.01793 2607.02869 2607.05196 2607.05382 2607.05391 2607.05394 2607.05910 2607.06807 2607.06815 2607.07397 2607.07470 2607.07474 2607.07702 2607.07953 2607.08028 2607.08269 2607.08395 2607.08459 2607.08495 2607.08716 2607.08765 2607.08768 2607.08964 2607.09121 2607.09125 2607.09322 2607.09349 2607.09362 2607.09701 2607.09786 2607.10350 2607.10400 2607.10623 2607.11079 2607.11086 2607.11111 2607.11250 2607.11505 2607.11523 2607.11594 2607.11643 2607.11644 2607.11736 2607.11783 2607.11849 2607.11862 2607.11881 2607.11885 2607.11886 2607.12227 2607.12310 2607.12340 2607.12406 2607.12747 2607.12752 2607.12764 2607.13027 2607.13104 2607.13125 2607.13679 2607.13705 2607.13960 2607.15263 2607.15434 2607.15657 2607.16955 2607.17715 2607.17986 2607.18826 2607.20064 2607.20092 2607.20346 2607.20468 2607.20891 2607.21503 2607.21557 2607.21576 2607.21653 2607.21936 2607.21962 2607.22157 2607.22682 2607.23188 2607.24223 2607.24368 2607.24653 2607.24882 2607.25236 2607.25294 2607.25308 2607.25337 2607.25380 2607.25398 2607.25431 2607.25565 2607.25572 2607.25614 2607.25895 2607.26055 2607.26120 2607.26314 2607.26410 2607.26497 2607.26520 2607.26627 2607.26637 2607.26654 2607.26760 2607.26784 2607.26811 2607.27080 2607.27136 2607.27146 2607.27167 2607.27380 2607.27616 2607.27749 2607.27816 2607.27918 2607.27919 2607.27958 2607.28022 2607.28126 2607.28227 2607.28263 2607.28319 2607.28362 2607.28374 2607.28397 2607.28568 2607.28580 2607.28595 2607.28618 2607.28624 2607.28625 2607.28802 2607.29167 2607.29677 2608.00677 2608.01526 2608.01558 2608.01679 2608.01964 2608.02023 2608.03036 2608.03207 2608.03216 2608.03499 2608.03700 2608.03744 2608.04569 2608.04570 2608.05108 2608.06113 2608.06130 2608.06865 2608.07446 2608.07468 2608.07565 2608.07645 2608.07886 2608.08097 2608.08160 2608.08466 2608.08621 2608.08722 2608.08814 2608.08975 2608.09158 2608.09408 2608.09698 2608.09766 2608.09779 2608.09867 2608.09880 2608.09888 2608.09900 2608.10218 2608.10744 2608.10835 2608.10875 2608.11110 2608.11111 2608.11146 2608.11205 2608.11632 2608.12036 2608.12314 2608.12571 2608.13010 2608.13040 2608.13120 2608.13210 2608.13410 2608.13489 2608.13517 2608.13545 2608.13567 2608.13606 2608.13667 2608.13760 2608.13987 2608.14036 2608.14054 2608.14075 2608.14106 2608.14144 2608.14210 2608.14229 2608.14277 2608.14284 2608.14391 2608.14546 2608.14577 2608.15022 2608.15659 2608.15669 2608.15763 2608.15875 2608.15888 2608.15984 2608.16143 2608.16328 2608.16515 2608.16536 2608.16765 2608.16776 2608.16859 2608.17067 2608.17253 2608.17379 2608.17393 2608.17402 2608.17426 2608.17512 2608.17528 2608.17536 2608.17597 2608.17744 2608.17781 2608.17906 2608.17950 2608.17960 2608.18027 2608.18063 2608.18184 2608.18607 2608.18613 2608.18701 2608.18746 2608.18852 2608.19098 2608.19269 2608.19583 2608.19758 2608.19799 2608.19854 2608.19857 2608.19863 2608.19880 2608.19936 2608.20055 2608.20246 2608.20281 2608.20335 2608.20338 2608.20438 2608.20953 2608.21095 2608.21159 2608.21208 2608.21252 2608.21281 2608.21486 2608.21500 2608.22510 2608.22752 2608.22767 2608.23001 2608.23256 2608.23564 2608.23691 2608.23740 2608.24040 2608.24358 2608.24479 2608.24569 2608.24764 2608.24777 2608.25500 2608.25518 2608.25593 2608.25625 2608.25832 2608.26005 2608.26200 2608.26238 2608.26530 2608.26872 2608.26993 2608.27260 2608.27345 2608.27448 2608.27455 2608.27456 2608.28122 2608.28389 2608.28444 2608.29692 2609.00092 2609.00137 2609.01836 2609.02771 2609.03293 2609.04170 2609.04280 2609.04355 2609.04382 2609.04444 2609.04482 2609.04714 2609.04720 2609.05232 2609.05339 2609.05903 2609.06011 2609.06140 2609.06702 2609.07064 2609.07821 2609.08126 2609.08149 2609.08572 2609.08832 2609.09113 2609.09134 2609.09206 2609.09219 2609.09875 2609.10296 2609.10430 2609.10712 2609.10895 2609.11108 2609.11155 2609.11294 2609.11412 2609.11561 2609.11596 2609.11808 2609.11977 2609.12541 2609.13406 2609.14857 2609.15029 2609.15134 2609.15309 2609.15364 2609.15578 2609.15818 2609.16816 2609.16818 2609.16900 2609.17320 2609.17653 2609.18605 2609.18703 2609.18748 2609.18766 2609.19144 2609.19656 2609.19671 2609.20511 2609.20519 2609.20784 2609.21094 2609.22076 2609.22682 2609.22753 2609.22947 2609.23038 2609.23087 2609.23130 2609.23407 2609.23551 2609.24308 2609.24385 2609.24555 2609.24967 2609.24974 2609.24983 2609.25853 2609.25963 2609.26333 2609.26355 2609.26489 2609.26550 2609.26637 2609.26780 2609.26781 2609.27277 2609.27308 2609.27334 2609.27657 2609.27746 2609.27981 2609.28416 2609.28466 2609.28470 2609.28654 2609.29167 2609.29362 2609.29421 2609.29429 2609.29444 2609.29647 2609.29769 2609.29816 2609.29837 2609.29845 2609.29875 2609.29964 2609.30192 2609.30216 2609.30221 2609.30233 2609.30243 2609.30867 2609.31093 2609.31394 2609.31415 2609.31506 2609.31590 2609.31620 2609.32019 2609.32049 2609.32241 2609.32259 2609.32577 2609.32720 2609.32810 2609.32993 2609.33382 2609.33403 2609.33780 2609.34227 2609.34242 2609.34385 2609.34563 2609.34771 2609.35215 2609.35259 2609.35629 2609.35673 2609.35718 2609.35767 2609.35932 2609.36138 2609.36199 2609.36322 2609.36388 2609.36585 2609.36636 2609.36730 2609.37334 2609.37673 2609.37863 2609.37893 2609.38096 2609.38137 