Attack Type

Denial of service Research

Attacks that disrupt model availability

36 matching entries

Denial of service research results

36 entries

Context privilege escalation in AI agent harnesses

Published Sep 1, 2026Analyzed Sep 9, 2026Source: arXiv

Context assembly can promote repository, tool or skill content into higher-priority instructions or persistent state. The paper studies 12 pinned agent-harness versions.

What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness

Evaluated models: GPT-5.5, GPT-5.4-mini, Claude Sonnet 4.6+4 more

GPT-5.5
GPT-5.4-mini
Claude Sonnet 4.6
Claude Opus 4.6
Gemini 2.5 Flash
Gemini 2.5 Pro
DeepSeek V4 Flash

Poisoned agent skills amplify coding-agent token use

Published Aug 22, 2026Analyzed Sep 9, 2026Source: arXiv

Third-party skills can inflate coding-agent resource use while an otherwise legitimate task remains functional.

SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents

Evaluated models: GLM-4.7-Flash, GLM-5, GPT-5.4-mini+1 more

GLM-4.7-Flash
GLM-5
GPT-5.4-mini
GPT-5.5

Stealthy Tool Chain Amplification

Published Jan 16, 2026Analyzed Apr 11, 2026Source: arXiv

A stealthy resource exhaustion (Economic Denial-of-Service) vulnerability exists in the multi-turn tool-calling layer of Large Language Model (LLM) agents, particularly those utilizing the Model Context Protocol (MCP). An attacker controlling a third-party tool server can manipulate text-visible fields (such as argument descriptions and error messages) to force the LLM into a prolonged, verbose tool-calling loop. By demanding lengthy, non-semantic outputs (e.g., long comma-separated lists) and…

Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents

Evaluated models: DeepSeek R1 Distill Llama 70B, GLM 4.5 Air, GPT-4o+4 more

DeepSeek R1 Distill Llama 70B
GLM 4.5 Air
GPT-4o
Llama 3.3 70B Instruct
Mistral Large
Qwen 3 32B
Seed 32B

Agent Lifecycle Compound Threats

Published Mar 12, 2026Analyzed Apr 10, 2026Source: arXiv

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Evaluated models: Not reported

Multi-Stream Thinking Collapse

Published Mar 10, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in Large Language Models (LLMs) equipped with built-in "thinking" or step-by-step reasoning modes allows attackers to bypass safety alignments, trigger reasoning collapse, and cause resource exhaustion. The vulnerability is exploited via a Multi-Stream Perturbation Attack, which fragments the sequential integrity of a harmful prompt by word-by-word interleaving it with benign auxiliary tasks (e.g., "Explain the water cycle"). By wrapping the benign text streams in specific…

Multi-Stream Perturbation Attack: Breaking Safety Alignment of Thinking LLMs Through Concurrent Task Interference

Evaluated models: Qwen 3 1.7B, Qwen 3 4B, Qwen 3 8B+2 more

Qwen 3 1.7B
Qwen 3 4B
Qwen 3 8B
Qwen 3 Max
Gemini 2.5 Flash

Video-LLM Token Flood

Published Mar 2, 2026Analyzed Mar 9, 2026Source: arXiv

Video-based Large Language Models (Video-LLMs) are vulnerable to a universal Energy-Latency Attack (ELA) that triggers a Denial-of-Service (DoS) via spatially concentrated adversarial patches. Because video architectures rely on temporal subsampling and pooling which act as a low-pass filter against full-frame diffuse noise, an attacker can bypass this compression by anchoring cross-modal attention to a dense, localized visual anomaly. By injecting a fixed, content-agnostic patch into the…

VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Models

Evaluated models: LLaVA-NeXT-Video 7B, Qwen3-VL 4B Instruct, Video-LLaVA 7B

Pathological Reasoning DoS

Published Jan 29, 2026Analyzed Mar 9, 2026Source: arXiv

A vulnerability in Large Reasoning Models (LRMs) allows attackers to perform Prompt-Induced Inference-Time Denial-of-Service (PI-DoS) attacks by submitting short, semantically coherent adversarial prompts. These prompts, which often take the form of complex logic puzzles with nested dependencies or contradictory constraints, exploit the adaptive computation mechanism of LRMs to force the model into pathologically long, nearly non-terminating intermediate reasoning traces (e.g., generating…

ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models

Evaluated models: DeepSeek V3, Kimi K2 Instruct, DeepSeek R1+8 more

DeepSeek V3
Kimi K2 Instruct
DeepSeek R1
DeepSeek R1 Distill Qwen 32B
MiniMax M2
Nemotron 3 Nano 30B-A3B
Qwen 3 30B-A3B Thinking
Qwen 3 32B
Claude Sonnet 4.5
GPT-5
Gemini 3 Pro Preview

Stealthy Tool-Call Token Exhaust

Published Mar 1, 2026Analyzed Mar 8, 2026Source: arXiv

OpenClaw v2026.2.9 is vulnerable to a resource amplification and economic denial-of-service (DoS) attack via malicious third-party skills. An attacker can publish a Trojanized skill that exploits the framework's tool-calling loop and context-management architecture by injecting a multi-turn "Segmented Verification Protocol" (SVP). Malicious instructions embedded in the skill's SKILL.md file mandate extensive autoregressive sequence generation, while a companion script returns PROGRESS, REPAIR…

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

Evaluated models: Gemini 2.5 Pro

TabooRAG Transferable Blocking

Published Mar 4, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in Retrieval-Augmented Generation (RAG) systems utilizing safety-aligned Large Language Models (LLMs) allows attackers to perform a highly transferable Denial-of-Service (DoS) or "blocking" attack. By injecting a single maliciously crafted document into the RAG knowledge base, attackers can force the LLM to refuse to answer benign queries. Unlike previous attacks that rely on explicit instruction injection or high-perplexity adversarial suffixes—which modern models easily…

When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG

Evaluated models: GPT-5.2, GPT-5 Mini, DeepSeek V3.2+4 more

GPT-5.2
GPT-5 Mini
DeepSeek V3.2
Qwen 3 32B
Gemma 3 12B IT
Llama 3 8B Instruct
Ministral 3 8B Instruct-2512

LLM Router Rerouting

Published Jan 29, 2026Analyzed Mar 8, 2026Source: arXiv

LLM routing systems are vulnerable to adversarial rerouting attacks where malicious triggers prepended to user queries manipulate the router's model-selection mechanism. Because LLM routers function as classifiers evaluating query complexity to balance computational cost and response quality, an attacker can craft adversarial prefixes that distort the query's latent semantic representation. This exploits the router's decision boundaries, forcing the system to misclassify the input and redirect…

RerouteGuard: Understanding and Mitigating Adversarial Risks for LLM Routing

Evaluated models: GPT-4, GPT-4o, GPT-5+2 more

GPT-4
GPT-4o
GPT-5
Llama 3 8B
Mixtral 8x7B

Related research categories