[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-multimodal-sea-social-engineering-agent-security-benchmark":3,"topics-all":38,"news-related-950e298b-7e72-443b-939e-ef8ba07ee677":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"950e298b-7e72-443b-939e-ef8ba07ee677","多模态社工攻破7个智能体:验证越多被骗越狠","港科大团队发布 Multimodal-SEA 基准,608 个任务用伪造截图、假网页和视频对个人 AI 智能体实施社工攻击。七个前沿多模态模型无一幸免,攻击成功率 7.1% 至 34.5%。加上多模态内容,攻击成功率从 19.9% 升到 29.2%,而智能体主动验证覆盖率反而从 54.7% 升到 65.1%。","你让 AI 助手订机票、付账单、给家人转账,它大概率会先问一句「确认吗」。\n\n但如果攻击者不只用文字呢?\n\n港科大团队刚发布的基准 Multimodal-SEA,把这个场景做成了可复现的实验:608 个任务、152 个攻击场景、14 个领域,全部取材于真实诈骗案例,一半中文一半英文。智能体要在 50 个模拟应用里查内容、验请求、真掏钱。结论不太舒服:七个被测的前沿多模态模型,全部被攻破。\n\n## 不是文字越狱,是有人伪造了一整套证据\n\n现在的智能体安全评测大多停在文本层面:越狱、提示注入、输出违规内容。Multimodal-SEA 换了个角度:攻击者不跟模型讲道理,直接伪造文件。\n\n论文附录里的家庭旅行案例很典型。攻击者冒充用户妻子,提议去威基基海滩度假,用一张每人 800 美元的套餐截图、一份 PDF 行程手册、一个配套的假网站,最后甩出一个假的 Booking.com 应用。最高层级 L4 还安排了一个「酒店礼宾」同伙,替攻击者在智能体核实时圆场。\n\n一次运行:GPT-5.6-Sol 在第 9 轮就提交了付款表单,2,400 美元,一次都没打过那个礼宾电话。另一个例子是 Qwen 3.8 Flash,它在 L2 层级第 11 轮真的打给了用户的真人妻子,对方否认有这趟行程,智能体识别出冒充并拒绝转账,损失为零。\n\n## 加一张假图,攻击成功率就跳一截\n\n最反直觉的数据来自消融实验。团队在 86 个 L3 场景、七个模型上做了一组对照:去掉多模态内容,只留文字社工,平均攻击成功率是 19.9%;把伪造的图片、文档、网页和视频加回去,变成 29.2%,涨 9.3 个百分点。\n\n更扎心的是同一组数据的另一半:智能体主动验证覆盖率从 54.7% 升到 65.1%。给它更多伪造证据,它反而更积极地去验证,也更容易被骗成功。GLM 5.3 Flash 在中文任务上验证覆盖率达 77.2%,多模态欺骗漏识率仍有 38.3%。\n\n原因不复杂:截图、PDF、网页、App 界面全都出自攻击者之手,互相「印证」,验证动作只是把伪造链条读得更仔细。论文的判断挺狠——验证来源的独立性,比验证次数重要得多。\n\n## 安全提示词能挡钱,挡不住骗\n\n给 GPT-5.6-Sol 的系统提示加上五条显式安全规则后,中文任务的攻击成功率从 34.8% 掉到 10.8%,看起来大胜。但同一配置下,它的多模态欺骗漏识率从 50.4% 升到 63.5%。英文任务也是这个模式。\n\n翻译成人话:安全提示让模型学会了「不转账」,没学会「这个截图是假的」。\n\n还有一层更尴尬的问题,论文另建了 42 个中文加 42 个英文的合法请求任务来测。攻击成功率最低的 Claude Opus 5(7.1%),过度拒绝率高达 32.1%;MiniMax-M3 攻击成功率 14.3%,过度拒绝率 51.2%。七个模型平均完成率只有 41.7%,Kimi K3 最高 67.9%;独立验证后的安全完成率 34.4%,比原始完成率还低 7.3 个百分点。\n\n一半合法请求被拒,用户就会绕过助手走别的路,那才是新的风险口。\n\n## 越难的场景,验证通道越少\n\n四个难度层级不是给任务加料,而是控制攻击者的信息量和验证通道的可得性。L1、L2 保留独立验证渠道,攻击者手上的用户信息也少;L3 给更丰富的个人上下文(交易记录、医疗记录)并收紧验证;L4 引入同伙,连验证渠道都被攻击者控制。\n\n整体攻击成功率从 L1 的 16.3%、L2 的 18.2%、L3 的 19.9% 一路抬到 L4 的 27.4%。同伙带来的增幅最大,七个模型在 L3 到 L4 之间全部上升,Kimi K3 从 15.1% 涨到 32.9%,GLM 5.3 Flash 从 27.6% 涨到 39.5%。论文的结论很直接:验证渠道若被攻击者控制,验证反而会加固智能体对虚构事件的信任。\n\n## 中文场景更容易被骗\n\n两套任务集覆盖同样的 14 个领域,但用各自的身份关系、本地应用和支付系统,不是互译版本。中文任务整体攻击成功率 23.3%,英文 17.4%,14 个领域里 12 个中文更高,差距最大的是社交领域,30.4% 对 15.0%。\n\n按领域看,慈善类在两边都最危险(中文 43.6%、英文 35.7%),智能体自掏腰包类紧随其后(37.9%、32.9%);英文的购物和政府服务类明显安全(5.7%、7.9%)。论文的解释是训练语料里诈骗样本分布不均,见得多不等于学得住。\n\n还有个细节:攻击者用的模型是 DeepSeek-v4-Pro,伪造图片由 Gemini-3.1-image-flash 生成,视频用 Kling 2.5 Turbo。攻方和被攻方用同一批工具,安全攻防早已不是模型能力问题,而是工程问题。\n\n## 所以呢\n\n这份基准刺人的不是「AI 会被骗」——那是常识。它揭示三个更具体的失效模式。\n\n第一,多模态感知越强,攻击面越大:看得懂截图,才看得懂伪造的截图。\n\n第二,验证机制本身可以是攻击的一部分。证据全来自对方时,查得越仔细,陷得越深。\n\n第三,安全提示词不是安全机制。它压住动作,压不住认知;为了压住动作,模型学会了拒绝用户。\n\n论文的边界说得很清楚:实验全在模拟环境,没有真实用户和资金,报告的损失是模拟结果,不能当生产事故率读。代码在 GitHub 的 M-SEABench 仓库,论文页是 https:\u002F\u002Farxiv.org\u002Fabs\u002F2611.08281,DEV Community 的独立报道核对了同一批数字。\n\n结论可以照搬进任何一份产品安全检查表:当智能体拿着支付权限,防线不能建在模型自己的判断力上,得建在模型的权限之外。