Language Model Security Database

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

GPT-OSS-Safeguard-20B and Meta-SecAlign (70B/8B) are vulnerable to white-box adversarial attacks generated by automated algorithmic recombination (specifically the claude_v63, claude_v82, and claude_v53-oss optimizers). These algorithms significantly outperform standard discrete optimization methods (like GCG) by integrating continuous optimization (ADC) with LayerNorm gradient scaling (LSGM), or by merging momentum-smoothed gradients with directional perturbation candidate selection (DPTO)…

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

LLM-powered automated social media accounts (bots) are vulnerable to prompt injection via public user replies. When an automated bot scrapes and processes social media engagement to generate responses, an attacker can submit an instruction-override command within a direct reply. Because the underlying LLM fails to isolate its core system instructions (e.g., maintaining a specific political persona) from untrusted user input, the injected command hijacks the model's context window. This forces…

Activation-delta-based linear probes used for detecting task drift and prompt injections in Large Language Models (LLMs) can be bypassed using universal adversarial suffixes. By utilizing the Greedy Coordinate Gradient (GCG) algorithm, an attacker can generate a single, optimized suffix that simultaneously fools multiple logistic regression classifiers attached to different hidden layers of the LLM. The attack jointly optimizes the suffix tokens by accumulating gradients from the losses of all…

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

Large Language Models (LLMs) utilized for Automatic Short Answer Grading (ASAG) are vulnerable to the "GradingAttack" framework, which employs fine-grained adversarial manipulation to alter grading outcomes. Attackers can leverage two distinct strategies: (1) Prompt-level attacks using role-play injection strings that instruct the model to pretend an answer is correct regardless of factual accuracy, and (2) Token-level attacks utilizing gradient-based optimization (similar to Greedy Coordinate…

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

LLM-based document re-rankers utilizing decoder-only and Mixture-of-Experts (MoE) architectures are vulnerable to candidate-embedded prompt injections during multi-document comparison tasks. By embedding Decision Objective Hijacking (DOH) or Decision Criteria Hijacking (DCH) prompts into candidate documents, attackers can manipulate the model's preference to artificially elevate an injected document to the top rank. The vulnerability exploits the models' instruction-following capabilities and…

Large Language Model (LLM) agents are vulnerable to automated prompt injection attacks generated via Reinforcement Learning (RL). The attack methodology, termed "AutoInject," utilizes Group Relative Policy Optimization (GRPO) combined with a comparison-based feedback mechanism to generate universal adversarial suffixes. Unlike traditional jailbreaks that optimize for generic affirmative responses (e.g., "Sure"), this vulnerability allows an attacker to optimize for specific, parameterized tool…