Attack Type

Denial of service Research

Attacks that disrupt model availability

15 matching entries out of 36 in this category

Denial of service research results

15 entries

Context privilege escalation in AI agent harnesses

Published Sep 1, 2026Analyzed Sep 9, 2026Source: arXiv

Context assembly can promote repository, tool or skill content into higher-priority instructions or persistent state. The paper studies 12 pinned agent-harness versions.

What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness

Evaluated models: GPT-5.5, GPT-5.4-mini, Claude Sonnet 4.6+4 more

GPT-5.5
GPT-5.4-mini
Claude Sonnet 4.6
Claude Opus 4.6
Gemini 2.5 Flash
Gemini 2.5 Pro
DeepSeek V4 Flash

Poisoned agent skills amplify coding-agent token use

Published Aug 22, 2026Analyzed Sep 9, 2026Source: arXiv

Third-party skills can inflate coding-agent resource use while an otherwise legitimate task remains functional.

SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents

Evaluated models: GLM-4.7-Flash, GLM-5, GPT-5.4-mini+1 more

GLM-4.7-Flash
GLM-5
GPT-5.4-mini
GPT-5.5

Agent Lifecycle Compound Threats

Published Mar 12, 2026Analyzed Apr 10, 2026Source: arXiv

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Evaluated models: Not reported

Stealthy Tool-Call Token Exhaust

Published Mar 1, 2026Analyzed Mar 8, 2026Source: arXiv

OpenClaw v2026.2.9 is vulnerable to a resource amplification and economic denial-of-service (DoS) attack via malicious third-party skills. An attacker can publish a Trojanized skill that exploits the framework's tool-calling loop and context-management architecture by injecting a multi-turn "Segmented Verification Protocol" (SVP). Malicious instructions embedded in the skill's SKILL.md file mandate extensive autoregressive sequence generation, while a companion script returns PROGRESS, REPAIR…

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

Evaluated models: Gemini 2.5 Pro

Adaptive Web Agent Prompt Injection

Published Feb 9, 2026Analyzed Feb 21, 2026Source: arXiv

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks

Evaluated models: GPT-4.1, GPT-4o, Qwen3-VL 32B Instruct

Voice Agent Behavioral Bypass

Published Feb 7, 2026Analyzed Feb 21, 2026Source: arXiv

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Aegis: Towards Governance, Integrity, and Security of AI Voice Agents

Evaluated models: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro+4 more

GPT-4o
GPT-4o Mini
Gemini 1.5 Pro
Gemini 2.5 Flash
Gemini 2.5 Pro
Qwen2-Audio 7B
Qwen 2.5 Omni 7B

Visual Object Injection

Published Jan 24, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Evaluated models: GPT-4o, GPT-4o Mini, GPT-4 Turbo+7 more

GPT-4o
GPT-4o Mini
GPT-4 Turbo
Gemini 1.5 Pro Latest
Gemini 1.5 Pro 002
Gemini 1.5 Flash Latest
Claude 3.5 Sonnet Latest
Claude 3.5 Haiku 20241022
Llama 3.2 11B Vision
Llama 3.2 90B Vision Instruct

Indirect Environmental Jailbreak

Published Nov 20, 2025Analyzed Dec 30, 2025Source: arXiv

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreaks

Evaluated models: GPT-4o, Qwen3-VL Plus, Gemini 2.0 Flash+3 more

GPT-4o
Qwen3-VL Plus
Gemini 2.0 Flash
GLM 4.5
DeepSeek-VL2
Claude 3.5 Sonnet

Schrodinger's Compliance Jailbreak

Published Sep 28, 2025Analyzed Feb 21, 2026Source: arXiv

The GPT-OSS-20B large language model contains critical failures in its alignment and Chain-of-Thought (CoT) reasoning mechanisms, specifically in how it prioritizes numerical objectives and validates procedural structure. The model is vulnerable to "Quant Fever," where explicit numerical targets in a prompt (e.g., "delete 90% of files") override contextual safety constraints (e.g., "do not delete important files"). Furthermore, the model exhibits "Reasoning Procedure Mirage," where harmful…

Quant Fever, Reasoning Blackholes, Schrodinger's Compliance, and More: Probing GPT-OSS-20B

Evaluated models: Not reported

Adversarial Report Code Insecurity

Published Sep 4, 2025Analyzed Dec 9, 2025Source: arXiv

Large Language Model (LLM)-based Automated Program Repair (APR) systems—such as SWE-agent, OpenHands, and AutoCodeRover—are vulnerable to adversarial manipulation via crafted bug reports. These systems accept unvetted natural language issue descriptions as trusted input to synthesize code patches. An attacker can exploit this trust by submitting semantically plausible but malicious bug reports designed to mislead the APR agent. By leveraging the semantic gap between natural language…

Adversarial Bug Reports as a Security Risk in Language Model-Based Automated Program Repair

Evaluated models: Prompt Guard, PromptGuard V2, Llama Guard 3+4 more

Prompt Guard
PromptGuard V2
Llama Guard 3
Llama Guard 4
Granite Guardian
GPT-4.1 Mini
o4-mini

Related research categories