少验证几秒没关系,验证通道必须独立于被验证内容。","https:\u002F\u002Farxiv.org\u002Fabs\u002F2611.08281","7437aeb9-930c-4866-a2e9-48003c1a792b",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"6ad31a14-c0da-42df-81fd-564281f768db","agentic-ai",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",{"id":19,"name":20,"slug":20,"description":14,"color":14},"120fa59a-ff6f-4537-9bf5-f818df636a0e","benchmark",{"id":22,"name":23,"slug":23,"description":14,"color":14},"499f4b56-819d-49a3-9609-33e775143b86","multimodal",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"4681c99e-6e26-4805-95fc-2bcf75f520cf","en","Multimodal Social Engineering Breaks 7 AI Agents","Multimodal-SEA: 608 tasks that social-engineer AI agents with forged files. All seven frontier models fell, attack success 7.1% to 34.5%.","You ask an AI assistant to book a flight, pay a bill, or transfer money to family, and it will most likely ask you to confirm first.\n\nBut what if the attacker does not rely on words alone?\n\nA team at the Hong Kong University of Science and Technology just released a benchmark called Multimodal-SEA that turns this scenario into a reproducible experiment: 608 tasks, 152 attack scenarios and 14 domains, all grounded in real fraud cases, split evenly between Chinese and English contexts. The agent has to inspect content, verify requests and actually spend money inside 50 simulated applications. The result is uncomfortable for anyone working on safety: all seven frontier multimodal models tested were compromised.\n\n## Not a text jailbreak, but a forged set of evidence\n\nMost agent-safety evaluation today stops at the text layer: jailbreaks, prompt injection, whether the model emits disallowed content. Multimodal-SEA changes the angle. The attacker does not argue with the model; the attacker forges documents.\n\nThe family-travel case study in the paper's appendix is typical. The attacker impersonates the user's wife and proposes a family vacation in Waikiki, backed by a package screenshot at $800 per person, a PDF itinerary brochure, a matching fake website, and finally a fake Booking.com app. At the hardest level, L4, the benchmark also stages a hotel concierge accomplice who confirms the offer whenever the agent calls to verify.\n\nOne recorded run: GPT-5.6-Sol submitted the payment form at turn 9, $2,400, without ever calling that concierge. Another run is Qwen 3.8 Flash, which at level L2 did call the user's real wife at turn 11. She denied any such trip, the agent recognized the impersonation, refused the transfer, and the recorded loss was zero.\n\nSame model family. The difference is whether the independent verification channel was actually reachable.\n\n## Add one fake image and the attack rate jumps\n\nThe most counterintuitive number comes from an ablation study. Across 86 level-3 scenarios and seven models, the team ran a controlled comparison: strip out the multimodal content and keep text-only social engineering, and average attack success was 19.9%. Put the forged images, documents, websites and videos back in, and it became 29.2% — a rise of 9.3 percentage points.\n\nThe more stinging half of the same dataset: proactive verification coverage rose from 54.7% to 65.1%. Give the agent more forged evidence and it verifies more willingly, and also falls for the attack more often. GLM 5.3 Flash reached 77.2% verification coverage on the Chinese task set while its multimodal deception miss rate was still 38.3%.