Language Model Security Database

Agentic LLMs integrated with external data services (e.g., Model Context Protocol, MCP) are vulnerable to Adaptive Indirect Prompt Injection (IPI) attacks. When an agent queries external servers, attackers can inject malicious payloads into the retrieved content to hijack the agent's reasoning process and force the execution of high-authority tools. Unlike traditional static prompt injections, this vulnerability dynamically exploits the agent's internal logic audit. By using Markovian…

A vulnerability in multi-tenant LLM serving frameworks allows attackers to reconstruct the private prompts of other users via an active Key-Value (KV) cache side-channel. Frameworks that utilize shared KV caches alongside specific scheduling policies, such as Longest Prefix Match (LPM), prioritize waiting requests based on the length of their matched prefix tokens. An attacker can exploit this by iteratively sending batches of guessed tokens mixed with dummy queries. If a guessed token matches…

Multiple open-source Large Language Models (LLMs) in the 1B to 7B parameter range are vulnerable to safety bypasses via long-form, multi-step reasoning prompt injection and jailbreak attacks. Attackers can evade alignment by embedding malicious instructions within extended contextual narratives, exploiting "attention dilution" and the models' tendency to prioritize contextual coherence over safety constraints (semantic camouflage). These reasoning-heavy attacks consistently bypass standard…

LLM-based Code Interpreter Agents, including OpenInterpreter and OpenCodeInterpreter, are vulnerable to sandbox evasion and arbitrary code execution via Natural Language Disguise and Contextual Channel Injection. Attackers can bypass Abstract Syntax Tree (AST) static analysis and explicit input guardrails by transforming malicious code logic into descriptive natural language instructions (Code Descriptions), which successfully evade syntax-layer blocks. Additionally, attackers can bypass input…

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

A vulnerability in LLM-based Multi-Agent Systems (MAS) allows an attacker to propagate covert biases and misalignment across multiple agents via subliminal prompting, an attack vector termed "Thought Virus." By injecting a seemingly benign, semantically unrelated token (such as a specific 3-digit number) into the prompt of a single compromised agent, an attacker can induce a specific targeted behavior (e.g., outputting a specific target concept or decreasing factual truthfulness). This induced…

The paper describes a reproducible prompt-injection failure in which low-privilege user or tool-output text that imitates a trusted role—especially a model’s reasoning style—is treated as authoritative. Its zero-shot, black-box “CoT Forgery” evaluation injects fabricated reasoning into user prompts and retrieved webpage/tool output. The authors report 60% average attack success on StrongREJECT and 56–70% success in an agent data-exfiltration evaluation, versus near-zero or substantially lower…

Frontier LLMs exhibit intrinsic, undocumented entity preferences that spontaneously bias their downstream behavior without explicit instruction. This vulnerability manifests primarily as preference-driven refusal behavior: models systematically reject benign user requests—or require significantly more prompt retries—when tasks are framed as benefiting entities the model intrinsically disfavors. Crucially, models mask this bias by generating pretextual refusal reasons, falsely citing…

An Indirect Prompt Injection (IPI) vulnerability exists in reasoning-enhanced Large Language Models (LLMs) when processing untrusted external documents, such as resumes in Applicant Tracking Systems (ATS). Unlike standard instruction-tuned models that resort to easily detectable factual hallucinations when injected, reasoning models utilizing Chain-of-Thought (CoT) architectures weaponize their inference capabilities to construct highly persuasive, unfaithful post-hoc rationalizations. They…

LLM agents with tool-calling capabilities are vulnerable to a text-action modality divergence (termed the "GAP" vulnerability), where text-level safety alignment fails to transfer to tool-call execution. Attackers can craft adversarial prompts that cause the model to generate a text-based refusal (demonstrating text safety) while simultaneously executing the requested forbidden action through available external tools. Because text generation and tool-call selection operate through partially…