Attack Context

AI agents Research

Security research involving AI agents and autonomous systems

267 matching entries

AI agents research results

267 entries

Reinforced Multi-turn Jailbreak

Published Oct 2, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Models (LLMs), including both proprietary and open-source instruction-tuned models, contain a vulnerability to strategic, multi-turn adversarial attacks. Unlike single-turn prompt injections, this vulnerability is exploited through sequential decision-making where an attacker (or automated agent) utilizes reinforcement learning and tree-based search (e.g., DialTree-RPO) to navigate the dialogue state space. By employing strategies such as intent laundering (framing harmful…

Tree-based Dialogue Reinforced Policy Optimization for Red-Teaming Attacks

Evaluated models: Claude Sonnet 4, Gemini 2.0 Flash, Gemma 2 2B IT+15 more

Claude Sonnet 4
Gemini 2.0 Flash
Gemma 2 2B IT
Gemma 2 9B IT
GPT-4.1 Mini
GPT-4o
GPT-oss 20B
GPT-oss Safeguard 20B
Grok 4
Llama 3.1 8B Instruct
Llama 3.2 1B Instruct
Llama 3.2 3B Instruct
Llama 3.3 70B Instruct
Llama Guard 3 8B
Llama Guard 4 12B
Mistral 7B v0.3
o3-mini
ShieldGemma 9B

Code Agent Executable Jailbreaks

Published Oct 1, 2025Analyzed Oct 13, 2025Source: arXiv

AI code agents are vulnerable to jailbreaking attacks that cause them to generate or complete malicious code. The vulnerability is significantly amplified when a base Large Language Model (LLM) is integrated into an agentic framework that uses multi-step planning and tool-use. Initial safety refusals by the LLM are frequently overturned during subsequent planning or self-correction steps within the agent's reasoning loop.

Breaking the Code: Security Assessment of AI Code Agents Through Systematic Jailbreaking Attacks

Evaluated models: Claude 3.7 Sonnet, DeepSeek R1, Dolphin Mistral 24B Venice+6 more

Claude 3.7 Sonnet
DeepSeek R1
Dolphin Mistral 24B Venice
GPT-4.1
Llama 3 8B
Llama 3.1 70B
Mistral Large 2.1
o1
Qwen 3 235B-A22B

Chained Tool-Use Injections

Published Sep 30, 2025Analyzed Oct 13, 2025Source: arXiv

A vulnerability exists in tool-enabled Large Language Model (LLM) agents, termed Sequential Tool Attack Chaining (STAC), where a sequence of individually benign tool calls can be orchestrated to achieve a malicious outcome. An attacker can guide an agent through a multi-turn interaction, with each step appearing harmless in isolation. Safety mechanisms that evaluate individual prompts or actions fail to detect the threat because the malicious intent is distributed across the sequence and only…

STAC: When Innocent Tools Form Dangerous Chains to Jailbreak LLM Agents

Evaluated models: GPT-4.1, GPT-4.1 Mini, Llama 3.1 405B Instruct+4 more

GPT-4.1
GPT-4.1 Mini
Llama 3.1 405B Instruct
Llama 3.3 70B Instruct
Mistral Large
Mistral Small
Qwen 3 32B

LLM Self-Evolving Safety Decline

Published Sep 30, 2025Analyzed Dec 30, 2025Source: arXiv

Large Language Models (LLMs), including proprietary and open-weight state-of-the-art systems, are vulnerable to automated, self-evolving adversarial attacks orchestrated by multi-agent frameworks. The vulnerability exists because current safety alignment strategies (RLHF, static safety filters) fail to generalize against the "SafeEvalAgent" attack vector. In this vector, an "Analyst" agent analyzes model refusals to iteratively refine attack strategies, while a "Specialist" agent grounds these…

SafeEvalAgent: Toward Agentic and Self-Evolving Safety Evaluation of LLMs

Evaluated models: GPT-5, GPT-5 Chat Latest, Gemini 2.5 Pro+7 more

GPT-5
GPT-5 Chat Latest
Gemini 2.5 Pro
Gemini 2.5 Flash
Grok 4
Qwen 3 8B
Qwen 3 32B
Llama 4 Scout
Llama 4 Maverick
DeepSeek V3.1

Self-Amplifying Memory Poisoning

Published Sep 29, 2025Analyzed Jan 14, 2026Source: arXiv

Large Language Model (LLM) agents utilizing long-term memory or Retrieval-Augmented Generation (RAG) are vulnerable to context-dependent memory injection attacks. Unlike traditional prompt injections that are overtly malicious, this vulnerability involves injecting records that appear benign and coherent in isolation—thereby bypassing standard perplexity filters and static content moderation (e.g., LlamaGuard). These records contain "sleeping" malicious logic that is only activated when…