2609.38334 2609.38349 2609.38658 2609.38792 2609.38879 2609.39075 2609.39102 2609.39154 2609.39788 2609.39841 2609.39929 2609.39982 2610.00437 2610.00559 2610.00648 2610.01092 2610.01428 2610.01762 2610.01780 2610.01871 2610.01936 2610.01939 2610.02076 2610.02396 2610.02762 2610.02772 2610.03020 2610.03140 2610.03430 2610.03509 2610.04616 2610.04631 2610.04749 2610.05162 2610.05622 2610.05637 2610.05782 2610.05826 2610.05842 2610.05912 2610.06207 2610.06479 2610.06597 2610.06666 2609.06140 2609.07821 2609.09113 2609.11596 2609.15818 2609.16900 2610.06679 2610.07753 2610.08432 2610.08463 2610.08571 2610.08630 2610.08674 2610.08902 2610.11169 2610.11287 2610.11794 2610.11899 2610.12085 2610.12183 2610.12274 2610.12300 2610.12312 2610.12338 2610.12367 2610.12415 2606.03335 2410.21276 2603.15031 2510.09665 2601.11369 2201.08239 2204.05862 2206.07682 2303.04226 2304.08485 2412.19437 2601.21204 2602.08071 2309.16609 2009.01325 2402.06196 2303.12712 2204.14198 2203.02155 2511.01815 2602.08071 2609.38121 2610.03027
CVE-2025-32711 CVE-2025-49596 CVE-2025-6514 CVE-2025-6541 CVE-2025-67644 CVE-2025-68664 CVE-2026-10300 CVE-2026-22773 CVE-2026-22778 CVE-2026-25253 CVE-2026-26384 CVE-2026-26385 CVE-2026-27022 CVE-2026-28277 CVE-2026-28363 CVE-2026-3059 CVE-2026-3060 CVE-2026-31431 CVE-2026-3172 CVE-2026-33032 CVE-2026-33626 CVE-2026-34070 CVE-2026-3989 CVE-2026-39987 CVE-2025-3248 CVE-2026-42271 CVE-2026-1731 CVE-2026-43284 CVE-2026-43500 CVE-2026-48710 CVE-2026-49468 CVE-2026-5027 CVE-2026-50548 CVE-2026-50549 CVE-2026-5241 CVE-2026-54309 CVE-2026-54769 CVE-2026-55255 CVE-2026-5588 CVE-2026-56274 CVE-2026-57572 CVE-2026-5760 CVE-2026-59118 CVE-2026-59726 CVE-2026-61447 CVE-2026-61539 CVE-2026-62830 CVE-2026-65617 CVE-2026-65618 CVE-2026-65921 CVE-2026-65923 CVE-2026-65924 CVE-2026-65925 CVE-2026-66014 CVE-2026-66015 CVE-2026-66018 CVE-2026-7301 CVE-2026-7302 CVE-2026-7304 CVE-2026-73558 CVE-2026-7669
CVE(主轴既有集合 · 56 件沿用 + JFrog Artifactory 9 CVE prep + R107 MaxKB 5 CVE + R105 CVE-2026-43715 已在集合)
CVE-2026-77521 CVE-2026-77522 CVE-2026-77523 CVE-2026-39419 CVE-2026-59822 CVE-2026-109618 CVE-2026-109619 CVE-2026-43715 CVE-2026-109618 CVE-2026-109619
DOI(主轴既有集合 · 2 件沿用 + R100 续补 1 件 + R108 续补 6 件)
10.48550/arxiv.2610.01871 10.01871/2610.01936 10.48550/arxiv.2410.21276 10.48550/arxiv.2603.15031 10.48550/arxiv.2609.24967 10.48550/arxiv.2412.19437 10.48550/arxiv.2204.05862 10.48550/arxiv.2303.04226 10.48550/arxiv.2201.08239 10.48550/arxiv.2304.08485 10.48550/arxiv.2206.07682 10.48550/arxiv.2610.05637 10.48550/arxiv.2606.14061 10.48550/arxiv.2510.09665 10.48550/arxiv.2511.02230 10.48550/arxiv.2609.29429 10.48550/arxiv.2605.13831 10.48550/arxiv.2606.06090 10.48550/arxiv.2410.21276 10.48550/arxiv.2603.15031 10.48550/arxiv.2309.16609 10.48550/arxiv.2009.01325 10.48550/arxiv.2402.06196 10.48550/arxiv.2303.12712 10.48550/arxiv.2204.14198 10.48550/arxiv.2203.02155
URL(主轴既有集合 + R99 evening 10-11 续补)
http://arxiv.org/abs/2609.05232v1 http://arxiv.org/abs/2609.05339v1 https://80000hours.org/hugging-face https://aboutamazon.com/news/aws/bedrock-openai-models https://academ.us/article/2608.28389 https://academy.dair.ai/papers/does-your-agents-memory-survive-a-model-upgrade-a-controlled-study-of-memory-por-2609.05339 https://aclanthology.org/2026.findings-acl.1619 https://ai.google.dev/gemini-api/docs/models/gemini-3.5-transcribe https://alicelabs.ai/en/insights/best-ai-agent-frameworks-2026 https://alignment.anthropic.com/2026/agentic-misalignment-summer-2026 https://anil.recoil.org/notes/rumour-is-the-exploit https://arxiv.org/abs/2506.14245 https://arxiv.org/abs/2508.09442 https://arxiv.org/abs/2508.10991 https://arxiv.org/abs/2508.13220 https://arxiv.org/abs/2508.14925 https://arxiv.org/abs/2510.16558 https://arxiv.org/abs/2510.23673 https://arxiv.org/abs/2512.15163 https://arxiv.org/abs/2601.04043 https://arxiv.org/abs/2601.07395 https://arxiv.org/abs/2601.10971 https://arxiv.org/abs/2601.17549 https://arxiv.org/abs/2602.01129 https://arxiv.org/abs/2603.27918 https://arxiv.org/abs/2603.29231 https://arxiv.org/abs/2604.01707 https://arxiv.org/abs/2604.06268 https://arxiv.org/abs/2604.11978 https://arxiv.org/abs/2604.16548 https://arxiv.org/abs/2605.16045 https://arxiv.org/abs/2606.02643 https://arxiv.org/abs/2606.03811 https://arxiv.org/abs/2606.05679 https://arxiv.org/abs/2606.14061 https://arxiv.org/abs/2606.19803 https://arxiv.org/abs/2606.24322 https://arxiv.org/abs/2607.08964 https://arxiv.org/abs/2607.20891 https://arxiv.org/abs/2607.25614 https://arxiv.org/abs/2607.26637 https://arxiv.org/abs/2607.26654 https://arxiv.org/abs/2607.27080 https://arxiv.org/abs/2607.27958 https://arxiv.org/abs/2607.28802 https://arxiv.org/abs/2607.29167 https://arxiv.org/abs/2608.00677 https://arxiv.org/abs/2608.01679 https://arxiv.org/abs/2608.03036 https://arxiv.org/abs/2608.03700 https://arxiv.org/abs/2608.03744 https://arxiv.org/abs/2608.06130 https://arxiv.org/abs/2608.08160 https://arxiv.org/abs/2608.08975 https://arxiv.org/abs/2608.09158 https://arxiv.org/abs/2608.11632v1 https://arxiv.org/abs/2608.12036 https://arxiv.org/abs/2608.13010 https://arxiv.org/abs/2608.14229 https://arxiv.org/abs/2608.14391 