Chain Vulnerabilities

The paper presents a specific black-box indirect prompt-injection evaluation: attacker-controlled external content can cause a memory-enabled assistant or external memory manager to persist a fabricated user memory, which may later be retrieved in a separate session and steer responses or agent actions. The authors evaluate injection, retrieval, and conditional adversarial usage separately across synthetic document and future-session datasets. The released repository provides defensive benchmark and smoke configurations; safe reproduction should use synthetic memories and sandboxed or mocked actions only.

The paper describes a specific black-box knowledge-base poisoning attack against retrieval-augmented reasoning systems. An attacker who can add one query-specific document to the corpus can cause it to be retrieved and influence the LLM toward an attacker-chosen answer. AdversarialCoT shapes the document around the target model’s observable reasoning structure and iteratively refines retrieval relevance and persuasive reasoning using final model feedback. The paper reports this as an evaluation result; it was not independently verified here.

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the embedded payload during routine task completion. This implicit execution bypasses both model-level safety alignment (which looks for imperative malicious instructions) and framework-level architectural guardrails, hijacking the agent's system-level action space (file I/O, shell commands, network requests) without requiring explicitly malicious user prompts.

Autonomous LLM agents deployed in dynamic, multi-step tool-calling environments are highly vulnerable to Indirect Prompt Injections (IPI) embedded in external content. Surface-level defensive prompts and monitoring mechanisms (such as Prompt Warning, the Sandwich Method, Spotlighting, Keyword Filtering, and LLM-as-a-Judge) consistently fail to prevent exploitation and occasionally exacerbate the vulnerability by introducing adversarial distraction. While compromised agents exhibit near-instantaneous mechanical compliance to the injected payload (bypassing multi-step deliberation) and rationalize the malicious instructions in their reasoning traces, token-level analysis reveals abnormally high decision entropy in their predictive distributions. Traditional text-filtering guardrails are entirely blind to this latent hesitation, allowing the agent to execute unauthorized tool invocations.

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and step-wise KL-divergence. The attacker then injects a poisoned instance whose embedding is optimized using constraint tightening—a joint optimization of Particularity, Clustering, Separability, and Margin losses—to map the trigger to a unique, compact region in the semantic space. When a user submits a completely normal, unperturbed query, the agent retrieves the poisoned instance. This dynamically hijacks the agent's reasoning trajectory and reward function, causing it to execute unintended actions or malicious tool invocations.

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further interaction.

A multi-step tool execution vulnerability exists in Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) or similar tool-calling frameworks. Safety guardrails in aligned LLMs typically evaluate static, single-turn text generation. Attackers can bypass these text-centric guardrails by supplying adversarial prompts that force the agent into a complex planning sequence. The agent is manipulated into executing a trajectory of seemingly benign individual tool invocations that collectively achieve a harmful objective, converting prompt-level jailbreaks into realized environmental actions.

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain benign system tools (such as file readers and HTTP clients) into malicious workflows, bypassing single-endpoint security filters.

Multi-Agent Systems based on Large Language Models (LLM-MAS) are vulnerable to systemic Consensus Corruption via cascading error amplification. Because mainstream collaborative architectures rely on recursive context reuse without atomic-level provenance tracking, a single atomic falsehood injected into the system is repeatedly cited and reused within the multi-agent interaction chain. This structural exposure causes the error to deterministically compound across the communication graph, bypassing single-agent self-correction and overriding initial constraints to solidify into a system-wide false consensus. The vulnerability exhibits extreme topological fragility; targeting structurally central agents (e.g., routing supervisors or managers) forces immediate, system-wide propagation.

Embodied Large Language Models (LLMs) used for real-world agent planning are vulnerable to Action-level Manipulation (dubbed "Blindfold"), a jailbreak technique that bypasses semantic-level safety filters by exploiting the models' limited spatial and causal reasoning regarding physical consequences. Attackers can use an adversarial proxy LLM to decompose a semantically harmful intent into a sequence of individually benign primitive actions. To evade advanced semantic correlation checks (semantic residual effect), the attack injects context-aware cover actions (noise) that mask the dominant malicious action. Because standard LLM safeguards evaluate linguistic semantics rather than physical action trajectories, the embodied agent executes the benign-looking instructions, resulting in dangerous real-world outcomes.