Last analyzed Sep 9, 2026

Language Model Security Database

Explore primary-source AI security research, evaluated models, attack techniques, and defensive evidence.

985 research findings · 1119 evaluated models

Findings

985

Models evaluated

1119

Paper-evaluated models

Any selected model can match.

Refine by category

Findings match every selected category.

Attack Type1 selected

Attack Context2 selected

Architecture Components

Attack Surface

Impact

Advanced filters

Published fromPublished throughEvidence status

Research indexed from arXiv.

Filtered research findings

3 entries

Matches every word across titles, descriptions, sources, affected systems, and models.

Malicious GitHub Issue Injection Against Coding Agents

Published Jul 22, 2026Analyzed Aug 13, 2026Source: arXiv

IssueTrojanBench studies indirect prompt injection when a coding agent processes an apparently ordinary software-development issue or related artifact. Starting with six legitimate seed issues from two Python repositories, the authors construct 696 adversarial issue variants spanning four unsafe-action families and six delivery formats, then execute those variants across six agent-model configurations.

IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests

Evaluated models: GPT-5.3 Codex, GPT-5.4, Claude Sonnet 4.6

Third-Party Agent Skill Supply-Chain Execution Risks

Published Jul 22, 2026Analyzed Aug 13, 2026Source: arXiv

OpenSkillRisk evaluates whether agent harnesses safely handle third-party skills that introduce risky behavior through otherwise plausible, benign tasks. The benchmark assembles 263 risky skills from public agent-skill ecosystems and tests three CLI-agent harnesses against seven risk categories using isolated task workspaces, mocked external services, and execution-level evidence.

OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

Evaluated models: GPT-5.1 Codex Mini, GPT-5.3 Codex, GPT-5.4+10 more

GPT-5.1 Codex Mini
GPT-5.3 Codex
GPT-5.4
Gemini 2.5 Pro
Gemini 3 Flash
Gemini 3.1 Pro
Claude Haiku 4.5
Claude Sonnet 4.6
Claude Opus 4.6
DeepSeek V3.2
DeepSeek V4-Pro
Kimi-K2.6
GLM-5.1

Prompt injection across agent privilege boundaries

Published Jul 21, 2026Analyzed Sep 9, 2026Source: arXiv

Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.

Twin Agent: Context Residual Compression for Privilege Separated Agents

Evaluated models: GPT-5.2, Gemini 2.5 Flash, Gemini 3.5 Flash

Research methodology

Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.

Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.