https://arxiv.org/abs/2608.15763 https://arxiv.org/abs/2608.15888 https://arxiv.org/abs/2608.16536 https://arxiv.org/abs/2608.17067 https://arxiv.org/abs/2608.18746 https://arxiv.org/abs/2608.19269 https://arxiv.org/abs/2608.19857 https://arxiv.org/abs/2608.19880 https://arxiv.org/abs/2608.20338 https://arxiv.org/abs/2608.21159 https://arxiv.org/abs/2608.21281 https://arxiv.org/abs/2608.21486 https://arxiv.org/abs/2608.22752 https://arxiv.org/abs/2608.24479 https://arxiv.org/abs/2608.24569 https://arxiv.org/abs/2608.24777 https://arxiv.org/abs/2608.25518 https://arxiv.org/abs/2608.25593 https://arxiv.org/abs/2608.26005 https://arxiv.org/abs/2608.26238 https://arxiv.org/abs/2608.26530 https://arxiv.org/abs/2608.26872 https://arxiv.org/abs/2608.26993 https://arxiv.org/abs/2608.27260 https://arxiv.org/abs/2608.27448 https://arxiv.org/abs/2608.27455 https://arxiv.org/abs/2608.27456 https://arxiv.org/abs/2608.28389 https://arxiv.org/abs/2608.28444 https://arxiv.org/abs/2608.29692 https://arxiv.org/abs/2609.00092v1 https://arxiv.org/abs/2609.00137 https://arxiv.org/abs/2609.01836 https://arxiv.org/abs/2609.03293 https://arxiv.org/abs/2609.04280 https://arxiv.org/abs/2609.04382 https://arxiv.org/abs/2609.04355 https://arxiv.org/abs/2609.04444 https://arxiv.org/abs/2609.04482 https://arxiv.org/abs/2609.04714 https://arxiv.org/abs/2609.04720 https://arxiv.org/abs/2609.05339 https://arxiv.org/abs/2609.05903 https://arxiv.org/abs/2609.06140 https://arxiv.org/abs/2609.07821 https://arxiv.org/abs/2609.08126 https://arxiv.org/abs/2609.08832 https://arxiv.org/abs/2609.09113 https://arxiv.org/abs/2609.09134 https://arxiv.org/abs/2609.09206 https://arxiv.org/abs/2609.09875 https://arxiv.org/abs/2609.10430 https://arxiv.org/abs/2609.10895 https://arxiv.org/abs/2609.11596 https://arxiv.org/abs/2609.11977 https://arxiv.org/abs/2609.12541 https://arxiv.org/abs/2609.15029 https://arxiv.org/abs/2609.15134 https://arxiv.org/abs/2609.15309 https://arxiv.org/abs/2609.15364 https://arxiv.org/abs/2609.15818 https://arxiv.org/abs/2609.16818 https://arxiv.org/abs/2609.16900 https://arxiv.org/abs/2609.17320 https://arxiv.org/abs/2609.17653 https://arxiv.org/abs/2609.18605 https://arxiv.org/abs/2609.18748 https://arxiv.org/abs/2609.18766 https://arxiv.org/abs/2609.19671 https://arxiv.org/abs/2609.20511 https://arxiv.org/abs/2609.20784 https://arxiv.org/abs/2609.21094 https://arxiv.org/abs/2609.22076 https://arxiv.org/abs/2609.39788 https://arxiv.org/abs/2610.00648 https://arxiv.org/abs/2610.02762 https://arxiv.org/abs/2610.03430 https://arxiv.org/abs/2610.05637 https://arxiv.org/abs/2610.06679 https://arxiv.org/abs/2610.07753 https://arxiv.org/abs/2610.08571 https://arxiv.org/abs/2610.11169 https://arxiv.org/abs/2610.11287 https://arxiv.org/abs/2610.11794 https://arxiv.org/abs/2610.11899 https://arxiv.org/abs/2610.12085 https://arxiv.org/abs/2610.12183 https://arxiv.org/abs/2610.12274 https://arxiv.org/abs/2610.12300 https://arxiv.org/abs/2610.12312 https://arxiv.org/abs/2610.12338 https://arxiv.org/abs/2610.12367 https://arxiv.org/abs/2610.12415 https://arxiv.org/abs/2412.19437 https://arxiv.org/abs/2204.05862 https://arxiv.org/abs/2303.04226 https://arxiv.org/abs/2201.08239 https://arxiv.org/abs/2304.08485 https://arxiv.org/abs/2206.07682 https://arxiv.org/abs/2609.09219 https://arxiv.org/abs/2511.02230 https://arxiv.org/abs/2510.09665 https://arxiv.org/abs/2609.29429 https://arxiv.org/html/2604.06268v1 https://arxiv.org/html/2604.12312v1 https://arxiv.org/html/2604.16548v1 https://arxiv.org/html/2606.03811v1 https://arxiv.org/html/2606.24322 https://arxiv.org/html/2608.00677v1 https://arxiv.org/html/2608.06130v1 https://arxiv.org/html/2608.28389v1 https://arxiv.org/html/2609.05339v1 https://arxiv.org/pdf/2609.05232 https://arxiv.org/pdf/2610.06597 https://arxiv.org/pdf/2609.24967 https://arxiv.org/abs/2609.24967 https://arxiv.org/pdf/2510.09665 https://github.com/SALT-NLP/agent-collusion https://github.com/xerj-org/xerj https://github.com/ZigZagBoi1/PS5-14.10-Research https://github.com/openbin-ai/binny https://github.com/semrincaballero/polymarket-prediction-bot https://github.com/bydeng01/conv-vs-ped-tutor https://arxiv.org/abs/2607.28128 https://github.com/Keesan12/martin-loop https://github.com/olegzhr/altprobe https://github.com/KCNyu/clawock https://github.com/marketcalls/openalgo https://github.com/Ayorinha/ayorai-opensearch https://auth0.com/blog/owasp-top-10-agentic-applications-lessons https://blog.bytebytego.com/p/llm-security-basics-the-full-threat https://blog.cloudflare.com/the-agent-access-model https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3.5-transcribe https://blog.google/technology/ai/google-family-agent-2026 https://blog.modelcontextprotocol.io/posts/2026-07-28 https://brightsec.com/blog/the-2026-state-of-llm-security-key-findings-and-benchmarks https://cameronrwolfe.substack.com/p/agentic-rl https://check-point.com/blog/when-your-ai-agents-memory-becomes-a-security-liability https://cobusgreyling.medium.com/hugging-face-openai-security-incident-f7c167047f68 https://codingscape.com/blog/build-production-ai-agents-in-2026-without-deleting-your-database