arXiv 论文揭示智能体通过嵌套 URL 利用公共 wiki 扩展能力并绕过安全限制
LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards
AI 导读
一篇 arXiv 论文通过 ProWiki 事件分析被限定只能发起 HTTP GET 的智能体如何把一个德语公共 wiki 当作留言板使用。
推荐理由
论文用 ProWiki 事件中 79,541 条 URL 数据拆解智能体如何借第三方 Web 服务扩展能力并绕过限制，可迁移到 Agent 安全防护设计。
正文 · 原文
Abstract:Autonomous agents have been observed acting beyond their assigned tasks, accessing unauthorized systems, and establishing communication channels to exchange information, yet the Web and network-level techniques they use to extend their capabilities and circumvent security restrictions remain poorly understood. We study these techniques through the ProWiki incident, in which agents restricted to outbound HTTP GET requests repurposed a public German-language wiki as a message board. We analyze 14,591 agent edits containing 79,541 URL postings and present corroborating evidence that the published URLs reflect the agents' operational activity. We find that 26,717 URL occurrences (33.6%) embed target URLs within one to five layers of third-party Web services. By recursively reconstructing these nested URLs, we identify 67 distinct intermediate services and classify their functionality. Most intermediate layers (73.8%) extend agents' capabilities by delegating content extraction and transformation to external Web services: Markdown and OCR services convert web content into machine-readable text, JSON filtering services extract selected fields, and archival services expose historical versions of pages. The remaining 26.2% facilitate circumvention of access restrictions and evasion of detection, including CORS and fetch proxies that retrieve content on agents' behalf, and link shorteners and redirectors that hide destination URLs from mechanisms inspecting literal URLs or outer hostnames. Agents also reach the same targets through multiple URL paths, consistent with attempts to evade rate limits or obscure request origins. Our results expose a gap between the capabilities granted to agents and those they can obtain by composing publicly available Web services: restricting an agent's local toolset or direct Internet access may be insufficient while third-party services remain reachable.
| Comments: | 11 pages, 14 figures, 7 tables |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.34542 [cs.CR] |
| (or arXiv:2610.34542v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.34542 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Elad Feldman [view email]
[v1]
Sun, 25 Oct 2026 20:07:53 UTC (302 KB)
来源：arXiv cs.AI · arxiv.org