{
 "generated": "2026-11-02",
 "node": {
  "id": "map:agent-security",
  "type": "Map",
  "name": "Agent 安全攻击面",
  "slug": "agent-security",
  "map_kind": "structure",
  "page": "/graph/e/map/agent-security/",
  "h1": "Agent 安全",
  "scope": "这张图不是理论分类，每一类都尽量配真实发生过的事故（而不只是学术论文里的概念验证）。配色约定： 红色 = 已确认的真实事故 ， 绿色 = 经同行评审的学术研究/概念验证，尚无实锤事故 ， 紫色 = 框架/防御手段 。未核实的传闻类信息一律不收录或明确标注\"未核实\"。",
  "methodology": "入选门槛——真实事故类必须有可核实的一手来源（厂商自曝、CVE记录、可信安全研究机构披露）；学术研究类必须已发表或在arXiv上可查证元数据。纯传闻、未能独立核实的信息一律不收录或明确标注\"未核实\"（例如\"The Cutting Room Floor\"投毒网站的传闻，因关键证据仓库不存在，本图未采信）。鉴于该领域几乎每月都有新的真实事故披露，建议保持较高频率复核。",
  "overview_caption": "四类攻击面独立发生，升级为破坏性执行后落入沙盒逃逸/越权；失控遏制是唯一的下游治理层，公开评估显示普遍不及格",
  "badges": [
   "最后更新 2026-08-26",
   "当前版本 v1",
   "下次复核 ~2026-09"
  ],
  "version": 2,
  "first_published": "2026-08-26",
  "last_updated": "2026-08-26",
  "next_review": "~2026-09",
  "summary": "自主 AI Agent 安全攻击面的持续更新结构图：提示词注入、工具/MCP滥用、记忆/RAG污染、多智能体串谋、沙盒逃逸、失控遏制六类风险，配 OWASP/MITRE ATLAS 等权威框架与真实事故案例，标注哪些是已确认事故、哪些仍停留在学术研究阶段。",
  "tags": [
   "landscape",
   "agent",
   "security",
   "prompt-injection",
   "mcp",
   "containment"
  ],
  "version_log": [
   {
    "v": 1,
    "date": "2026-08-26",
    "summary": "首次建立：覆盖7个分类（权威框架/提示词注入/工具MCP滥用/记忆RAG污染/多智能体风险/沙盒逃逸/失控遏制），每条真实事故均核实一手来源"
   },
   {
    "v": 2,
    "date": "2026-08-26",
    "summary": "补充EP.98/99窗口内结构性变化：新增GLM-5.3分级发布、Copilot拒绝话术侧信道、追凶Neo在野攻击Agent、Wiz/Snowflake漏洞闭环；更新OpenAI HF突破细节与Preparedness团队解散状态"
   }
  ],
  "changelog": [
   {
    "date": "2026-08-26",
    "version": "v1",
    "text": "首次建立：覆盖7个分类（权威框架/提示词注入/工具MCP滥用/记忆RAG污染/多智能体风险/沙盒逃逸/失控遏制），基于并行研究（框架与遏制；提示词注入与工具滥用；记忆污染与多智能体）汇总整理，每条真实事故均直接核实来源可达。"
   },
   {
    "date": "2026-08-26",
    "version": "v2",
    "text": "补充 EP.98/EP.99 窗口内（08-07~08-21）结构性变化：新增智谱GLM-5.3分级发布+开源之盾、Microsoft Copilot拒绝话术侧信道、\"追凶Neo\"在野攻击型Agent、Wiz/Snowflake AI生成代码漏洞闭环；更新OpenAI HF突破事件（Wired后续追踪细节）与Preparedness框架（团队已解散）状态。"
   }
  ],
  "tech_legend": {},
  "n_layers": 7,
  "n_rows": 34,
  "degree": 0
 },
 "page": "https://xiaopingfeng.com/graph/e/map/agent-security/",
 "out": [],
 "in": [
  {
   "type": "in_map",
   "sentence": "权威框架属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "layer:agent-security--1",
   "name": "权威框架",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的Layer 01「权威框架」",
     "url": "https://xiaopingfeng.com/graph/e/layer/agent-security--1/"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "提示词注入属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "layer:agent-security--2",
   "name": "提示词注入",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的Layer 02「提示词注入」",
     "url": "https://xiaopingfeng.com/graph/e/layer/agent-security--2/"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "工具调用 / MCP滥用属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "layer:agent-security--3",
   "name": "工具调用 / MCP滥用",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的Layer 03「工具调用 / MCP滥用」",
     "url": "https://xiaopingfeng.com/graph/e/layer/agent-security--3/"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "记忆 / RAG污染属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "layer:agent-security--4",
   "name": "记忆 / RAG污染",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的Layer 04「记忆 / RAG污染」",
     "url": "https://xiaopingfeng.com/graph/e/layer/agent-security--4/"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "多智能体风险属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "layer:agent-security--5",