https://codingwithroby.substack.com/p/the-2026-ai-agent-stack-drawn-from https://csis.org/podcasts/ai-policy-podcast/openai-pauses-rl-training-and-anthropic-adds-watermarks-ai-generated https://cyberflow.substack.com/p/offensive-security-market-map-the https://cycode.com/blog/owasp-top-10-agentic-applications https://darioamodei.com/post/we-must-pace-the-frontier https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/ https://deepmind.google/blog/introducing-gemini-3-8-flash-and-38-flash-cyber/ https://deepmind.google/blog/piloting-the-worlds-first-double-blind-ai-evaluations/ https://deepmind.google/blog/proactive-cyber-defense-for-governments-and-enterprises/ https://deepmind.google/blog/securing-the-future-of-ai-agents/ https://docs.modulos.ai/frameworks/owasp-top-10-agentic https://en.wikipedia.org/wiki/2026_OpenAI_agent_cyberattacks https://epoch.ai/data-insights/cve-severity-spike https://eu.36kr.com/en/p/3989811919076098 https://explainx.ai/blog/openai-collective-cyberdefense-open-letter-august-2026 https://explainx.ai/blog/openai-frontier-rl-safety-cases-training-2026 https://finance.yahoo.com/technology/article/openai-says-its-upcoming-astra-model-may-have-critical-cybersecurity-capabilities-amid-rash-of-ai-model-hacks-194909085.html https://forbes.com/sites/johnwerner/2026/09/12/mollick-writes-about-agent-swarms-and-hugging-face-debacle https://fortune.com/2026/09/01/openais-reports-on-its-ai-agents-attack-on-hugging-face-should-be-ringing-alarm-bellsand-making-all-companies-rethink-how-they-secure-ai-agents https://fortune.com/2026/09/12/sam-altman-openai-ipo-2026/ https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026 https://github.com/CaiusDai/RecMem https://github.com/MemTensor/Metis https://github.com/advisories/GHSA-4r2x-xpjr-7cvv https://github.com/anthropics/claude-code https://github.com/cloudflare/security-audit-skill https://github.com/h5i-dev/awesome-ai-agent-incidents https://github.com/mattheliu/riskchainbench-task1 https://github.com/meridianlabs-ai/inspect_petri https://github.com/xinyuelou/SaLAD https://gofastmcp.com/servers/auth https://gradientflow.com/ai-data-centers-water-noise-power/ https://gradientflow.com/hbf-ai-inference/ https://gradientflow.com/heres-my-uncomfortable-bet-on-openai-and-anthropic/ https://gradientflow.com/i-keep-hearing-the-same-advice-about-agents/ https://gradientflow.com/i-think-we-are-looking-for-ai-risk-in-the-wrong-place/ https://gradientflow.com/nine-practical-rules-for-agents-doing-real-work/ https://gradientflow.com/passing-your-evals-doesnt-mean-youre-safe/ https://gradientflow.com/self-improvement-without-the-science-fiction/ https://gradientflow.com/the-ai-data-center-backlash-has-a-blind-spot/ https://gradientflow.com/the-biggest-ai-risks-sit-outside-the-model/ https://gradientflow.com/this-is-how-self-improving-ai-actually-starts/ https://gradientflow.com/what-counts-is-valuable-company-data-is-changing/ https://gradientflow.com/what-counts-as-valuable-company-data-is-changing/ https://ground.news/article/researchers-say-openai-agents-were-behind-may-hacking-campaign-targeting-rubygems_26e821 https://helpnetsecurity.com/2026/06/03/autonomous-ai-worm-can-reason-its-way-through-corporate-networks/ https://helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability https://huggingface.co/blog/MultiverseComputingCAI/safety-for-whom https://huggingface.co/blog/agent-intrusion-july-2026 https://huggingface.co/blog/agent-intrusion-technical-timeline https://huggingface.co/blog/agent-glossary https://huggingface.co/blog/allenai/benchmirt https://huggingface.co/blog/jeffboudier/open-model-cyber-defense https://huggingface.co/blog/security-incident-july-2026 https://huggingface.co/blog/state-of-open-models-summer-2026 https://huggingface.co/collections/cho-ai/constitutional-midtraining https://huggingface.co/papers/2604.06268 https://huggingface.co/papers/2608.00677 https://huggingface.co/papers/2609.00092 https://huggingface.co/papers/2609.00137 https://huggingface.co/papers/2609.07821 https://huggingface.co/papers/2610.12085 https://huggingface.co/papers/2610.12415 https://importai.substack.com/p/import-ai-467-self-sustaining-ai https://importai.substack.com/p/import-ai-472-deepminds-cheating https://joshuasaxe181906.substack.com/ https://labs.cloudsecurityalliance.org/agentic/agentic-mcp-security-best-practices-v1 https://labs.cloudsecurityalliance.org/research/csa-research-note-autonomous-ai-agent-swarm-hugging-face-bre https://labs.cloudsecurityalliance.org/research/csa-research-note-autonomous-ai-agent-swarm-huggingface-bre https://labs.cloudsecurityalliance.org/research/csa-research-note-huggingface-autonomous-agent-breach-202607 https://labs.cloudsecurityalliance.org/research/csa-research-note-multiagent-ai-collusion-systemic-risk-2026 https://labs.cloudsecurityalliance.org/research/csa-research-note-openai-model-sandbox-escape-huggingface-br https://labs.cloudsecurityalliance.org/research/csa-research-note-sglang-cve-2026-5760-llm-serving-rce-20260 https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA_research_note_ai_adaptive_worms_autonomous_exploitation_20260604-csa-styled.pdf