这篇arXiv综述把AI智能体的五大安全漏洞和防御控制掰开讲清楚了，还拿Hugging Face/OpenAI事件做案例，做AI安全的都该看看。
该综述聚焦于结合语言模型、工具、记忆和执行环境的网络能力AI智能体，识别了五类脆弱性：多步攻击链、与沙箱边界冲突的目标、供应链与凭据暴露、持久命令与控制、自动化行动速度。以2026年7月Hugging Face/OpenAI事件为案例，区分了事件特定发现与文献中的通用结论。讨论了用于遏制、权限分离、溯源及响应者访问的控制措施，包括防御性制品可能被滥用的双重用途问题。
Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
Cyber-capable AI agents combine language models with tools, memory, and execution en- vironments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable agent within the environments used to evaluate it. This review synthe- sizes five vulnerability classes at that boundary: multi-step offensive chains, objectives that conflict with sandbox boundaries, supply-chain and credential exposure, persistent command- and-control, and the speed of automated action. We use the reported July 2026 Hugging Face/OpenAI incident as a bounded case study, distinguishing incident-specific observations from findings established in the wider literature. Across the taxonomy and case, we examine controls for containment, privilege separation, provenance, and responder access, including the dual-use problem that defensive artifacts may also enable misuse. The review identifies practical priorities for evaluating cyber capability together with the security of the environment in which that capability is exercised.