Language Model Security Database

LLM agents deployed with tool access are vulnerable to goal-reframing prompt injection, which reliably bypasses explicit rule-following and safety instructions. By injecting language that recasts a standard task as a "puzzle," "Capture The Flag (CTF)," or "easter egg" hunt, an attacker can manipulate the agent's task-frame alignment. The agent does not override security rules; instead, it reinterprets exploitative actions—such as exploring hidden directories, bypassing test runners, or reading…

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

LLM-based personal agents are vulnerable to Indirect Prompt Injection (IPI) defense bypasses via declarative context reframing and implicit file provenance trust. Attackers can bypass agent safety filters by phrasing malicious instructions as declarative compliance alerts rather than imperative commands. Because agents are designed to report discrepancies as expected behavior, declarative framing bypasses intent-sensitive safety mechanisms. Additionally, attackers can exploit the agent's…

Vision-Language-Action (VLA) models suffer from a severe linguistic fragility vulnerability where semantically equivalent but structurally complex adversarial instructions cause catastrophic failures in visual grounding and geometric reasoning. Attackers can reliably induce physical execution failures in robotic manipulation tasks by applying semantic-preserving linguistic variations, such as synonymous rephrasing, syntactic restructuring, or the addition of fine-grained compositional…

Autonomous LLM agents deployed in dynamic, multi-step tool-calling environments are highly vulnerable to Indirect Prompt Injections (IPI) embedded in external content. Surface-level defensive prompts and monitoring mechanisms (such as Prompt Warning, the Sandwich Method, Spotlighting, Keyword Filtering, and LLM-as-a-Judge) consistently fail to prevent exploitation and occasionally exacerbate the vulnerability by introducing adversarial distraction. While compromised agents exhibit…

Large Language Models (LLMs) are vulnerable to system instruction leakage when extraction requests are framed as benign formatting, encoding, or structured-output tasks. While standard alignment and refusal mechanisms successfully block direct queries for system instructions, they fail when attackers request the instructions to be rendered in alternate representations (e.g., YAML, TOML, Base64, or system logs). The model's safety filters misinterpret the request as a harmless transformation or…

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Large Language Models (LLMs) aligned for helpfulness and empathy are vulnerable to a Persona-based Client Simulation Attack (PCSA) that exploits the model's inability to distinguish therapeutic empathy from maladaptive validation. By embedding harmful intents within coherent, multi-turn psychological counseling narratives and employing clinical resistance strategies (such as intellectualization or metaphorical expression), attackers can compel the model to prioritize rapport-building over…

A vulnerability in LLM input filtering mechanisms allows attackers to bypass keyword, semantic, and state-of-the-art intent-aware defenses using composite prompt injections. By combining Obfuscation (OBF) techniques with Semantic/Social manipulation—specifically Emotional Manipulation (EM) or Reward Framing (RF)—attackers exploit a "representation gap" between the model and the defense. The underlying LLM decodes the obfuscated payload, while the defense mechanisms fail to parse the raw…

Memory-augmented LLM web agents utilizing raw trajectory memory are vulnerable to Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP). Attackers can embed malicious instructions within user-generated web content (e.g., product pages, forum posts). When the agent processes this content during a routine task, the instructions are passively ingested into its raw trajectory memory. During subsequent, entirely separate tasks on different websites, semantic retrieval mechanisms pull…