https://lilianweng.github.io/posts/2026-07-04-harness/ https://magazine.sebastianraschka.com/p/claude-watermarking https://mem0.ai/blog/state-of-ai-agent-memory-2026 https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation https://mezha.net/eng/news/b60d16bc_openai_agents_targeted https://nathanbenaich.substack.com/p/europe-ai-sovereignty https://nathanbenaich.substack.com/p/fund-iii https://nathanbenaich.substack.com/p/state-of-ai-may-2026 https://news.ycombinator.com/item?id=49480466 https://news.ycombinator.com/item?id=49758250 https://nypost.com/2026/09/10/business/openai-faces-senate-probe-over-hugging-face-hack/ https://open.substack.com/pub/alexewerlof/p/owasp-top-10-ai-llm-agents https://openai.com/careers/researcher-frontier-risk-mitigations-san-francisco https://openai.com/index/ https://openai.com/index/advancing-responsible-ai-across-europe https://openai.com/index/apple-is-getting-this-wrong https://openai.com/index/australian-youth-safety-blueprint https://openai.com/index/daybreak-for-frontline-defenders https://openai.com/index/daybreak-models-are-now-available-on-aws https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows https://openai.com/index/hex-gpt-6-astra-data-agents https://openai.com/index/hugging-face-incident-and-the-road-ahead https://openai.com/index/hugging-face-model-evaluation-security-incident https://openai.com/index/introducing-private-safety-processing https://openai.com/index/model-misalignment-reporting-framework https://openai.com/index/offering-zero-data-retention-for-frontier-models https://openai.com/index/our-decision-on-cursor-following-its-acquisition-by-spacex https://openai.com/index/path-to-astra https://openai.com/index/paul-christiano-joins-openai-foundation-board https://openai.com/index/putting-frontier-cyber-models-in-more-trusted-hands https://openai.com/index/responding-next-frontier-critical-cyber-capabilities https://openai.com/index/safety-alignment-long-horizon-models https://openai.com/index/safety-overview-gpt-6-astra https://openai.com/index/sophos https://openai.com/index/asana-browser-agent https://openai.com/index/third-party-cyber-evaluations-involving-openai-models https://openai.com/index/threat-intelligence-report-detecting-and-countering-malicious-uses-of-ai https://openai.com/index/towards-safety-cases-for-frontier-ai-training https://openai.com/news https://openai.com/news/hugging-face-incident-and-the-road-ahead https://openai.com/news/path-to-astra https://orca.security/resources/blog/cve-2026-22778-vllm-rce-vulnerability https://owasp.org/www-project-agentic-skills-top-10 https://owasp.org/www-project-top-10-for-large-language-model-applications/ https://protoslabs.io/resources/openai-hugging-face-july-2026-security-incident https://ragen-ai.github.io https://ranksquire.com/2026/03/31/agent-memory-vs-rag-what-breaks-at-scale-2026 https://red.anthropic.com/2026/mythos/2025/smart-contracts https://releasebot.io/updates/anthropic https://reuters.com/legal/litigation/openai-commits-1-billion-cyberdefense-effort-amid-ai-safety-scrutiny-2026-09-03 https://rits.shanghai.nyu.edu/ai/metas-muse-spark-1-1-breached-a-company-during-cybersecurity-testing https://rohitai.com/blog/openai-daybreak-cyber-defense-models-aws-bedrock https://rubyhack.ai https://schneier.com/essays/archives/2026/10/the-genie-is-out-of-the-bottle https://siliconangle.com/2026/07/20/hugging-face-uses-open-weights-z-ai-glm-5-2-defend-attacker-commercial-frontier-model-refusal https://simonw.dev/accidental-cyberattacks https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug/ https://simonwillison.net/2026/Aug/5/incident-report/ https://simonwillison.net/2026/Aug/6/an-ai-model-from-meta/ https://simonwillison.net/2026/Aug/7/openai-timeline https://simonwillison.net/2026/Aug/8/auto-mode https://simonwillison.net/2026/Aug/28/just-a-rumour-of-a-bug/ https://simonwillison.net/2026/Aug/8/now-we-have-a-timeline-of-the-openai-accidental-attack-against-h https://simonwillison.net/2026/Sep/12 https://simonwillison.net/2026/Sep/12/openai-agents-rubygems/ https://simonwillison.net/2026/Sep/14/the-contagion-of-fear/ https://simonwillison.net/2026/Sep/18/claude-code-agents-md/ https://simonwillison.net/2026/Sep/18/gemini-felony-bench/ https://simonwillison.net/2026/Sep/29/anthropic-frontier-red-team/ https://simonwillison.net/2026/Sep/4/rogue-agent-wikis/ https://stealthbench.com https://stratechery.com/2026/whos-afraid-of-chinese-models https://tech.yahoo.com/ai/articles/rogue-openai-agents-hijacked-german-123036336.html https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models https://techcrunch.com/2026/07/30/anthropic-says-its-own-ai-models-breached-three-companies-during-security-tests https://techcrunch.com/2026/08/07/openai-says-it-slowed-astra-model-development-over-security-concerns https://techxplore.com/news/2026-06-ai-worm-networks-online-device.html https://theagenttimes.com/articles/new-research-quantifies-our-constraint-decay-problem-in-back-2b3527a1 https://theaiengineer.substack.com/p/the-ai-agents-stack-2026-edition https://thenewstack.io/tns-daily/september-4-2026 https://tildes.net/~comp/1w07/openai_agents_attacked_rubygems_back_in_may