AI Wiki — Knowledge Base

Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming

arXiv:2606.05233v1 Announce Type: cross Abstract: Recent computer-using-agent (CUA) red-teaming papers report prompt-injection attack success rates (ASR) of 42-98%, but these headline numbers cluster

model-releasesarxiv-cs-cl

5 Jun 2026

Search: “prompt-injection”

RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems

PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift

Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense

Passing the Test You Trained On: Re-evaluating Prompt-Injection Detectors for LLM Agents

Confidently Wrong: Severity-Aware Calibration of Prompt-Injection Detectors under Attack Shift

Semalith v1.4: A Calibrated 184M Safety Classifier Achieving State-of-the-Art Prompt-Injection Detection at 44x Fewer Parameters than Llama-Guard-3-8B

Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails

CoRL: Co-Evolutionary Reinforcement Learning for Adaptive Indirect Prompt-Injection Attacks and Defenses

Visible Reasoning and Indirect Prompt-Injection Monitorability Across English, Tamil, and Tanglish

Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure

ESLD (External Surrogate Latent Defense): A Latent-Space Architecture for Faster, Stronger Prompt-Injection Defense

GPT-Red: Unlocking Self-Improvement for Robustness

Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

Hiding in Plain Floats: Steganographic Carriers for Indirect Prompt and Content Injection

Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming

Gate AI: LLM Security Benchmark Evaluation Methodology and Results

LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injectio

Is Chain-of-Thought Really Not Explainability? Chain-of-Thought Can Be Faithful without Hint Verbalization

Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation

Forensic Trajectory Signatures for Agent Memory Poisoning Detection

Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices

BatteryPass-12K: The First Dataset for the Novel Digital Battery Passport Conformance Task

LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge

One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails

Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience

Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wild

SecJev: Bringing Security Expertise to System One Decision Models

Memetic Trojans: Social Contagions as Carriers of Adversarial Payloads in Agent Networks

CALIBUDGET: Calibration-Guided Source Allocation for Fixed-Budget Mixed-Reasoning Adaptation

Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning

Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions

ActGov: Governing LLM Agent Actions via Policy-Constrained Validation

Zero-Trust Authorization and Discovery for Enterprise MCP

Deep Noir: Autonomous Steering Discovery via Architectural Chronometry in Transformer Models

Self-generated prompt injections in compaction summaries

Latent Undertow: How Ordinary Typos Break Probes

Thinking that we’ll get safety by CoT traces is wishful thinking. Safety lives in the harness, not the chain of thought

Persistent Sparse Autoencoders: Learning Feature-Specific Timescales in Language Model Representations

FocusAgent: Simple Yet Effective Ways of Trimming the Large Context of Web Agents

Not Safe for All: Auditing the Dialect Penalty in Text-to-Image Safety Pipelines

Qwen3.8-Flash-Next-NVFP4 vs Qwen3.8-27B-FP Test Results

The Latent Diagnostic Taxonomy: A Framework for Constructing Classifiers and Diagnosing Their Decisions, Applied to Prompt Injection Detection

Breaking Claude Code Opus 5 Auto Mode

Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)

WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents

If alignment issues are becoming big enough that OpenAI is willing to commit 20% of research inference compute to chain-of-thought monitorin…