English(EN) No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers

新的“无盒”分析方法仅使用元数据即可检测提示注入漏洞

作者 PulseAugur 编辑部 · [1 个来源] · 2026-09-12 04:00

研究人员引入了一种名为“无盒漏洞分析”的新颖方法，用于检测闭源软件中的安全漏洞。该方法仅使用描述性元数据（如输入、输出和预期行为）来分析系统，而无需直接访问或运行时交互。开发了一个名为MCPSEC的原型系统，用于识别模型上下文协议（MCP）服务器中的间接提示注入漏洞。MCPSEC在预测漏洞方面表现出高召回率，仅使用元数据就准确识别了98.9%的已验证漏洞，优于基线LLM。 AI

影响引入了一种无需直接访问即可分析AI系统的新范例，有望改善闭源模型的安全审计。

排序理由详细介绍新方法论和原型系统的学术论文。[lever_c_demoted from research: ic=1 ai=1.0]

在 arXiv cs.AI 阅读 →

AI 生成摘要 · Google Gemini · 来自 1 个来源。我们如何撰写摘要 →

本文如何被排名

Signal score: 11 / 100; Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket: Tool; 详细介绍新方法论和原型系统的学术论文。[lever_c_demoted from research: ic=1 ai=1.0]
Source corroboration: Single-source cluster; Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics: paper, safety; Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance: High; Clearly on-topic for AI-industry coverage.
Story freshness: Same-day; Cluster formed today. Ranking reflects the current source set at time of score.

完整方法见我们的编辑标准。

报道来源 [1]

arXiv cs.AI TIER_1 English(EN) · Zehua Zhang, Jie Hu, Pratham Hegde, Aditya Maheshbhai Gabani, Souradip Nath, Yibo Liu, Siyu Liu, Hongkai Chen, Hulin Wang, Zhuoer Lyu, Chang Zhu, Divij Handa, Yan Shoshitaishvili, Tiffany Bao, Ruoyu Wang, Adam Doupe · 2026-09-12 04:00

无盒漏洞分析：MCP服务器中间接提示注入漏洞的仅描述检测

arXiv:2609.10854v1 Announce Type: cross Abstract: Conventional vulnerability analysis relies on either system access or dynamic interaction, all of which may be unavailable to third-party analysts auditing closed-source, remotely hosted, critical in situ systems, or commercially …

本文如何被排名

报道来源 [1]

无盒漏洞分析：MCP服务器中间接提示注入漏洞的仅描述检测

相关实体

相关话题