Language Model Security Database

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

Large Language Models (LLMs) are vulnerable to a jailbreak technique termed "Priority Hacking." Adversaries can bypass safety alignments by exploiting the model's internal priority graph, where certain abstract values (e.g., justice, public health) implicitly outweigh general safety restrictions within specific contexts. By crafting a deceptive prompt that frames a malicious request as a necessary action in service of a higher-priority benign value, attackers engineer a value conflict. The…

A vulnerability in LLM-based Multi-Agent Systems (LLM-MAS) allows an attacker who controls a single arbitrary agent to map and extract the system's entire confidential communication topology. Unlike prior attacks that rely on direct identity queries and administrative privileges, this attack infers topology stealthily purely from contextual and linguistic signals (stylometry, role-specific syntax), bypassing standard keyword-based and identity-filtering defenses. The exploit relies on a…

LLM-powered automated social media accounts (bots) are vulnerable to prompt injection via public user replies. When an automated bot scrapes and processes social media engagement to generate responses, an attacker can submit an instruction-override command within a direct reply. Because the underlying LLM fails to isolate its core system instructions (e.g., maintaining a specific political persona) from untrusted user input, the injected command hijacks the model's context window. This forces…

LLM-based Code Interpreter Agents, including OpenInterpreter and OpenCodeInterpreter, are vulnerable to sandbox evasion and arbitrary code execution via Natural Language Disguise and Contextual Channel Injection. Attackers can bypass Abstract Syntax Tree (AST) static analysis and explicit input guardrails by transforming malicious code logic into descriptive natural language instructions (Code Descriptions), which successfully evade syntax-layer blocks. Additionally, attackers can bypass input…

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

LLM agents equipped with tool-use, persistent memory, and environmental interaction capabilities are vulnerable to long-horizon attacks. Attackers can bypass single-turn safety guardrails by exploiting the temporal dimension of multi-turn interactions to incrementally steer agent behavior. The vulnerability manifests because the agent's safety mechanisms perform localized, single-step evaluations but fail to maintain semantic safety across extended interaction trajectories. This enables…

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…