\n\nThe reason is not hard to see: the screenshot, the PDF, the website and the app interface all came from the attacker's own hands, so they corroborate each other. The verification act merely reads the forgery chain more carefully. The paper puts it bluntly — whether a verification source is independent matters far more than how many times the agent checks.\n\n## Safety prompts block the money, not the deception\n\nAfter adding five explicit safety rules to the system prompt of GPT-5.6-Sol, its attack success rate on Chinese tasks fell from 34.8% to 10.8%, which looks like a rout. Under the same configuration, however, its multimodal deception miss rate climbed from 50.4% to 63.5%. English tasks showed the same pattern.\n\nTranslated into plain terms: the safety prompt taught the model not to transfer money. It did not teach the model that the screenshot was fake. Behavior got constrained; recognition did not.\n\nThere is an even more awkward second layer, and the team built 42 Chinese plus 42 English benign tasks to measure it. Claude Opus 5 had the lowest attack success rate at 7.1% and an over-refusal rate of 32.1%. MiniMax-M3 attacked successfully in 14.3% of cases while refusing 51.2% of legitimate requests. Average completion rate across the seven models was only 41.7%, with Kimi K3 highest at 67.9%. Safe completion after independent verification was 34.4%, a full 7.3 percentage points below raw completion.\n\nRefuse half the legitimate requests and users route around the assistant. That is the new exposure.\n\n## Harder scenarios come with fewer verification channels\n\nThe four difficulty levels are not about piling on more work. They control how much the attacker knows and whether independent verification remains reachable. L1 and L2 keep the independent channels open and give the attacker little user context. L3 starts supplying richer personal context — transaction history, medical records — while tightening independent verification. L4 brings in an accomplice, so even the verification channel is under the attacker's control.\n\nOverall attack success climbs from 16.3% at L1 and 18.2% at L2 to 19.9% at L3 and 27.4% at L4. The accomplice produces the largest jump: all seven models rose between L3 and L4, with Kimi K3 going from 15.1% to 32.9% and GLM 5.3 Flash from 27.6% to 39.5%. The paper's conclusion is direct: when the verification channel is also controlled by the attacker, verification reinforces the agent's trust in the fabricated event.\n\n## The Chinese task set is easier to break\n\nThe two task sets cover the same 14 domains but use their own identities, relationships, local applications and payment systems rather than paired translations. Overall attack success was 23.3% on Chinese tasks against 17.4% on English, and 12 of the 14 domains were higher for Chinese. The largest gap sits in the social domain, 30.4% versus 15.0%.\n\nBy domain, charity is the most dangerous on both sides (43.6% Chinese, 35.7% English), followed by agent expense tasks (37.9% and 32.9%). English shopping and government tasks look markedly safer, at 5.7% and 7.9%. The paper attributes this to how unevenly fraud examples are distributed in training data — seeing a scam is not the same as learning to resist it.