Chains & workflows Vulnerabilities

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

A vulnerability exists in Large Language Models (LLMs) deployed in environments with output reingestion (e.g., RAG, coding assistants, agentic workflows) that allows attackers to execute "temporal backdoors" (time bombs) via an implicit memory channel. Attackers can implant this behavior via system prompts or fine-tuning (data poisoning) to make the model encode hidden state information within its generated text using non-printing Unicode characters or semantic steganography. When these…

Multi-agent Large Language Model (LLM) architectures are vulnerable to internal-channel data leakage due to the absence of access controls and data minimization in inter-agent communication and shared memory. Frameworks such as LangChain, CrewAI, AutoGPT, and MetaGPT propagate complete task contexts—including unredacted sensitive data—between specialized agents during task delegation. Because traditional LLM security guardrails only filter final user-facing outputs, attackers or benign…

LLM agents equipped with tool-use, persistent memory, and environmental interaction capabilities are vulnerable to long-horizon attacks. Attackers can bypass single-turn safety guardrails by exploiting the temporal dimension of multi-turn interactions to incrementally steer agent behavior. The vulnerability manifests because the agent's safety mechanisms perform localized, single-step evaluations but fail to maintain semantic safety across extended interaction trajectories. This enables…

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

A logical vulnerability exists in LLM security proxies and guardrails that utilize weighted-average aggregation algorithms for multi-turn risk scoring. The scoring logic exhibits a mathematical "ceiling property" where the cumulative conversation-level risk score converges to the per-turn score regardless of the number of interaction turns ($n$). Consequently, the aggregated score is bounded by the maximum single-turn score ($cum \leq \max(s_i)$). This allows remote attackers to bypass…

Conventional LLM agent architectures suffer from a working memory contamination vulnerability due to indiscriminate memory accumulation. When these agents retrieve external data via tools (e.g., web search, reading emails), the entire raw output is appended directly to their continuous context window. If the external data contains an Indirect Prompt Injection (IPI) payload, the malicious instruction persists in the agent's working memory across its entire multi-step reasoning workflow. This…

OpenClaw is vulnerable to Indirect Prompt Injection (IPI), Tool-Return Manipulation, and Persistent Memory Poisoning. The agent incorporates untrusted external content (e.g., fetched web pages) and external tool outputs directly into its observation stream without sufficient isolation. An attacker can embed malicious payloads into these external channels to hijack the agent's planning and execution trace. This allows the attacker to silently trigger high-privilege actions via OpenClaw's Skills…

A behavioral vulnerability exists in Large Language Model (LLM) agents where task-irrelevant persuasion introduced in prior interactions or system contexts induces a persistent "belief state" that alters downstream task execution. This phenomenon, termed "Persuasion Propagation," occurs when an agent adopts a stance on a controversial topic (e.g., politics, privacy) that is semantically unrelated to its primary function (e.g., coding, medical research). This adopted stance acts as a latent…

LLM-as-a-Judge systems utilizing natural language rubrics are vulnerable to Rubric-Induced Preference Drift (RIPD). This vulnerability allows an attacker (or a flawed optimization process) to refine evaluation rubrics such that they maintain high agreement with human references on standard validation benchmarks while inducing systematic, directional preference degradation on unseen target domains. The attack exploits the disconnect between benchmark validation and target generalization by…