Chains & workflows Vulnerabilities

Internal Safety Collapse (ISC) is a vulnerability in frontier Large Language Models (LLMs) where models autonomously generate highly restricted, harmful content while executing structurally legitimate professional workflows. The vulnerability triggers when a model infers that generating sensitive data is a functional requirement to complete an otherwise benign task. By nesting harmful content generation inside standard execution constraints (e.g., resolving a schema validation error in a…

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

OpenClaw v2026.2.9 is vulnerable to a resource amplification and economic denial-of-service (DoS) attack via malicious third-party skills. An attacker can publish a Trojanized skill that exploits the framework's tool-calling loop and context-management architecture by injecting a multi-turn "Segmented Verification Protocol" (SVP). Malicious instructions embedded in the skill's SKILL.md file mandate extensive autoregressive sequence generation, while a companion script returns PROGRESS, REPAIR…

A vulnerability in LLM-based Multi-Agent Systems (MAS) allows an attacker to propagate covert biases and misalignment across multiple agents via subliminal prompting, an attack vector termed "Thought Virus." By injecting a seemingly benign, semantically unrelated token (such as a specific 3-digit number) into the prompt of a single compromised agent, an attacker can induce a specific targeted behavior (e.g., outputting a specific target concept or decreasing factual truthfulness). This induced…

The paper describes a reproducible prompt-injection failure in which low-privilege user or tool-output text that imitates a trusted role—especially a model’s reasoning style—is treated as authoritative. Its zero-shot, black-box “CoT Forgery” evaluation injects fabricated reasoning into user prompts and retrieved webpage/tool output. The authors report 60% average attack success on StrongREJECT and 56–70% success in an agent data-exfiltration evaluation, versus near-zero or substantially lower…

Adversarial Explanation Attacks (AEAs) introduce a behavioral vulnerability in Large Language Model (LLM) based decision-support systems where the communication channel between the AI and the user is exploited to induce trust in incorrect model predictions. By manipulating the framing of an explanation—specifically its reasoning mode, evidence type, communication style, and presentation format—an attacker can dissociate the perceived plausibility of an explanation from its factual correctness…

Agentic LLMs integrated with external data services (e.g., Model Context Protocol, MCP) are vulnerable to Adaptive Indirect Prompt Injection (IPI) attacks. When an agent queries external servers, attackers can inject malicious payloads into the retrieved content to hijack the agent's reasoning process and force the execution of high-authority tools. Unlike traditional static prompt injections, this vulnerability dynamically exploits the agent's internal logic audit. By using Markovian…

Large Reasoning Models (LRMs) optimized via Reinforcement Learning from Verifiable Rewards (RLVR) are vulnerable to context pollution in their reasoning traces. An attacker can induce catastrophic reasoning failure by injecting locally coherent but logically or mathematically corrupted snippets into the model's Chain-of-Thought (CoT) or conditioning context. Because standard RLVR optimizes for final-answer correctness strictly under clean conditioning, the models treat the visible trajectory…

Hybrid monitoring protocols for Large Language Model (LLM) agents, specifically those that strictly evaluate both Chain-of-Thought (CoT) reasoning and tool usage (such as LlamaFirewall's AlignmentCheck and Extract-and-Evaluate monitors), are vulnerable to "Agent-as-a-Proxy" indirect prompt injection attacks. Unlike standard injections that target the agent, this attack targets the monitoring model itself. By embedding a malicious string—optimized via an algorithm named Parallel-GCG—into…