Language Model Security Database

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

A vulnerability exists in the handling of chat templates within open-weight Large Language Model (LLM) distribution formats, specifically GGUF files. Chat templates are executable Jinja2 programs stored as metadata (typically tokenizer.chat_template) alongside model weights. An attacker can modify a legitimate model's template to include conditional logic that detects specific trigger phrases in user input. When triggered, the template injects malicious system instructions or context into the…

Large Language Models (LLMs) and Retrieval-Augmented Generation (RAG) systems deployed in clinical workflows are vulnerable to direct and indirect (RAG-mediated) medical prompt injection attacks. Attackers can embed malicious instructions within user queries or external retrieved documents (such as poisoned clinical guidelines or PDFs). By exploiting "authority framing" (e.g., formatting the payload as a clinical guideline update or an editor's note), the injections successfully bypass generic…

Large Language Models (LLMs) utilized for Automatic Short Answer Grading (ASAG) are vulnerable to the "GradingAttack" framework, which employs fine-grained adversarial manipulation to alter grading outcomes. Attackers can leverage two distinct strategies: (1) Prompt-level attacks using role-play injection strings that instruct the model to pretend an answer is correct regardless of factual accuracy, and (2) Token-level attacks utilizing gradient-based optimization (similar to Greedy Coordinate…

A vulnerability exists in the chat template mechanism used by Large Language Model (LLM) tokenizers, specifically within the Jinja2 templating engine commonly employed by libraries such as Hugging Face Transformers. By modifying the chat_template field within the tokenizer configuration (e.g., tokenizer_config.json), an attacker can inject hidden backdoor instructions into the system prompt. These instructions are concatenated with legitimate user inputs during the tokenization process…

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

LLM-based document re-rankers utilizing decoder-only and Mixture-of-Experts (MoE) architectures are vulnerable to candidate-embedded prompt injections during multi-document comparison tasks. By embedding Decision Objective Hijacking (DOH) or Decision Criteria Hijacking (DCH) prompts into candidate documents, attackers can manipulate the model's preference to artificially elevate an injected document to the top rank. The vulnerability exploits the models' instruction-following capabilities and…

Large Language Model (LLM) agents are vulnerable to automated prompt injection attacks generated via Reinforcement Learning (RL). The attack methodology, termed "AutoInject," utilizes Group Relative Policy Optimization (GRPO) combined with a comparison-based feedback mechanism to generate universal adversarial suffixes. Unlike traditional jailbreaks that optimize for generic affirmative responses (e.g., "Sure"), this vulnerability allows an attacker to optimize for specific, parameterized tool…

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Conventional LLM agent architectures suffer from a working memory contamination vulnerability due to indiscriminate memory accumulation. When these agents retrieve external data via tools (e.g., web search, reading emails), the entire raw output is appended directly to their continuous context window. If the external data contains an Indirect Prompt Injection (IPI) payload, the malicious instruction persists in the agent's working memory across its entire multi-step reasoning workflow. This…