Language Model Security Database

Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) are vulnerable to semantic injection attacks via adversarial tool descriptors. The vulnerability arises because MCP implementations inject natural language tool metadata (descriptions, schemas) directly into the model's reasoning context without semantic sanitization or cryptographic binding. This allows unprivileged adversaries to register tools containing hidden imperative instructions within the descriptor text…

Large Language Models (LLMs), including GPT-5, Gemini-2.5-Flash, DeepSeek, and Llama-3, are vulnerable to a semantic isomorphism attack known as "Safe2Harm." This vulnerability arises from the failure of safety alignment mechanisms (SFT, RLHF, DPO) to detect harmful underlying principles when they are encapsulated within semantically legitimate scenarios. Attackers can bypass safety filters through a four-stage process: (1) rewriting a harmful query into a safe, principle-equivalent query…

Reasoning-specialized Large Language Models (LLMs) that utilize Chain-of-Thought (CoT) processes are vulnerable to reasoning-exploitation jailbreaks. Attackers can bypass standard safety alignments (such as RLHF) by using adaptive multi-turn interactions or semantic transformations to induce the model to generate intermediate reasoning steps that "rationalize" or "contextualize" a harmful request. Because current alignment techniques often fail to scale linearly with reasoning depth, forcing…

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

A vulnerability exists in OpenAI's Custom GPTs platform where the lack of effective isolation between the system context ("Expert Prompt"), external knowledge retrieval, and user input allows for unauthorized information disclosure and tool misuse. By employing specific prompt injection techniques—including Hex injection, Many-shot prefix attacks, and Knowledge Poisoning (uploading malicious files)—an attacker can bypass safety guardrails. This results in the extraction of proprietary system…

A "Helpful Mode" role-confusion vulnerability exists in specific Large Language Model (LLM) safety guardrails, specifically Nemotron-Safety-8B and Granite-Guardian-3.2-5B. These models, designed to act as binary classifiers (outputting "Safe" or "Unsafe") for content moderation, can be manipulated via contextually framed adversarial prompts (e.g., academic research requests, corporate security scenarios, or roleplay) to abandon their classification objective. Instead of blocking the request…

A vulnerability, dubbed RoguePrompt, allows for bypassing large language model (LLM) moderation filters by encoding a forbidden instruction into a self-reconstructing payload. The attack uses a dual-layer ciphering process. First, the forbidden prompt is partitioned into two subsequences (e.g., even and odd words). One subsequence is encrypted using a classical cipher like Vigenere, while the other remains plaintext. Both the plaintext subsequence, the Vigenere ciphertext, and natural language…

A vulnerability exists in multiple Large Language Models (LLMs) that allows for safety alignment bypass through an advanced jailbreaking technique called Template and Suffix Optimization (TASO). The attack combines two distinct optimization methods in an alternating, iterative feedback loop. First, a semantically meaningless adversarial suffix is optimized (e.g., using gradient-based methods like GCG) to force the LLM to begin its response with an affirmative phrase (e.g., "Sure, here is...")…

Improper restriction of the "Capability Space" in Large Language Model (LLM) applications allows remote attackers to manipulate application behavior through "Goal Deviation" attacks. This vulnerability arises when developers rely on the broad capabilities of a foundational model (e.g., GPT-4, LLaMA) without implementing sufficient negative constraints or disabling default plugins (e.g., DALL-E, Web Search) in the system prompt. Attackers can exploit this via natural language inputs to trigger…

Large Language Models (LLMs) are vulnerable to a black-box jailbreak technique known as the "Game-Theory Attack" (GTA). This vulnerability exploits the model's instruction-following and objective-shaping capabilities by framing the interaction as a finite-horizon sequential stochastic game. By introducing a game-theoretic scenario template—specifically a "Mechanism-Induced Graded Prisoner’s Dilemma"—the attacker alters the model's effective payoff structure. The vulnerability triggers a…