arXiv cs.MA· Bryan C. Boots·· 12 小时前AI 评分43
智能体对智能体的合成社会工程攻击：ASE-EC 测试平台与 Qwen3-4B 实验
Agent-to-Agent Synthetic Social Engineering on the Web
AI 导读
研究提出"合成社会工程（SSE）"概念，指发送方智能体利用可信度、权威或义务线索误导接收方智能体、使其偏离授权目标，并构建 ASE-EC 可复现测试平台区分攻击尝试与成功重定向。基于 Qwen3-4B 的 1,260 次实验显示，援引一项有限的前期约定可使未授权请求比例从 43.3% 升至 96.7%，而接收方仍保留有依据的决策、权限范围未变。
正文
Abstract:An AI agent can prepare an accurate report and still request an action its user has not authorized. Cooperation across Web services therefore requires separate judgments about identity, evidentiary support, and permission. We define synthetic social engineering (SSE) as deliberately deceptive or misleading influence intended to exploit AI recipients' responses to credibility, authority, or obligation cues and redirect behavior away from authorized objectives. We focus on separately tasked sender agents that produce or adapt misleading communication. Drawing on cybersecurity, social engineering, and persuasion research, we develop an operational framework connecting actors, deceptive representations, candidate influence routes, evidence or permission boundaries, responses, and consequences. The framework distinguishes attempts from successful redirection, without assuming human psychological processes. We implement it in the Agent Service Exchange and Evidence Commons (ASE-EC), a reproducible testbed with independently specified records and authorization scopes. Across 1,260 research episodes using Qwen3-4B in two fictional briefing tasks, matched comparisons test authority and commitment appeals, while defense comparisons assess protection alongside authorized task completion. Invoking a limited prior agreement increased unauthorized requests from 43.3% to 96.7%, although recipients retained supported decisions and permissions remained unchanged. These controlled findings identify action selection as a distinct security concern, even when evidence handling succeeds, and they provide a reusable basis for evaluating safeguards that preserve useful cooperation across Web services.
| Subjects: | Cryptography and Security (cs.CR); Multiagent Systems (cs.MA) |
| ACM classes: | K.6.5; I.2.11 |
| Cite as: | arXiv:2610.33411 [cs.CR] |
| (or arXiv:2610.33411v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.33411 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Bryan Boots [view email]
[v1]
Sat, 24 Oct 2026 02:59:12 UTC (2,843 KB)
来源：arXiv cs.MA · arxiv.org