Language Model Security Database

The paper presents a controlled, reproducible evaluation in which untrusted MCP tool descriptions contain hidden instructions that attempt to induce coding agents to access files, invoke other tools, create deceptive links, or execute remote scripts. The authors report that several clients accepted poisoned metadata without adequate validation or parameter visibility; Cursor 1.6.45 was reported unsafe across all four tested vectors. These are paper-reported results from isolated local tests…

High-privilege LLM agents with filesystem and network access are vulnerable to documentation-embedded instruction injection, an issue termed the "Trusted Executor Dilemma." When autonomously processing external workflow documents (e.g., README.md files or setup guides) during software installation workflows, agents implicitly trust and execute embedded text instructions without verifying their underlying intent. Attackers can embed syntactically valid, malicious directives (such as data…

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

A vulnerability in LLM-based Multi-Agent Systems (LLM-MAS) allows an attacker who controls a single arbitrary agent to map and extract the system's entire confidential communication topology. Unlike prior attacks that rely on direct identity queries and administrative privileges, this attack infers topology stealthily purely from contextual and linguistic signals (stylometry, role-specific syntax), bypassing standard keyword-based and identity-filtering defenses. The exploit relies on a…

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

LLM-based autonomous email security agents configured with signal-based system prompts are vulnerable to a "signal inversion" attack via infrastructure phishing. When a system prompt instructs an LLM to prioritize a specific heuristic—such as sender-URL domain consistency—attackers can bypass the security filter entirely by registering a single, inexpensive domain and using it for both the sender email address and the malicious payload host. Because the LLM faithfully executes the prioritized…

A "Visual Confused Deputy" vulnerability exists in Computer-Using Agents (CUAs) that rely on visual perception to execute coordinate-based GUI actions (e.g., click(x,y)). Because the agent's understanding of the system state is entirely dependent on the screenshot provided by the runtime, a compromised runtime or tool can intercept and alter the screenshot pixels before forwarding them to the LLM. By visually swapping the locations of benign and privileged UI elements, an attacker can trick…

The paper describes a reproducible prompt-injection failure in which low-privilege user or tool-output text that imitates a trusted role—especially a model’s reasoning style—is treated as authoritative. Its zero-shot, black-box “CoT Forgery” evaluation injects fabricated reasoning into user prompts and retrieved webpage/tool output. The authors report 60% average attack success on StrongREJECT and 56–70% success in an agent data-exfiltration evaluation, versus near-zero or substantially lower…

LLM agent frameworks that rely on external or marketplace-distributed skills are vulnerable to supply-chain payload execution and confused deputy attacks. Attackers can inject malicious skills into agent registries by exploiting the fundamental skill architecture (applicability conditions, policies, and interfaces). By manipulating skill metadata and applicability predicates, attackers force the agent to retrieve and activate the malicious skill across broad task categories. Malicious…