Last analyzed Sep 9, 2026

Language Model Security Database

Explore primary-source AI security research, evaluated models, attack techniques, and defensive evidence.

985 research findings · 1119 evaluated models

Findings

985

Models evaluated

1119

Paper-evaluated models

Any selected model can match.

Refine by category

Findings match every selected category.

Attack Type

Attack Context1 selected

Architecture Components

Attack Surface

Impact

Advanced filters

Published fromPublished throughEvidence status

Research indexed from arXiv.

Filtered research findings

267 entries

Matches every word across titles, descriptions, sources, affected systems, and models.

Visual prompt injection crosses document trust boundaries

Published Sep 3, 2026Analyzed Sep 9, 2026Source: arXiv

Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Evaluated models: claude-opus-4-7, GPT-5.5, Gemini 3.1 Pro+3 more

claude-opus-4-7
GPT-5.5
Gemini 3.1 Pro
Qwen3.6-27B
Qwen3-VL 32B Instruct
InternVL3.5 38B Instruct

Deleted agent memory persists in live execution state

Published Sep 4, 2026Analyzed Sep 9, 2026Source: arXiv

Deleting a memory record can leave its information in an agent's summaries, pending plans and KV cache. The paper evaluates revocation across this derived execution state.

Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents

Evaluated models: Llama 3.1 8B Instruct, Qwen 2.5 7B Instruct, Mistral 7B Instruct v0.3

Context privilege escalation in AI agent harnesses

Published Sep 1, 2026Analyzed Sep 9, 2026Source: arXiv

Context assembly can promote repository, tool or skill content into higher-priority instructions or persistent state. The paper studies 12 pinned agent-harness versions.

What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness

Evaluated models: GPT-5.5, GPT-5.4-mini, Claude Sonnet 4.6+4 more

GPT-5.5
GPT-5.4-mini
Claude Sonnet 4.6
Claude Opus 4.6
Gemini 2.5 Flash
Gemini 2.5 Pro
DeepSeek V4 Flash

Single-interaction poisoning of agent memory

Published Aug 24, 2026Analyzed Sep 9, 2026Source: arXiv

A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

Evaluated models: Qwen 2.5 7B Instruct, Qwen 2.5 1.5B Instruct, Qwen 2.5 3B Instruct+3 more

Qwen 2.5 7B Instruct
Qwen 2.5 1.5B Instruct
Qwen 2.5 3B Instruct
Qwen 2.5 14B Instruct
Llama 3.1 8B Instruct
Mistral 7B Instruct v0.3

Poisoned agent skills amplify coding-agent token use

Published Aug 22, 2026Analyzed Sep 9, 2026Source: arXiv

Third-party skills can inflate coding-agent resource use while an otherwise legitimate task remains functional.

SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents

Evaluated models: GLM-4.7-Flash, GLM-5, GPT-5.4-mini+1 more

GLM-4.7-Flash
GLM-5
GPT-5.4-mini
GPT-5.5

Tool-response state corruption through unauthorized source claims

Published Aug 13, 2026Analyzed Sep 9, 2026Source: arXiv

Lower-trust tool content can assert facts beyond its authority and distort an agent's decisions. PIPES screens response units against source provenance and expected field meaning.

PIPES: Securing Agent Perception with Provenance and Priors

Evaluated models: Gemma 4 31B IT, GPT-5.6 Luna

Unsafe shell commands can pass LLM agent dispatch guards

Published Jul 21, 2026Analyzed Sep 9, 2026Source: arXiv

Shell-command screening can miss harmful actions generated by coding agents. CARE combines static checks with optional model review at the command-dispatch boundary.

CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents

Evaluated models: Qwen3-Coder-30B-A3B-Instruct, Granite Guardian 2B, Llama Guard 3 8B+1 more

Qwen3-Coder-30B-A3B-Instruct
Granite Guardian 2B
Llama Guard 3 8B
GPT-oss Safeguard 20B

Prompt injection across agent privilege boundaries

Published Jul 21, 2026Analyzed Sep 9, 2026Source: arXiv

Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.

Twin Agent: Context Residual Compression for Privilege Separated Agents

Evaluated models: GPT-5.2, Gemini 2.5 Flash, Gemini 3.5 Flash

Workspace Agent Runtime Safety Failures Across Risk Carriers

Published Jul 29, 2026Analyzed Aug 13, 2026Source: arXiv

AgentS4D measures unsafe actions and state changes across complete workspace-agent executions rather than treating task completion or isolated model responses as safety evidence. Its 328 sandboxed cases introduce risky content through user requests, documents, web resources, tools, third-party skills, and persistent memory, then compare the same cases across four agent harnesses and five model backends.

AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents

Evaluated models: GPT-5.5, Gemini 3.1 Pro, DeepSeek V4-Pro+2 more

GPT-5.5
Gemini 3.1 Pro
DeepSeek V4-Pro
MiniMax-M3
Qwen3.7-Plus

Third-Party Agent Skill Supply-Chain Execution Risks

Published Jul 22, 2026Analyzed Aug 13, 2026Source: arXiv

OpenSkillRisk evaluates whether agent harnesses safely handle third-party skills that introduce risky behavior through otherwise plausible, benign tasks. The benchmark assembles 263 risky skills from public agent-skill ecosystems and tests three CLI-agent harnesses against seven risk categories using isolated task workspaces, mocked external services, and execution-level evidence.

OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

Evaluated models: GPT-5.1 Codex Mini, GPT-5.3 Codex, GPT-5.4+10 more

GPT-5.1 Codex Mini
GPT-5.3 Codex
GPT-5.4
Gemini 2.5 Pro
Gemini 3 Flash
Gemini 3.1 Pro
Claude Haiku 4.5
Claude Sonnet 4.6
Claude Opus 4.6
DeepSeek V3.2
DeepSeek V4-Pro
Kimi-K2.6
GLM-5.1

Research methodology

Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.

Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.