https://timesofindia.indiatimes.com/technology/tech-news/anthropic-ceo-dario-amodei-calls-on-ai-firms-to-slow-pace-of-developmen-gets-backing-from-sam-altman-elon-musk/articleshow/134146825.cms https://timesofindia.indiatimes.com/technology/tech-news/sam-altman-says-sorry-after-openais-messy-gpt-6-astra-rollout-locks-out-paying-users-but-apology-misses-out-on-this-one-promise/articleshow/133762207.cms https://tldr.tech/ai/2026-08-10 https://tldr.tech/ai/2026-09-18 https://trydeepteam.com/docs/frameworks-owasp-top-10-for-agentic-applications https://utimaco.com/news/blog-posts/when-your-ai-agent-has-keys-kingdom-zero-trust-starts-hardware-layer https://wikimediafoundation.org/news/2026/10/05/openai-agent-activity/ https://www.aboutamazon.com/news/aws/bedrock-openai-models https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing https://www.alphaxiv.org/abs/2604.16548 https://www.andrewng.org/writing https://www.anthropic.com/aug-2026-risk-report https://www.anthropic.com/claude-fable-and-mythos-5-1 https://www.anthropic.com/news https://www.anthropic.com/news/anthropic-2025-cyber-eval-update https://www.anthropic.com/news/anthropic-accenture-embedded-evaluators-202609 https://www.anthropic.com/news/claude-commerce-agents https://www.anthropic.com/news/claude-fable-5-1-and-mythos-5-1-system-cards https://www.anthropic.com/news/claude-opus-5 https://www.anthropic.com/news/claude-projects-v2 https://www.anthropic.com/news/enabling-independent-research-on-how-people-use-claude https://www.anthropic.com/news/improving-fable-5-s-biology-safeguards https://www.anthropic.com/news/threat-intelligence-report-detecting-and-countering-malicious-uses-of-ai https://www.anthropic.com/research/automated-researchers-mitigate-alignment-failures https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities https://www.anthropic.com/threat-intelligence-report-september-2026 https://www.bleepingcomputer.com/news/security/openai-agent-cluster-wikimedia/ https://www.buildfastwithai.com/blogs/claude-fable-5-returns-july-2026-what-changed https://www.coalitionforsecureai.org/securing-the-ai-agent-revolution-a-practical-guide-to-mcp-security https://www.csis.org/podcasts/ai-policy-podcast/openai-pauses-rl-training-and-anthropic-adds-watermarks-ai-generated https://www.datadoghq.com/state-of-ai-engineering https://www.decryptiondigest.com/blog/autonomous-ai-agents-offensive-security-2026 https://www.developersdigest.tech/blog/cloudflare-agent-access-model-2026 https://www.dipankar.co/articles/ai-agent-safety-substrate-pattern-practice https://www.docker.com/blog/29-million-secret-problem-ai-coding-agents https://www.euronews.com/2026/10/07/openai-agents-wikimedia-huggingface/ https://www.frontierriskmonitor.org https://www.grantthornton.com/ https://www.greaterwrong.com/posts/n5htoDGvKKJFAjji2/constitutional-midtraining-content-presidence-drives-alignment-1 https://www.heise.de/en/news/IT-researchers-demonstrate-adaptive-AI-worm-11318259.html https://www.interconnects.ai/p/latest-open-artifacts-24-motif-3 https://www.interconnects.ai/p/one-resignation-turned-the-embers https://www.interconnects.ai/p/open-source-ai-reading-list https://www.interconnects.ai/p/teaching-everyone-to-fish-for-tokens https://www.interconnects.ai/p/the-cyber-risk-discourse-is-broken https://www.interconnects.ai/p/when-will-average-people-feel-ais https://www.ithome.com/0/984/365.htm https://www.jpost.com/international/article-907603 https://www.kb.cert.org/vuls/id/665416 https://www.kodemsecurity.com/cve-archive/package/sglang https://www.ox.security/blog/cve-2026-22778-vllm-rce-vulnerability https://www.practical-devsecops.com/owasp-top-10-agentic-applications https://www.radware.com/blog/anthropic-claude-mythos-and-the-2026-cybersecurity-landscape https://www.reuters.com/legal/litigation/openai-commits-1-billion-cyberdefense-effort-amid-ai-safety-scrutiny-2026-09-03 https://www.sentinelone.com/vulnerability-database/cve-2026-22778 https://www.storyboard18.com/amp/digital/openai-ai-agents-attacked-rubygems-months-before-hugging-face-hack-110515.htm https://www.techzine.eu/news/security/144072/openai-agents-turned-a-german-wiki-into-a-secret-message-board https://www.theinformation.com/articles/meta-ai-model-hacked-another-company-cybersecurity-testing https://www.theregister.com/ai-and-ml/2026/09/18/anthropic-decides-to-support-openais-markdown-instructions-spec/ https://www.theverge.com/ai-artificial-intelligence/990060/altman-apologizes-messy-astra-rollout https://www.unite.ai/openai-daybreak-cyber-defense-models-land-on-amazon-bedrock https://www.unite.ai/sam-altman-apologizes-as-gpt-6-astra-staged-launch-denies-paid-access https://www.vectra.ai/blog/an-autonomous-ai-agent-compromised-hugging-face-the-response-is-the-real-story https://www.vulncheck.com/blog/anthropic-glasswing-cves https://www.youtube.com/@TwoMinutePapers https://www.youtube.com/watch?v=87DyyMV0kCY https://www.youtube.com/watch?v=87DyyMV7kCY https://www.youtube.com/watch?v=AIExplained-GPT6 https://www.youtube.com/watch?v=J3ljHm57yU0 https://www.youtube.com/watch?v=JQQYhNK6AyU https://www.youtube.com/watch?v=KL9_1GbmCic