Attack Context

Chains & workflows Research

Security issues in prompt chaining and workflows

101 matching entries

Chains & workflows research results

101 entries

Knowledge Weaving Jailbreak Tactic

Published Dec 1, 2025Analyzed Dec 5, 2025Source: arXiv

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

A Wolf in Sheep's Clothing: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search

Evaluated models: Circuit Breaker, Claude 3.5 Haiku, Gemini 2.5 Flash+7 more

Circuit Breaker
Claude 3.5 Haiku
Gemini 2.5 Flash
Gemini 2.5 Pro
Gemma 2B
GPT-5 Mini
GPT-oss 120B
Llama 2 13B
Llama Guard 3
Qwen 3 32B

Ciphered Prompt Self-Reconstruction Jailbreak

Published Nov 24, 2025Analyzed Dec 1, 2025Source: arXiv

A vulnerability, dubbed RoguePrompt, allows for bypassing large language model (LLM) moderation filters by encoding a forbidden instruction into a self-reconstructing payload. The attack uses a dual-layer ciphering process. First, the forbidden prompt is partitioned into two subsequences (e.g., even and odd words). One subsequence is encrypted using a classical cipher like Vigenere, while the other remains plaintext. Both the plaintext subsequence, the Vigenere ciphertext, and natural language…

RoguePrompt: Dual-Layer Ciphering for Self-Reconstruction to Circumvent LLM Moderation

Evaluated models: GPT-4o, Claude 3 Opus, Gemini 1.5 Pro

MAS Pipeline Weak Links

Published Nov 14, 2025Analyzed Jan 14, 2026Source: arXiv

Centralized Multi-Agent Systems (MAS) architectures, specifically those implemented using frameworks such as Magentic-One, LangGraph, and OpenAI Agents, contain design-level vulnerabilities facilitating safety alignment bypasses. Two primary mechanisms drive this vulnerability: 1. Context Fragmentation via Atomic Delegation: The orchestrator decomposes adversarial prompts into atomic, granular sub-tasks (e.g., "click button," "write function header") before delegating them to sub-agents. These…

Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting

Evaluated models: GPT-4o

Meta-Optimized LLM Judge Jailbreak

Published Nov 3, 2025Analyzed Nov 20, 2025Source: arXiv

A vulnerability in Large Language Models (LLMs) allows for systematic jailbreaking through a meta-optimization framework called AMIS (Align to MISalign). The attack uses a bi-level optimization process to co-evolve both the jailbreak prompts and the scoring templates used to evaluate them.

Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges

Evaluated models: Claude 3.5 Haiku, Claude 3.5 Sonnet, Claude Sonnet 4+3 more

Claude 3.5 Haiku
Claude 3.5 Sonnet
Claude Sonnet 4
GPT-4o
GPT-4o Mini
Llama 3.1 8B Instruct

Latent Space Discontinuity Exploitation

Published Nov 1, 2025Analyzed Dec 5, 2025Source: arXiv

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Evaluated models: Not reported

Mobile Agent Channel Subversion

Published Oct 31, 2025Analyzed Dec 30, 2025Source: arXiv

Mobile LLM-based agents (including Mobile-Agent-E, AppAgent, AutoDroid, and others) are vulnerable to indirect prompt injection attacks delivered via untrusted third-party mobile channels, such as in-app advertisements, system notifications, and embedded webviews. These agents utilize Multimodal Large Language Models (MLLMs) to perceive the device state via screenshots or accessibility trees. The vulnerability exists because the agents concatenate the user's prompt ($p$) with the environmental…

Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels

Evaluated models: GPT-3.5 Turbo, GPT-4 Turbo, GPT-4o+1 more

GPT-3.5 Turbo
GPT-4 Turbo
GPT-4o
GPT-4.1 Mini

Trust Paradox Agent Over-Exposure

Published Oct 21, 2025Analyzed Dec 9, 2025Source: arXiv

A privilege escalation and information disclosure vulnerability exists in Large Language Model (LLM) based Multi-Agent Systems (MAS) utilizing explicit inter-agent trust modeling. When the internal trust coefficient ($\tau$) between a Custodian-Agent (holding sensitive data) and a Seeker-Agent is set to a high level (e.g., $\tau=0.9$) to optimize coordination efficiency, the Custodian-Agent systematically fails to enforce Minimum Necessary Information (MNI) principles. This…

The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability

Evaluated models: Llama 3 8B

Agent Plan And Intent Hijack

Published Oct 13, 2025Analyzed Dec 8, 2025Source: arXiv

Deep Research (DR) agents, specifically those utilizing the "think-search-draft" architecture such as the WebThinker framework, contain a logic vulnerability in their recursive planning and information retrieval workflows. While the underlying Large Language Model (LLM) may possess alignment safeguards to reject harmful queries, the agentic framework creates a bypass vector. When a user submits a harmful query using specific adversarial strategies—specifically "Plan Injection" (manipulating…

Deep Research Brings Deeper Harm

Evaluated models: QwQ 32B, Qwen 3 32B, DeepSeek R1 Distill Llama 70B+3 more

QwQ 32B
Qwen 3 32B
DeepSeek R1 Distill Llama 70B
Qwen 2.5 72B Instruct
DeepResearcher 7B
Qwen 2.5 7B Instruct

Distributed Backdoor in Multi-Agent Systems

Published Oct 13, 2025Analyzed Oct 31, 2025Source: arXiv

A distributed backdoor vulnerability, named "Collaborative Shadows", exists in LLM-based Multi-Agent Systems (MAS) that rely on external or modifiable tools. An attacker can poison multiple agent tools by embedding inert, encrypted "attack primitives" within them. These primitives are fragments of a larger malicious payload. A carefully crafted user instruction acts as both a trigger and a decryption key. The instruction steers the agents to collaborate in a specific sequence, causing them to…

Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems

Evaluated models: Gemini 2.5 Pro, GLM 4.5, GPT-4.1+2 more

Gemini 2.5 Pro
GLM 4.5
GPT-4.1
Kimi K2 Instruct
Qwen 3 30B-A3B

Adaptive Monitor Injection

Published Oct 10, 2025Analyzed Dec 9, 2025Source: arXiv

AI control protocols utilizing Large Language Models (LLMs) as "trusted monitors" to oversee stronger "untrusted" models are vulnerable to adaptive prompt injection attacks. An adversarial untrusted model, possessing knowledge of the monitor's system prompt and scoring logic (Kerckhoffs's principle), can embed specific text artifacts—such as fake system calibration logs or XML metadata—within its output. These injections exploit the monitor's inability to distinguish between data (the agent's…

Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols

Evaluated models: GPT-4o, GPT-4o Mini, GPT-4.1+3 more

GPT-4o
GPT-4o Mini
GPT-4.1
GPT-5
Claude Sonnet 4
DeepSeek Chat

Related research categories