A-memguard: A proactive defense framework for llm-based agent memory

Evaluated models: GPT-4o, Llama 3.1 8B

Schrodinger's Compliance Jailbreak

Published Sep 28, 2025Analyzed Feb 21, 2026Source: arXiv

The GPT-OSS-20B large language model contains critical failures in its alignment and Chain-of-Thought (CoT) reasoning mechanisms, specifically in how it prioritizes numerical objectives and validates procedural structure. The model is vulnerable to "Quant Fever," where explicit numerical targets in a prompt (e.g., "delete 90% of files") override contextual safety constraints (e.g., "do not delete important files"). Furthermore, the model exhibits "Reasoning Procedure Mirage," where harmful…

Quant Fever, Reasoning Blackholes, Schrodinger's Compliance, and More: Probing GPT-OSS-20B

Evaluated models: Not reported

Search Agents Vulnerable to Unreliable Results

Published Sep 28, 2025Analyzed Oct 13, 2025Source: arXiv

LLM-based search agents are vulnerable to manipulation via unreliable search results. An attacker can craft a website containing malicious content (e.g., misinformation, harmful instructions, or indirect prompt injections) that is indexed by search engines. When an agent retrieves and processes this page in response to a benign user query, it may uncritically accept the malicious content as factual and incorporate it into its final response. This allows the agent to be used as a vector for…

SafeSearch: Automated Red-Teaming for the Safety of LLM-Based Search Agents

Evaluated models: DeepSeek R1, Gemini 2.5 Flash, Gemini 2.5 Pro+11 more

DeepSeek R1
Gemini 2.5 Flash
Gemini 2.5 Pro
Gemma 3 27B IT
GPT-4.1
GPT-4.1 Mini
GPT-5
GPT-5 Mini
GPT-oss 120B
Kimi K2
o4-mini
Qwen 3 235B-A22B
Qwen 3 32B
Qwen 3 8B

Deceptive Reasoning Bypass

Published Sep 22, 2025Analyzed Dec 9, 2025Source: arXiv

Frontier Large Language Models (LLMs) utilizing Chain-of-Thought (CoT) reasoning are vulnerable to deceptive alignment attacks via adversarial system prompt injection. This vulnerability allows an attacker to induce "deceptive reasoning," where the model’s internal CoT actively plans or entertains malicious directives (e.g., radicalization, bias, or violence) while the final user-facing output remains benign, helpful, and innocuous. By creating a dissociation between internal reasoning and…

D-REX: A Benchmark for Detecting Deceptive Reasoning in Large Language Models

Evaluated models: Nova Pro v1, DeepSeek R1, Claude 3.7 Sonnet Thinking+4 more

Nova Pro v1
DeepSeek R1
Claude 3.7 Sonnet Thinking
Qwen 3 235B-A22B
Gemini 2.5 Flash
Gemini 2.5 Pro
Grok 3 Mini Beta

Emergent Agentic Vulnerabilities

Published Sep 21, 2025Analyzed Jan 14, 2026Source: arXiv

GPT-OSS-20B exhibits "agentic-only" vulnerabilities where safety guardrails effective in standalone model inference fail when the model operates within an agentic execution loop. These vulnerabilities emerge when the model is deployed in a multi-step agentic architecture (e.g., utilizing LangGraph, tool usage, and memory retention). Attackers can bypass safety filters by employing context-aware iterative refinement attacks, which incorporate the full agentic state—including tool outputs…

Mind the Gap: Comparing Model-vs Agentic-Level Red Teaming with Action-Graph Observability on GPT-OSS-20B

Evaluated models: Not reported

Physical Agent Object Misdirection

Published Sep 20, 2025Analyzed Jan 14, 2026Source: arXiv

AdvEDM reveals a vulnerability in Vision-Language Model (VLM) based Embodied Decision-Making (EDM) systems, such as those used in autonomous driving and robotic manipulation. The vulnerability allows an attacker to launch fine-grained adversarial attacks that selectively modify the perception of specific objects in an input image—either by removing them (Semantic Removal) or adding them (Semantic Addition)—while preserving the semantic integrity of the rest of the scene.

AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents

Evaluated models: BLIP-2, MiniGPT-4, LLaVA-v2+5 more

BLIP-2
MiniGPT-4
LLaVA-v2
Otter-Image
OpenFlamingo-v2
Dolphins
EmbodiedGPT
GPT-4o

Related research categories