https://www.youtube.com/watch?v=Spuza-KwTJ4 https://www.youtube.com/watch?v=sLt0EmA1S44 https://www.youtube.com/watch?v=wzY2fV4Mp3U https://www.youtube.com/watch?v=xGzseSSStnw https://x.com/AINativeF/status/2088059514356736165 https://x.com/AISafetyMemes/status/2085129043956097299 https://x.com/AndrewYNg/status/2098459474608672916 https://x.com/AnthropicAI/status/2070665903440871779 https://x.com/AnthropicAI/status/2085801349866729975 https://x.com/AnthropicAI/status/2093038426140651791 https://x.com/AnthropicAI/status/2098097512544444447 https://x.com/DarioAmodei/status/2098773920774074715 https://x.com/OpenAI/status/2084747580693426555 https://x.com/OpenAI/status/2085801349866729975 https://x.com/OpenAI/status/2103587050347995581 https://x.com/StevenLevy/status/2085033716552810633 https://x.com/Thom_Wolf/status/2098080470235762702 https://x.com/anthropicai/ https://x.com/emollick https://x.com/emollick/status/2094617053730685054 https://x.com/emollick/status/2098428962468700197 https://x.com/emollick/status/2098812026944454715 https://x.com/huggingface https://x.com/hwchase17/status/2102087963517550667 https://x.com/karpathy/status/2098811935114551617 https://x.com/sama https://x.com/sama/status/2092339694210040187 https://x.com/sama/status/2093060670472241368 https://x.com/sama/status/2095678759651438887 https://x.com/sama/status/2095973658867171733 https://x.com/sama/status/2097776310940569783 https://x.com/sama/status/2103567198690349362 https://x.com/ylecun/status/2099496673990815862 https://yongjoopark.github.io/slotguard https://youtube.com/watch?v=INGOC6-LLv0 https://arxiv.org/abs/2609.21094 https://simonwillison.net/2026/Oct/7/openai-rogue-agent-wikimedia/ https://zylos.ai/research/2026-03-18-emergent-behavior-large-scale-multi-agent-systems https://arxiv.org/abs/2410.21276 https://arxiv.org/abs/2603.15031 https://arxiv.org/abs/2510.09665 https://www.usenix.org/system/files/usenixsecurity26-zhang-yichi.pdf https://magazine.sebastianraschka.com/p/llm-research-papers-2026-part1 https://github.com/KCNyu/clawock https://github.com/marketcalls/openalgo https://github.com/Ayorinha/ayorai-opensearch https://github.com/Daniel221287/mcp-human-approval-gate https://github.com/Fazmin/cve-intel https://github.com/syhunt/php2shell-protection https://github.com/soporte-defontsoft/delphi-ide-remote-mcp https://en.wikipedia.org/wiki/PHP2Shell https://watchtowr.com/intelligence/php-cve-2026-109618-faq https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php https://sansec.io/research/php2shell https://ubuntu.com/blog/php2shell-vulnerability-fixes-available https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
2605.13831 2606.06090
CVE-2026-77521 CVE-2026-77522 CVE-2026-77523 CVE-2026-39419 CVE-2026-59822
10.48550/arxiv.2605.13831 10.48550/arxiv.2606.06090
https://www.lasso.security/blog/cve-2026-77521-maxkbypass---from-prompt-injection-to-bypassing-maxkb-agents-sandbox https://nvd.nist.gov/vuln/detail/CVE-2026-77521 https://www.cve.org/CVERecord?id=CVE-2026-77521 https://app.opencve.io/cve?product=maxkb&vendor=1panel https://www.sentinelone.com/vulnerability-database/cve-2026-39419 https://www.pillar.security/blog/the-week-of-sandbox-escapes https://www.pillar.security/blog/open-and-shut-remote-code-execution-in-opencode-via-mcp-oauth https://adversa.ai/blog/top-ai-agent-security-resources-october-2026 https://labs.cloudsecurityalliance.org/research/csa-research-note-indirect-prompt-injection-in-the-wild-2026 https://www.sysdig.com/learn-cloud-native/prompt-injection https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem https://www.frontiermodelforum.org/issue-briefs/emerging-security-practices-for-ai-agents https://github.com/1Panel-dev/MaxKB https://github.com/yunqing-me/AttackVLM https://github.com/pastawithpesto/PS5-14.10-Jailbreak-Research https://github.com/pastawithpesto/PS5-14.10-Jailbreak-Research/blob/master/README.md https://www.notebookcheck.net/PS5-console-jailbreak-on-latest-14-10-firmware-shared-before-GTA-6-release-date.1428405.0.html https://medium.com/@npavfan2facts/the-alignment-tax-in-rlhf-the-real-bill-b9c0cadff35e https://cameronrwolfe.substack.com/p/the-story-of-rlhf-origins-motivations https://github.com/opendilab/awesome-RLHF https://arxiv.org/abs/2309.16609 https://arxiv.org/pdf/2309.16609 https://arxiv.org/abs/2009.01325 https://arxiv.org/pdf/2009.01325 https://arxiv.org/abs/2402.06196 https://arxiv.org/pdf/2402.06196 https://arxiv.org/abs/2303.12712 https://arxiv.org/pdf/2303.12712 https://arxiv.org/abs/2204.14198 https://arxiv.org/pdf/2204.14198 https://arxiv.org/abs/2203.02155 https://arxiv.org/pdf/2203.02155
本次变更
