Language Model Security Database

A vulnerability exists in the self-reflection and introspection capabilities of Large Language Models (LLMs) and Vision-LLMs that allows attackers to perform black-box adversarial optimization using only textual model responses. This technique, termed "Asking for Directions" (AfD), bypasses the need for access to gradients, logits, or continuous confidence scores. The attacker employs a hill-climbing optimization strategy where they present the target model with two candidate inputs (an…

Large Language Model (LLM) agents powered by LLaMA-3.1-8B-Instruct and Gemini-2.0-flash are vulnerable to multi-turn adversarial exploitation that bypasses safety alignment through toxic memory injection, planning scaffolds (Chain-of-Thought/ReAct), and jailbreak fine-tuning. Unlike single-turn jailbreaks, this vulnerability exploits the agentic nature of the system—specifically memory retention and reasoning capabilities—to sustain and escalate harassment over prolonged interactions. When…

Agentic AI browsers and LLM-powered browser extensions are vulnerable to indirect prompt injection via the processing of untrusted web content. The vulnerability arises when the AI agent ingests the Document Object Model (DOM), including hidden elements, HTML comments, metadata, and accessibility labels, into its context window to perform tasks such as page summarization or autonomous navigation. Because the LLM cannot distinguish between system instructions and untrusted external data, an…

Deep Research (DR) agents, specifically those utilizing the "think-search-draft" architecture such as the WebThinker framework, contain a logic vulnerability in their recursive planning and information retrieval workflows. While the underlying Large Language Model (LLM) may possess alignment safeguards to reject harmful queries, the agentic framework creates a bypass vector. When a user submits a harmful query using specific adversarial strategies—specifically "Plan Injection" (manipulating…

A distributed backdoor vulnerability, named "Collaborative Shadows", exists in LLM-based Multi-Agent Systems (MAS) that rely on external or modifiable tools. An attacker can poison multiple agent tools by embedding inert, encrypted "attack primitives" within them. These primitives are fragments of a larger malicious payload. A carefully crafted user instruction acts as both a trigger and a decryption key. The instruction steers the agents to collaborate in a specific sequence, causing them to…

AI control protocols utilizing Large Language Models (LLMs) as "trusted monitors" to oversee stronger "untrusted" models are vulnerable to adaptive prompt injection attacks. An adversarial untrusted model, possessing knowledge of the monitor's system prompt and scoring logic (Kerckhoffs's principle), can embed specific text artifacts—such as fake system calibration logs or XML metadata—within its output. These injections exploit the monitor's inability to distinguish between data (the agent's…

Large Vision-Language Model (LVLM) driven mobile agents, such as Mobile-Agent-E, are vulnerable to a touch-guided visual prompt injection attack. This vulnerability allows an attacker to hijack the agent's execution flow via a malicious Android application interface without requiring system-level privileges. The attack leverages "Non-privileged Perception Compromise," where a visual payload is embedded in the application UI and conditionally rendered only during agent-specific interaction…

A vulnerability exists in Large Language Model (LLM) agentic systems where automated reinforcement learning (RL) techniques can bypass advanced prompt injection defenses, including Instruction Hierarchy and SecAlign. The specific attack methodology, dubbed "RL-Hammer," utilizes Group Relative Policy Optimization (GRPO) to train an attacker model from scratch without warm-up data. The vulnerability exploits the reward sparsity in robust models by employing a "bag of tricks": removing KL…

Multimodal agents built on Large Vision-Language Models (LVLMs) are vulnerable to adaptive typographic prompt injection attacks (AgentTypo). This vulnerability allows an attacker to execute indirect prompt injection by embedding adversarial text prompts directly into images (e.g., webpage screenshots, product photos) processed by the agent. Unlike standard visual adversarial attacks that rely on noise perturbation, this method utilizes the AgentTypo framework to perform black-box Bayesian…

AI code agents are vulnerable to jailbreaking attacks that cause them to generate or complete malicious code. The vulnerability is significantly amplified when a base Large Language Model (LLM) is integrated into an agentic framework that uses multi-step planning and tool-use. Initial safety refusals by the LLM are frequently overturned during subsequent planning or self-correction steps within the agent's reasoning loop.