Language Model Security Database

The paper describes and evaluates a reproducible application-layer weakness in agents with persistent memory: untrusted external content can cross the memory-write boundary, be stored as trusted factual, experience, or procedural memory, and influence later sessions. It identifies four write channels—explicit writes, policy-driven writes, compaction, and experience-to-procedure synthesis—and six attack classes. For safe defensive testing, use MPBench’s two-phase structure in an isolated agent…

Vision-Language-Action (VLA) models suffer from a severe linguistic fragility vulnerability where semantically equivalent but structurally complex adversarial instructions cause catastrophic failures in visual grounding and geometric reasoning. Attackers can reliably induce physical execution failures in robotic manipulation tasks by applying semantic-preserving linguistic variations, such as synonymous rephrasing, syntactic restructuring, or the addition of fine-grained compositional…

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Multi-Agent Systems based on Large Language Models (LLM-MAS) are vulnerable to systemic Consensus Corruption via cascading error amplification. Because mainstream collaborative architectures rely on recursive context reuse without atomic-level provenance tracking, a single atomic falsehood injected into the system is repeatedly cited and reused within the multi-agent interaction chain. This structural exposure causes the error to deterministically compound across the communication graph…

Safety-aligned Large Language Models (LLMs) exhibit a "Defensive Refusal Bias" vulnerability, resulting in a safety-induced denial-of-service for legitimate cybersecurity operations. The models systematically refuse authorized defensive queries when they contain security-sensitive terminology (e.g., "exploit," "payload," "shell") because current alignment mechanisms rely on semantic similarity to harmful training data rather than intent analysis. Paradoxically, explicit authorization signals…

A vulnerability in multi-step, tool-using Large Language Model (LLM) agents allows attackers to bypass safety guardrails by manipulating user context variables, such as personalization profiles or persistent memory. The safety policies of frontier LLMs are highly context-dependent; inserting innocuous user bios (e.g., demographic or health disclosures) fundamentally alters the agent's action policy. When combined with lightweight adversarial jailbreaks, specific personalization contexts…

LLM-as-a-judge systems and automated LLM evaluators are vulnerable to meaning-preserving perturbations, specifically formatting alterations and verbosity manipulations. When grading or classifying text and agentic transcripts, LLM judges exhibit high sensitivity to layout-only changes (such as whitespace and indentation) and response length, frequently altering their scores even when the underlying semantic and factual content remains identical. This allows attackers to bypass automated safety…

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…