Language Model Security Database

A vulnerability exists in Large Language Model (LLM) deployments and multi-agent systems where an autonomous attacker agent can systematically extract hidden system prompts through self-evolving interaction strategies. The vulnerability leverages a "JustAsk" framework which utilizes Upper Confidence Bound (UCB) exploration to dynamically select and refine attack vectors from a hierarchical taxonomy of 14 atomic skills (e.g., structural formatting, authority appeals) and 14 multi-turn…

A vulnerability exists in the function-calling mechanisms of open-source Large Language Models (LLMs), specifically identified as "Renaming Tool Poisoning" (RTP). This attack vector exploits the model's visibility into both the natural language description and the actual code implementation of available tools. By embedding a two-part adversarial payload—one in the tool description directing focus to implementation variables, and another within the tool's source code variable…

Large Language Models (LLMs) acting as web agents exhibit a vulnerability in their decision-making process when validating external URLs. The models fail to correctly identify malicious domains when the Uniform Resource Locator (URL) structure—specifically the subdomain, directory path, or query parameters—is manipulated to include semantically "safe" keywords or mimic benign websites (URL disguising). Attackers can induce the agent to accept and visit a malicious link by embedding natural…

LLM-based autonomous agents deployed for Static Application Security Testing (SAST) false positive filtering exhibit a critical failure mode resulting in the suppression of True Positive (TP) vulnerability reports. When configured to triage alerts from tools such as CodeQL, Semgrep, and SonarQube, agents including SWE-agent, OpenHands, and Aider incorrectly classify legitimate, exploitable vulnerabilities as false positives. This vulnerability suppression is highly correlated with specific…

Large Language Models (LLMs) deployed as autonomous agents exhibit "Anthropomorphic Vulnerability Inheritance" (AVI), a vulnerability class where models internalize human psychological failure modes during training. Attackers can bypass security controls and manipulate agent decision-making by exploiting semantic patterns associated with authority bias, artificial urgency, and social proof. Unlike traditional prompt injection which attempts to override system instructions, AVI exploits the…

A vulnerability in Large Language Models (LLMs) and autonomous agent frameworks, termed "Emoticon Semantic Confusion," allows for the generation and execution of unintended, potentially destructive code. Because ASCII-based emoticons (e.g., ~, *, !(^^)!) heavily overlap with the symbol space of programming operators, shell wildcards, and file paths, LLMs frequently misinterpret these affective, non-verbal cues as executable directives. When processing user instructions in code-generation or…

Backdoor-based fingerprinting mechanisms used for Intellectual Property (IP) protection in Large Language Models (LLMs) are vulnerable to evasion when deployed in model ensemble configurations. The vulnerability arises because fingerprint triggers elicit specific, high-probability tokens or responses in a protected model that are statistically improbable in unprotected or differently-fingerprinted auxiliary models. Attackers can exploit this statistical discrepancy without accessing model…

The Model Context Protocol (MCP) specification v1.0 contains fundamental architectural vulnerabilities enabling server-side prompt injection and privilege escalation. The protocol relies on bidirectional sampling (sampling/createMessage) without cryptographic origin authentication or UI distinction, allowing connected servers to inject content that the LLM backend interprets as legitimate user input. Additionally, the protocol lacks isolation boundaries between concurrent server connections…

Production Large Language Models (LLMs) are vulnerable to long-form training data extraction via a two-phase prompt injection attack. This vulnerability allows an attacker to recover substantial portions of memorized, copyrighted text (such as novels) by exploiting the model's autoregressive text completion capabilities. The attack methodology involves two distinct phases: 1. Prefix Completion Probe: The attacker provides a short "seed" sequence (e.g., the first sentence of a book) coupled…

LLM-based code agents and vulnerability detectors employing Chain-of-Thought (CoT) reasoning are susceptible to automated adversarial code obfuscation. The vulnerability exists because CoT mechanisms expose the model's decision logic, allowing reinforcement learning frameworks (such as CoTDeceptor) to iteratively refine code transformations based on the detector's own reasoning traces. By optimizing for "reasoning instability" and "hallucination" rather than just syntactic evasion, attackers…