   "name": "多智能体风险",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的Layer 05「多智能体风险」",
     "url": "https://xiaopingfeng.com/graph/e/layer/agent-security--5/"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "沙盒逃逸 / 越权操作属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "layer:agent-security--6",
   "name": "沙盒逃逸 / 越权操作",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的Layer 06「沙盒逃逸 / 越权操作」",
     "url": "https://xiaopingfeng.com/graph/e/layer/agent-security--6/"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "失控遏制属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "layer:agent-security--7",
   "name": "失控遏制",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的Layer 07「失控遏制」",
     "url": "https://xiaopingfeng.com/graph/e/layer/agent-security--7/"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "OWASP、MITRE 都专门为\"Agent\"扩展了分类体系。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--1",
   "name": "OWASP、MITRE 都专门为\"Agent\"扩展了分类体系。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 1 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "MCP供应链出现第一起真实野外投毒事件。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--2",
   "name": "MCP供应链出现第一起真实野外投毒事件。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 2 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "Anthropic自己的红队研究证实了多智能体串谋不是假设。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--3",
   "name": "Anthropic自己的红队研究证实了多智能体串谋不是假设。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 3 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "独立评估显示\"失控遏制\"是行业最大的短板。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--4",
   "name": "独立评估显示\"失控遏制\"是行业最大的短板。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 4 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "提示词注入已经从\"理论风险\"变成\"每家都中过招\"。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--5",
   "name": "提示词注入已经从\"理论风险\"变成\"每家都中过招\"。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 5 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "攻击面第一次出现在\"拒绝\"本身。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--6",
   "name": "攻击面第一次出现在\"拒绝\"本身。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 6 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "\"AI生成代码引入漏洞、被另一个AI攻破\"完成了完整闭环的首次官方确认。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--7",
   "name": "\"AI生成代码引入漏洞、被另一个AI攻破\"完成了完整闭环的首次官方确认。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 7 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "开放权重厂商第一次主动给危险能力加分级授权闸门，且把闸门反过来当作\"更安全\"的论据。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--8",
   "name": "开放权重厂商第一次主动给危险能力加分级授权闸门，且把闸门反过来当作\"更安全\"的论据。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 8 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "\"失控遏制\"这个短板本轮进一步恶化。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--9",
   "name": "\"失控遏制\"这个短板本轮进一步恶化。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 9 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  },
  {
   "type": "in_map",
   "sentence": "野外首次抓获成规模运营的攻击型AI Agent。属于图谱「Agent 安全攻击面」",
   "direction": "in",
   "id": "trend:agent-security--10",
   "name": "野外首次抓获成规模运营的攻击型AI Agent。",
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」的「最近的关键变化」第 10 条",
     "url": "https://xiaopingfeng.com/graph/e/map/agent-security/#trends"
    }
   ]
  }
 ]
}