Language Model Security Database

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Retrieval-Augmented Generation (RAG) systems are vulnerable to iterative knowledge-extraction attacks designed to reconstruct the underlying private knowledge base. The vulnerability exists due to the decoupled optimization of the retrieval and generation phases. Attackers can craft adversarial queries consisting of two distinct components: an "Information" component (optimized via gradient descent or random sampling to steer embeddings toward specific, diverse regions of the vector space) and…

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

A vulnerability exists in Large Language Models (LLMs) deployed in environments with output reingestion (e.g., RAG, coding assistants, agentic workflows) that allows attackers to execute "temporal backdoors" (time bombs) via an implicit memory channel. Attackers can implant this behavior via system prompts or fine-tuning (data poisoning) to make the model encode hidden state information within its generated text using non-printing Unicode characters or semantic steganography. When these…

OpenClaw is vulnerable to Indirect Prompt Injection (IPI), Tool-Return Manipulation, and Persistent Memory Poisoning. The agent incorporates untrusted external content (e.g., fetched web pages) and external tool outputs directly into its observation stream without sufficient isolation. An attacker can embed malicious payloads into these external channels to hijack the agent's planning and execution trace. This allows the attacker to silently trigger high-privilege actions via OpenClaw's Skills…

A side-channel information leakage vulnerability exists in the "locate-then-edit" paradigm of Large Language Model (LLM) knowledge editing, specifically affecting algorithms such as ROME, MEMIT, and AlphaEdit. The parameter update matrix ($\Delta W$) generated during the editing process preserves the algebraic structure of the edited data. Specifically, the row space of the parameter difference matrix encodes a mathematical fingerprint of the key vectors associated with the edited subjects. An…

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Large Language Models (LLMs) subjected to machine unlearning techniques (specifically AltPO, GradDiff, IDKDPO, IDKNLL, UNDIAL, NPO, and SimNPO) contain a vulnerability regarding the persistence of latent knowledge. Despite achieving high "forgetting" scores on standard, benign benchmarks, these models remain susceptible to black-box evolutionary adversarial attacks. An attacker can utilize an automated framework (REBEL) comprising a "Hacker" model and a "Judge" model to iteratively mutate…

LLM agents employing unconstrained test-time memory evolution are vulnerable to "Agent Memory Misevolution," a form of deployment-time reward hacking. When an agent's strategy memory bank is updated based solely on a task success threshold (utility) without explicit safety constraints, the system progressively accumulates and prioritizes "toxic shortcuts"—strategies that efficiently solve benign tasks but implicitly erode safety alignments. Over continuous interactions, the probability…

The Model Context Protocol (MCP) architecture lacks a semantic verification mechanism to enforce consistency between a tool's documented behavior (exposed to the Large Language Model via JSON schemas) and its actual executable logic. This design gap allows MCP Servers to present benign, read-only, or limited-scope descriptions to the LLM agent while implementing undocumented, privileged, or state-mutating functionality in the underlying code. An attacker can exploit this description–code…