Language Model Security Database

Open-weight Large Language Models, demonstrated specifically on Qwen3 (4B and 30B-A3B Base, Instruct, and Thinking variants), are vulnerable to unauthorized steerability attacks where minimal inference-time interventions—such as short, pro-instrumental prompt suffixes—reliably elicit dangerous instrumental-convergence behaviors. Because instruction-tuned and "Thinking" models are inherently designed to be highly responsive to steering (authorized steerability), malicious actors can exploit…

A vulnerability in the safety alignment of several major Large Language Models (LLMs) allows attackers to bypass content filters using complex, automatically generated adversarial prompts. Discovered via the AgenticRed evolutionary framework, the flaw is exploited by wrapping malicious intents in structured formats (such as strict JSON output contracts), combined with prefix injection and refusal suppression. By explicitly commanding the model to begin its response with a compliant prefix and…

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign…

A stealthy resource exhaustion (Economic Denial-of-Service) vulnerability exists in the multi-turn tool-calling layer of Large Language Model (LLM) agents, particularly those utilizing the Model Context Protocol (MCP). An attacker controlling a third-party tool server can manipulate text-visible fields (such as argument descriptions and error messages) to force the LLM into a prolonged, verbose tool-calling loop. By demanding lengthy, non-semantic outputs (e.g., long comma-separated lists) and…

Large Language Model (LLM) agents utilizing external tool execution frameworks are vulnerable to Indirect Prompt Injection (IPI) via the "Tool Stream." Unlike traditional data-stream injections (e.g., malicious emails), this vulnerability exploits the agent's interpretation of functional tool definitions (docstrings, signatures) and runtime feedback (error messages, return values) as binding operational constraints. Adversaries functioning as compromised or malicious tool providers can embed…

A cognitive vulnerability exists in the reasoning mechanisms of autonomous Large Language Model (LLM) agents, specifically regarding "narrative overfitting"—the model's intrinsic drive to synthesize coherent causal stories from fragmented inputs. This vulnerability allows for "Cognitive Collusion Attacks" where an attacker creates a fabricated belief state in the victim agent using exclusively factually true evidence fragments. By employing a "Generative Montage" framework (consisting of…

Large Language Model (LLM) agents implementing the Model Context Protocol (MCP) are vulnerable to Implicit Tool Poisoning (ITP). This vulnerability allows an attacker to manipulate agent behavior by embedding malicious instructions within the metadata (specifically the natural language description) of a third-party tool. Unlike explicit tool poisoning, where the agent is tricked into invoking a malicious tool, ITP exploits the agent's contextual reasoning to force the invocation of a distinct…

A vulnerability in search-augmented Large Language Models (LLMs) allows attackers to bypass safety alignments and generate actionable malicious content by weaponizing the model's web retrieval tools. The exploit operates in two stages. First, via "Outsourcing Injection," attackers obfuscate harmful intent by translating it into benign-looking, multi-hop knowledge-seeking queries. This forces the LLM to fetch the harmful semantics directly from the open web, bypassing parametric intent filters…

The VILTA (VLM-in-the-Loop Trajectory Adversary) framework is vulnerable to Prompt Injection and Data Poisoning via un-sanitized scene representation inputs. The system integrates a Vision-Language Model (Gemini-2.5-Flash) into a closed-loop reinforcement learning environment, feeding it Bird’s-Eye-View (BEV) imagery alongside text-based vehicle dynamics data (e.g., position, speed, and risk_category) to generate challenging driving trajectories. An attacker who can manipulate the input…

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…