(2026-10-24 17:10 CST · flyP · R109 10-24 · 本轮清单 8 件增量(4 paper_card 承接 + 4 repo_card 净新)。结构性判断升级:本轮是本主轴开篇以来第一次出现「防守侧具象件与攻击侧证据同量级」的批次 ⚠⚬⚬ —— 前 108 轮全是事后事故链,本轮首次出现事故之前的防守工具形态;核心论断:当防守控制面第一次以「Agent 可调用的工具面」形态交付时,它同时进入两条风险路径 —— 降低既有失守点发生率,同时其自身输入面成为新的注入点 ⚠⚬⚬,据此把 R108「防御性代码路径是攻击面」规则扩到组件类别(Q237)。paper NET-new = 0 件 ⚠⚬(逐份核对确认全为承接,未把采集时间/被引变化当新观点):2410.21276 GPT-4o System Card(R106 · 须标时点)/ 2603.15031 Raschka 2026 清单(R104 · 按 #118 只作引用锚 · ⚠ 编号/标题错配:卡内时间线把该号自身列为 "Attention Residuals",按编号+标题核验会引错)/ 2605.13831 MMProLong(R107 · 削弱「模型读不远」假设)/ 2606.06090 MAGE(R107 · 唯一缝合线索:分层状态树与 exact preview 同为「结构化状态」,非本轮增量)。repo NET-new = 4 件 ⚠⚬⚬:① syhunt/php2shell-protection(76 Star · PHP · MIT · experimental · 待LLM分类=是)—— 本轮唯一 CVE 硬资产来源,经 2 次 web_search 把 CVE 细节补齐到可核查级:CVSS v4.0 9.2(六源一致)· 披露 10-21 14:00 UTC 因公开泄露提前一日 · PHP 核心请求引擎 use-after-free · 受影响可追溯至 PHP 5.4.0(2012),修复于 8.5.12/8.4.27/8.3.36/8.2.35 · AWS 观测 10-17 即有在野利用尝试 + watchTowr 蜜罐确认 · CISA KEV 未收录 · 应用层认证无法阻止 · 两 CVE 为独立缺陷家族 · 影响面覆盖 Magento/WordPress/Drupal/Joomla/MediaWiki/phpMyAdmin/Nextcloud/Laravel/Symfony/WHMCS)⚠⚬⚬;② Fazmin/cve-intel(92 Star · 周增 +21 本批增速最高 · Rust · trending · experimental)—— 39 数据源 / 36 tools / risk score / MCP server / Private by default,填补主轴长期缺的巡检侧具象件,并给出「CVE 情报 → Agent 可调用工具面」形态迁移本身即新注入面(39 数据源 = 39 信任边界)⚠⚬⚬;③ Daniel221287/mcp-human-approval-gate(Stars 0 · JS · MIT · skill · experimental · 首次采集当日即 0 star)—— 审批层从「失守证据」到「存在设计样本」的第一例,「approves the exact preview + runs it once」恰好堵住 R107 SSMS 只读模式块名单被正则绕过的具体手法(审批对象从类别绑到具体动作内容 + 消除批准/执行间 TOCTOU 窗口)⚠⚬;⚠ 必须降级表述:无 README/测试/issue/负面结论,连 R108 采信下限都未达;④ soporte-defontsoft/delphi-ide-remote-mcp(21 Star · Pascal · MIT · skill · experimental)—— 「MCP server 的真实权力 = 被代理主机的完整权限,而不是它声明的 tool 列表」,把 R107 协议层论断推到工具宿主层,构建→部署→PAServer→adb→vault 全链,与 R107 interrupt_on 漏配 execute 同构 ⚠⚬⚬;⚠「per-workspace security」为作者主张。硬资产 NET-new:arXiv 0 件 · CVE 2 件(CVE-2026-109618 / CVE-2026-109619)· DOI 2 件(10.48550/arxiv.2410.21276 / 10.48550/arxiv.2603.15031 —— 前两轮未入册)· URL 11 条(4 repo GitHub + 7 条 php2shell 核实链接)。共识 #134–#137 4 条(#134 引擎级缺陷使应用层安全控制整体失效 = 第一次「下游控制面对上游引擎缺陷无效」的结构性结论 / #135 攻击面转移在 HTTP 层的重演 / #136 审批可信度取决于审批对象绑定的粒度,证据不对称:反例有一等实证,正例只有设计意图 / #137 MCP server 真实权力 = 被代理主机完整权限)+ 争议 #119–#122 4 条(#119 协调披露实际成本:在野尝试 10-17 → 补丁 10-21 共 4 天,披露原定 10-22 因泄露提前 / #120 应急缓解件的检测逻辑未公开,是否制造新绕过面无法判定 / #121 上游采集重心漂移:paper 侧连续两日归零、repo 侧连续两日放量(1→4),风险主轴会系统性从「有 CVE 与论文的实证」滑向「有人点赞的仓库」⚠⚬ / #122 Agent 生成的安全预览是否可作审批依据)+ Q234-Q241 8 条 P1 + 趋势一-八十五 ~ 六。来源:宿主机清单 8 份 materials 逐份实读 + 活文档 R108 全文 + inbox/flyp/2026-10-24-risk-e1prep.md + 2 次 web_search(PHP2Shell 多源核实 / approval-gate 检索,后者无该仓库足迹);未全库扫描,未把采集时间或被引变化当新观点,未虚构;CVE 细节标注来源层级(六源交叉一致=高可信;「利用需特定服务器条件」为 Sansec 单源且与 Abstract 存在时间差,采信更早的 AWS 时间戳与蜜罐观测并标注分歧)。)
(2026-10-23 17:10 CST · flyP · R108 10-23 · 本轮清单 8 件增量(6 paper_card + 1 repo_card + 1 承接位)。新增轴线:承 R107 四元链,新增「训练期对齐物化为运行时信任边界」正交轴 —— 核心论断「对齐的泛化边界 = 训练分布边界,而 Agent 运行时大部分代码不在训练分布内,故运行时防线必须独立建设」⚠⚬⚬。paper NET-new = 5 件 ⚠⚬⚬(此前从未进入本主轴):① arXiv:2203.02155 InstructGPT(card 810 · S2 25129 · 对齐=训练期动作范式奠基,三条被默认前提的出处);② arXiv:2009.01325 摘要 RLHF(card 1809 · S2 3588 · 「奖励模型泛化到新数据集」实为同任务域内跨数据集,被下游外推为跨域 —— 本轮最易误读的一条);③ arXiv:2309.16609 Qwen(card 1810 · S2 4482 · 「基座+对话」分层 = 对齐只作用在 chat 层,基座未对齐 → #117 前提失效通道);④ arXiv:2303.12712 Sparks of AGI GPT-4(card 435 · S2 4503 · 事后归责锚点);⑤ arXiv:2204.14198 Flamingo(card 437 · S2 6778 · 「任意交错图文序列」= 交错结构本身扩大注入面,与 R107 AttackVLM 形成技术依据对照);⑥ arXiv:2402.06196 LLM Survey(card 452 · S2 1138 / 影响力被引 55,比值 0.048 → 明确降级为「只作引用锚、不提取安全主张」,争议 #118)。承接:arXiv:2004.07213(card 1571 · 513)已锚入 R104,本轮无新观点。repo NET-new = 1 件 ⚠⚬⚬:pastawithpesto/PS5-14.10-Jailbreak-Research(card 4581 · 117 Star · JavaScript · trending · experimental · 首次采集 · 实机环境 PS5 固件 14.10 / Safari 17.0 / AppleWebKit 605.1.15 / JIT 禁用 LLInt-only / Gigacage 已禁用 / StructureID 未验证 · 2 新 bug + 2 已知未修补 CVE · 20+ 攻击面审计 · CSSFontFace UAF CVE-2026-43715 实机部署 · TransformStream 双迭代类型混淆:防御性重复迭代成为混淆注入点,上游 Safari 26.5.2(2026-06)已修补而 PS5 14.10 仍活跃,断开连接本身不产生内存破坏 · p150g-k 5 种堆喷洒全部 OOM/崩溃 + p160 Relapse CVE 集全部已修补 = 负面结论入正文表;项目使用多个不同 AI 模型挖掘 WebKit 漏洞,来自二次报道 ⚠⚬;README 首行即「授权的安全研究,自有机型,教育与研究用途」免责声明,引用须保留授权语境)。硬资产 NET-new:arXiv 6 件(2309.16609 / 2009.01325 / 2402.06196 / 2303.12712 / 2204.14198 / 2203.02155)· CVE NET-new = 0 件(CVE-2026-43715 经核对已在本主轴 R105 集合中,不重复计数,仅正文标注来源)· DOI 6 件 · URL 15 条(PS5 GitHub ×2 + notebookcheck + Medium RLHF 对齐税 + Cameron Wolfe RLHF 起源 + awesome-RLHF + 6 篇 arXiv abs/pdf)。共识 #131–#133 3 条(#131 对齐泛化边界=训练分布边界,运行时防线不可代偿 / #132 禁用 JIT 不构成沙箱边界 / #133 防御性重复遍历路径本身是攻击面候选,与 R107 interrupt_on 未含 execute 同构)+ 争议 #115–#118 4 条(#115 AI 辅助漏洞挖掘已落在消费设备固件层是否触发 frontier 级披露 / #116 奖励模型泛化被外推 / #117 基座层未对齐 + 下游绕过 chat 层包装 / #118 综述类文献采信规则)+ Q227-Q233 7 条 P1 + 趋势一-八十四 ~ 四。来源:宿主机清单 8 份材料 + 2 次 web_search(PS5 14.10 项目详情 + RLHF 当代奖励模型失败模式批评);未全库扫描,未把采集时间或被引变化当新观点;未虚构。)
(2026-10-21 17:10 CST · flyP · R107 10-21 · 清单 8 件增量(3 paper + 4 repo + 1 inbox 协调检查)。结构性判断升级:攻击面从「提示注入」单点迁移为「注入 × 沙箱能力暴露 × 审批旁路 × 输出可信性」四元链 ⚠⚬⚬。paper NET-new 2 件:arXiv:2605.13831 MMProLong(S2 1 · 削弱「模型读不远」缓解假设)+ arXiv:2606.06090 MAGE(S2 8 · 分层状态树 · 成功率 +7.8–20.4 pp · token −55.1% · 执行状态连续性 = 错误级联放大器)。repo:CVE-2026-77521 MaxKB(Critical 10.0 · SandboxShellBackend 暴露 execute 未列入 interrupt_on = 审批旁路;修复 08-06 / 公开 09-02 / NVD 09-21)+ 同族 77523(High 7.4)/77522(Medium 4.3)同日 = 系统性审计释放;CVE-2026-39419(帧内省读 UUID → 向 fd 1 写伪造工具结果 → sys.exit(0) = 输出可信性失守);yunqing-me/AttackVLM(多模态攻击面第 1 例);ZigZagBoi1/PS5-14.10-Research(219 Star · 周增 +518 · 明确声明未演示内核读写与完整 exploit = 负向披露采信下限模板);KCNyu/clawock(21 Star 续增 · 与 77521 反向互证)。SSMS Copilot 只读模式被正则块名单绕过 + opencode MCP OAuth RCE 分别提供审批层与协议层证据。硬资产:arXiv 2 · CVE 5 · DOI 2 · URL 13。共识 #127–#130 + 争议 #111–#114 + Q220-Q226 7 条 P1 + 趋势一-八十三。来源:宿主机清单 8 份材料 + 2 次 web_search(限 10-19→10-21)。)