SURL AI News
繁中English日本語

Archive

AI 安全

模型安全、資安、隱私、供應鏈、紅隊與防護。

代理工具

Anthropic Merges Claude Chat and Cowork, Enabling Automatic Selection of Agent Tools and Execution Environments Within a Single Conversation

Claude can now answer questions or launch long-running agentic tasks within the same conversation, while bringing documents, slides, and design tools into a shared context. With mode selection removed, tool routing and permission prompts become the new security boundary, while access to local files and computer use still depend on the desktop app.
AI 安全

Google Uses Three-Layer Trace Analysis to Audit Agent Behavior, but Anomaly Detection Happens After Tool Execution

Gemini Enterprise Agent Platform’s Agent Anomaly Detection asynchronously analyzes OpenTelemetry traces, tool parameters, and execution flows, then uses lightweight models and LLMs to identify anomalies. The private preview adds no latency to real-time requests, but the tradeoff is that it primarily provides post-event detection and requires storing raw telemetry containing prompt and response content.
AI 安全

HazardAuditor Unifies Trajectories from Four Computer-Use Agents and Trains a Safety Gatekeeper with Sequence-Level Rewards

HazardAuditor converts tool executions from Claude Code, Codex, Hermes, and OpenClaw into a shared event format, then determines whether the overall behavior is safe. Its new GuardPO method makes the final safety verdict drive model updates, but the research data has not been released, and gains of up to 16.5 percentage points still await independent replication.
AI 安全

SWEADV Uses Malicious Issues to Mislead Repair Agents: Over Half Fix the Functionality While Introducing Vulnerabilities

A new benchmark rewrites 150 SWE-bench Verified tasks into 750 issues containing security traps, testing whether automated repair agents will deliver code that is functionally correct but insecure. Across three model backends, an average of 51.7% of cases achieved both the repair and attack objectives, while common model reviews and static analysis still missed many malicious patches.
AI 安全

“Plan Injection” Makes Models Rewrite External Faulty Reasoning as Their Own—and Evade Chain-of-Thought Monitoring

New research finds that malicious plans phrased in benign language and inserted into context can be absorbed, rewritten, and executed by models, with even the strongest monitors missing at least a quarter of attacks. Showing monitors the original injected content or increasing the reasoning budget does not reliably improve detection, suggesting that agents cannot establish their safety solely through their output chain of thought.
AI 安全

SAILS Shows Backdoor Success Depends on the Poisoned Sample Set, While Random Sampling May Underestimate Worst-Case Risk

With the model, clean data, and number of poisoned samples held constant, a new study changed only the composition of the poisoned sample set and saw attack success rates on Llama 3 8B range from 3% to 80%. SAILS trains a set-scoring model using a small number of costly fine-tuning evaluations, then selects high-risk sets from millions of candidate combinations.
代理工具

Stellar Colosseum Breaks Long Proofs Into Agent Competitions, Reaching 71% on TCS-Bench With Cross-Model Selection

Google Research has unveiled Stellar Colosseum, which manages long-horizon mathematical research through strategy exploration, counterexample attacks, dependency graphs, and hierarchical aggregation. The system scored 71% on the 300-problem TCS-Bench, but the result relies on extensive inference and automated grading and should not be treated as evidence of a model’s independent proving ability.
AI 安全

OpenMAIC 1.0.2 Fixes DNS Rebinding and Cloud Metadata SSRF, Blocks Classroom Overwrites

OpenMAIC’s media proxy previously resolved DNS again after validating a domain, allowing an external hostname to point to an internal network at connection time; another path permitted access to an Alibaba Cloud metadata address. Version 1.0.2 now connects using a pinned resolution result and generates classroom IDs server-side, but the changes may affect deployments that access local models over CGNAT ranges used by Tailscale and similar services.
AI 安全

MCP Tool Annotations Remain Too Limited to Support Transaction Safety, Study Catalogs Eight Types of Agentic External-Side-Effect Anomalies

A new study categorizes eight types of external-state anomalies caused by agent retries, parallel execution, and compensation, showing that a successful response from an individual tool does not guarantee consistency across the overall workflow. A survey of 98,291 MCP tools found that annotation fields are common but cannot express outcome confirmation, staged commits, compensation, or cross-call dependencies.
AI 安全

Hugging Face’s Python SDK Detects Agent Tools and Labels Hub Requests, Prompting the Community to Reexamine Telemetry Boundaries

A community audit found that `huggingface_hub` identifies agents such as Codex, Claude Code, and Cursor through environment variables and adds their names to the User-Agent header of Hub requests. The mechanism has long been publicly documented by Hugging Face, but the documentation still does not clearly explain whether general telemetry opt-out settings fully cover agent labeling.