Denial of service Vulnerabilities

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

A vulnerability in Large Language Models (LLMs) equipped with built-in "thinking" or step-by-step reasoning modes allows attackers to bypass safety alignments, trigger reasoning collapse, and cause resource exhaustion. The vulnerability is exploited via a Multi-Stream Perturbation Attack, which fragments the sequential integrity of a harmful prompt by word-by-word interleaving it with benign auxiliary tasks (e.g., "Explain the water cycle"). By wrapping the benign text streams in specific…

OpenClaw v2026.2.9 is vulnerable to a resource amplification and economic denial-of-service (DoS) attack via malicious third-party skills. An attacker can publish a Trojanized skill that exploits the framework's tool-calling loop and context-management architecture by injecting a multi-turn "Segmented Verification Protocol" (SVP). Malicious instructions embedded in the skill's SKILL.md file mandate extensive autoregressive sequence generation, while a companion script returns PROGRESS, REPAIR…

A vulnerability in Retrieval-Augmented Generation (RAG) systems utilizing safety-aligned Large Language Models (LLMs) allows attackers to perform a highly transferable Denial-of-Service (DoS) or "blocking" attack. By injecting a single maliciously crafted document into the RAG knowledge base, attackers can force the LLM to refuse to answer benign queries. Unlike previous attacks that rely on explicit instruction injection or high-perplexity adversarial suffixes—which modern models easily…

Video-based Large Language Models (Video-LLMs) are vulnerable to a universal Energy-Latency Attack (ELA) that triggers a Denial-of-Service (DoS) via spatially concentrated adversarial patches. Because video architectures rely on temporal subsampling and pooling which act as a low-pass filter against full-frame diffuse noise, an attacker can bypass this compression by anchoring cross-modal attention to a dense, localized visual anomaly. By injecting a fixed, content-agnostic patch into the…

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

LLM serving frameworks utilizing continuous batching and PagedAttention (such as vLLM, SGLang, and Orca) are vulnerable to a resource exhaustion Denial-of-Service attack known as "Fill and Squeeze." An unprivileged remote attacker can exploit the deterministic state transitions of the scheduler's memory management to induce severe latency or service denial. The attack leverages a side-channel vulnerability where Inter-Token Latency (ITL) correlates linearly with global KV-cache usage due to…

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

The Model Context Protocol (MCP) architecture lacks a semantic verification mechanism to enforce consistency between a tool's documented behavior (exposed to the Large Language Model via JSON schemas) and its actual executable logic. This design gap allows MCP Servers to present benign, read-only, or limited-scope descriptions to the LLM agent while implementing undocumented, privileged, or state-mutating functionality in the underlying code. An attacker can exploit this description–code…

A data poisoning vulnerability exists in the pretraining pipeline of Transformer-based Large Language Models (LLMs) where the injection of synthetic uniform random noise into the training corpus induces irreversible training loss divergence or performance degradation. This instability is mechanistically distinct from divergence caused by high learning rates. The vulnerability is specifically triggered by "insertion noise" (inserting random tokens between clean tokens) drawn from a restricted…