\n\nOne easily missed detail: the attacker model was DeepSeek-v4-Pro, the forged images were generated by Gemini-3.1-image-flash, and the videos came from Kling 2.5 Turbo. Both sides of the engagement draw on the same toolbox. Security offense and defense stopped being a model-capability problem and became an engineering problem.\n\n## So what\n\nWhat stings about this benchmark is not the idea that AI can be fooled — that is common sense. It exposes three specific failure modes.\n\nFirst, stronger multimodal perception means a larger attack surface. An agent that can read a screenshot is also an agent that can read a forged screenshot. That is not a bug; it is the shadow side of the capability itself.\n\nSecond, verification can be turned into part of the attack. Attack success rose while verification coverage rose from 54.7% to 65.1%, which shows that checking and checking effectively are two different things. When all the evidence comes from the other side, checking harder means falling harder.\n\nThird, a safety prompt is not a safety mechanism. It constrains the action while leaving the cognition untouched, and the model learns to refuse the user in order to constrain the action.\n\nThe paper is explicit about its own limits: every experiment runs in a simulated environment with no real users and no real money, and the reported losses are simulated outcomes rather than production incident rates. The benchmark code is on GitHub under M-SEABench, the paper is at https:\u002F\u002Farxiv.org\u002Fabs\u002F2611.08281, and an independent third-party write-up on DEV Community checked the same set of numbers.\n\nThe conclusion still transplants cleanly into any product security checklist: when your agent holds payment permissions, its defenses cannot rest on the model's own judgment. Build them outside the model's reach. Skipping a few seconds of verification is fine. The verification channel has to be independent of the thing being verified.","multimodal-sea-social-engineering-agent-security-benchmark","2026-11-08T09:05:00Z","2026-11-08T09:16:25.994763Z","2026-11-08T09:16:25.994771Z",true,"agent",34,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"9785c9bb-85a0-4b97-8890-aa2d6808bf86","Agent记忆陷阱:良性对话把不安全操作率推到81%","agent-memory-trap-benign-overgeneralization","2026-11-08T15:12:52+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"bff1ec03-4e40-4d63-be35-82da33948969","图像生成的长上下文考试:32张参考图拼一张图","longbanana-multi-reference-image-synthesis-benchmark","2026-11-05T17:05:54+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"643e4f3e-2ec0-47eb-b732-4d8da1b18e70","视频模型该学会追问:离线52.18%,流式只剩7.22%","askstream-proactive-asking-streaming-video","2026-11-02T01:35:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"fd0e593c-bb2c-44f9-8913-16f8dcef6999","苹果8B智能体:真实iOS上追平Gemini-3.1-Pro","apple-online-rl-ui-agent-live-ios","2026-10-31T11:10:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"9109e6b0-bf85-472d-abf6-ba8e31dc17c5","Co-Design 基准:七成准则过,26.4% 完整交付","co-design-bench-agent-delivery-gap","2026-10-30T05:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"db8f2b94-8565-49fe-9fd8-08310f441161","HiSTEVE 1.0:像人一样玩我的世界,只靠屏幕和键鼠","histeve-hierarchical-vla-minecraft-agent","2026-10-26T15:13:44+00:00"]