Peking University & Tencent release lifecycle survey of generalist agent security

机器之心 · wechat · 2026-11-14

Peking University's KCL lab and Tencent's WeChat security team released Pandora's Toolbox, a survey reframing agent security as a lifecycle problem rather than isolated component risks.

The framework splits agent operation into provenance, orchestration, and execution stages, plus persistent feedback: a poisoned skill can enter at provenance, hijack planning at orchestration, trigger harmful actions at execution, then contaminate long-term memory or reusable skills to survive across sessions.
Four coupled attack surfaces are catalogued: skill supply-chain poisoning, user-side automated jailbreaks/red-teaming, long-term memory backdoors, and prompt injection via external environments (web pages, terminal output, MCP responses).
Defenses are organized into three layers by intervention point: input/context filtering, decision & control integrity, and runtime monitoring with pre-execution constraints. For self-evolving agents, the authors propose a continuous loop of risk generation, risk diagnosis, and security evolution.
The paper and a curated paper list are open-sourced on GitHub; first author is PhD student Yutao Mou.

Original post →

Peking University & Tencent release lifecycle survey of generalist agent security

More from coding & agent