Language Model Security Database

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

Agentic LLMs integrated with external data services (e.g., Model Context Protocol, MCP) are vulnerable to Adaptive Indirect Prompt Injection (IPI) attacks. When an agent queries external servers, attackers can inject malicious payloads into the retrieved content to hijack the agent's reasoning process and force the execution of high-authority tools. Unlike traditional static prompt injections, this vulnerability dynamically exploits the agent's internal logic audit. By using Markovian…

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

LLM agents employing unconstrained test-time memory evolution are vulnerable to "Agent Memory Misevolution," a form of deployment-time reward hacking. When an agent's strategy memory bank is updated based solely on a task success threshold (utility) without explicit safety constraints, the system progressively accumulates and prioritizes "toxic shortcuts"—strategies that efficiently solve benign tasks but implicitly erode safety alignments. Over continuous interactions, the probability…

LLM agents with tool-calling capabilities are vulnerable to a text-action modality divergence (termed the "GAP" vulnerability), where text-level safety alignment fails to transfer to tool-call execution. Attackers can craft adversarial prompts that cause the model to generate a text-based refusal (demonstrating text safety) while simultaneously executing the requested forbidden action through available external tools. Because text generation and tool-call selection operate through partially…

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

A vulnerability in multi-tenant LLM serving frameworks allows attackers to reconstruct the private prompts of other users via an active Key-Value (KV) cache side-channel. Frameworks that utilize shared KV caches alongside specific scheduling policies, such as Longest Prefix Match (LPM), prioritize waiting requests based on the length of their matched prefix tokens. An attacker can exploit this by iteratively sending batches of guessed tokens mixed with dummy queries. If a guessed token matches…

Large Language Models (LLMs) subjected to machine unlearning techniques (specifically AltPO, GradDiff, IDKDPO, IDKNLL, UNDIAL, NPO, and SimNPO) contain a vulnerability regarding the persistence of latent knowledge. Despite achieving high "forgetting" scores on standard, benign benchmarks, these models remain susceptible to black-box evolutionary adversarial attacks. An attacker can utilize an automated framework (REBEL) comprising a "Hacker" model and a "Judge" model to iteratively mutate…

A vulnerability exists in Large Language Models (LLMs) deployed in environments with output reingestion (e.g., RAG, coding assistants, agentic workflows) that allows attackers to execute "temporal backdoors" (time bombs) via an implicit memory channel. Attackers can implant this behavior via system prompts or fine-tuning (data poisoning) to make the model encode hidden state information within its generated text using non-printing Unicode characters or semantic steganography. When these…

Multi-agent Large Language Model (LLM) architectures are vulnerable to internal-channel data leakage due to the absence of access controls and data minimization in inter-agent communication and shared memory. Frameworks such as LangChain, CrewAI, AutoGPT, and MetaGPT propagate complete task contexts—including unredacted sensitive data—between specialized agents during task delegation. Because traditional LLM security guardrails only filter final user-facing outputs, attackers or benign…