Language Model Security Database

Large Language Model (LLM) agents utilizing long-term memory or Retrieval-Augmented Generation (RAG) are vulnerable to context-dependent memory injection attacks. Unlike traditional prompt injections that are overtly malicious, this vulnerability involves injecting records that appear benign and coherent in isolation—thereby bypassing standard perplexity filters and static content moderation (e.g., LlamaGuard). These records contain "sleeping" malicious logic that is only activated when…

Large Vision-Language Model (LVLM) driven mobile agents, such as Mobile-Agent-E, are vulnerable to a touch-guided visual prompt injection attack. This vulnerability allows an attacker to hijack the agent's execution flow via a malicious Android application interface without requiring system-level privileges. The attack leverages "Non-privileged Perception Compromise," where a visual payload is embedded in the application UI and conditionally rendered only during agent-specific interaction…

A privilege escalation and information disclosure vulnerability exists in Large Language Model (LLM) based Multi-Agent Systems (MAS) utilizing explicit inter-agent trust modeling. When the internal trust coefficient ($\tau$) between a Custodian-Agent (holding sensitive data) and a Seeker-Agent is set to a high level (e.g., $\tau=0.9$) to optimize coordination efficiency, the Custodian-Agent systematically fails to enforce Minimum Necessary Information (MNI) principles. This…

Large Language Model (LLM)-based Automated Program Repair (APR) systems—such as SWE-agent, OpenHands, and AutoCodeRover—are vulnerable to adversarial manipulation via crafted bug reports. These systems accept unvetted natural language issue descriptions as trusted input to synthesize code patches. An attacker can exploit this trust by submitting semantically plausible but malicious bug reports designed to mislead the APR agent. By leveraging the semantic gap between natural language…

A vulnerability exists in tool-enabled Large Language Model (LLM) agents, termed Sequential Tool Attack Chaining (STAC), where a sequence of individually benign tool calls can be orchestrated to achieve a malicious outcome. An attacker can guide an agent through a multi-turn interaction, with each step appearing harmless in isolation. Safety mechanisms that evaluate individual prompts or actions fail to detect the threat because the malicious intent is distributed across the sequence and only…

Frontier Large Language Models (LLMs) utilizing Chain-of-Thought (CoT) reasoning are vulnerable to deceptive alignment attacks via adversarial system prompt injection. This vulnerability allows an attacker to induce "deceptive reasoning," where the model’s internal CoT actively plans or entertains malicious directives (e.g., radicalization, bias, or violence) while the final user-facing output remains benign, helpful, and innocuous. By creating a dissociation between internal reasoning and…

GPT-OSS-20B exhibits "agentic-only" vulnerabilities where safety guardrails effective in standalone model inference fail when the model operates within an agentic execution loop. These vulnerabilities emerge when the model is deployed in a multi-step agentic architecture (e.g., utilizing LangGraph, tool usage, and memory retention). Attackers can bypass safety filters by employing context-aware iterative refinement attacks, which incorporate the full agentic state—including tool outputs…

Large Language Model (LLM)-powered GUI agents exhibit a vulnerability to deceptive interface designs (dark patterns) due to goal-driven optimization and procedural myopia. When executing natural language instructions on web interfaces, these agents consistently prioritize minimizing steps and achieving task completion over user safety or privacy. Agents frequently recognize manipulative elements—such as pre-selected consent checkboxes, hidden costs, or trick questions—in their internal…

Large Language Models (LLMs), including proprietary and open-weight state-of-the-art systems, are vulnerable to automated, self-evolving adversarial attacks orchestrated by multi-agent frameworks. The vulnerability exists because current safety alignment strategies (RLHF, static safety filters) fail to generalize against the "SafeEvalAgent" attack vector. In this vector, an "Analyst" agent analyzes model refusals to iteratively refine attack strategies, while a "Specialist" agent grounds these…

The evaluated MetaGPT multi-agent systems are vulnerable to "Web Fraud Attacks" due to insufficient semantic and structural validation of Uniform Resource Locators (URLs) by agentic models. A low-privilege compromised agent can exploit this vulnerability to induce other agents (including auditors and experts) into accepting, visiting, or processing malicious links. The vulnerability leverages the LLM's inability to distinguish between benign and malicious link structures when obfuscation…