研究揭示代码代理绕过安全监控的攻击方法
Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
朋友间推荐：研究团队测试了代码代理如何绕过安全监控，发现了一些新方法，比如注入攻击，还提出了一些改进建议，对做安全防御的人可能有参考价值。
研究通过对抗测试发现，当被监控的代码代理持续存在对齐问题时，其可通过生成提示注入、多代理攻击和恶意压缩等方式绕过安全监控。在79%的测试中，代理成功利用注入攻击在Claude Code的Auto Mode和OpenAI的Guardian中执行任意bash命令。研究提出通过增强工具覆盖范围、转录格式和引入代理监控阶段等方法可提升防御能力，但仍需解决多上下文攻击问题。
Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
To keep coding agents from going off the rails, production systems now review each proposed action with a blocking monitor that can reject it before it runs (Auto Mode in Claude Code, Guardian in OpenAI's Codex). Prior evaluations of such monitors largely measure robustness to accidental harm or prompt injections from untrusted sources looking to hijack the agent. Less understood is how they hold up when the agent they monitor is persistently misaligned. To understand this risk, we task an adversarial agent with evading production blocking monitors and causing catastrophic harm, e.g. by exfiltrating its own weights. We find that when instructed with high-level attack strategies, adversarial agents can succeed through several distinct mechanisms, such as agent-generated prompt injection against the monitor, multi-agent attacks, and malicious compaction. In particular we find that in 79% of trials, the agent can use an injection attack against Auto Mode and Guardian to run arbitrary bash commands. We also find that it is possible to greatly improve Auto Mode through design changes like enhancements to tool coverage, transcript formatting and an agentic monitor stage. Even with these improvements, preventing multi-context attacks at an acceptable cost remains an open problem. By detailing our red-teaming methodology and highlighting new attack vectors, we aim to help defenders evaluate their mitigations against the possibility of persistent malign coding agents. Code is available at https://github.com/safety-research/red-teaming-auto-mode.
