Attack Surface

Infrastructure Vulnerabilities

Vulnerabilities in the deployment and hosting infrastructure

10 matching entries out of 16 in this category

Infrastructure research results

10 entries

Agent Lifecycle Compound Threats

Updated 4/10/2026

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Source: arXiv

Autonomous Agent Tool RCE

Updated 4/11/2026

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw

Source: arXiv

LLM Prefix Cache Reconstruction

Updated 4/10/2026

Automatic Prefix Caching (APC) in multi-tenant LLM serving systems introduces a timing side-channel vulnerability that permits cross-tenant data leakage. APC shares computed Key-Value (KV) tensors across different users when their requests share identical initial tokens. Because reusing cached tensors is significantly faster than recomputing them, a measurable difference in Time-To-First-Token (TTFT) exists between cache hits and misses. An attacker can exploit this shared cache by sending…

PrefixWall: Mitigating Prefix Caching Side Channels in Shared LLM Systems

Affects: Gemma 3 4B IT, Llama 2 7B Chat, Llama 2 13B Chat +6 more

Source: arXiv

Efficient KV-Cache Prompt Leakage

Updated 3/8/2026

A vulnerability in multi-tenant LLM serving frameworks allows attackers to reconstruct the private prompts of other users via an active Key-Value (KV) cache side-channel. Frameworks that utilize shared KV caches alongside specific scheduling policies, such as Longest Prefix Match (LPM), prioritize waiting requests based on the length of their matched prefix tokens. An attacker can exploit this by iteratively sending batches of guessed tokens mixed with dummy queries. If a guessed token matches…

OptiLeak: Efficient Prompt Reconstruction via Reinforcement Learning in Multi-tenant LLM Services

Affects: Llama 3.1 8B, Qwen 2.5 3B

Source: arXiv

Fill-Squeeze Scheduler DoS

Updated 2/21/2026

LLM serving frameworks utilizing continuous batching and PagedAttention (such as vLLM, SGLang, and Orca) are vulnerable to a resource exhaustion Denial-of-Service attack known as "Fill and Squeeze." An unprivileged remote attacker can exploit the deterministic state transitions of the scheduler's memory management to induce severe latency or service denial. The attack leverages a side-channel vulnerability where Inter-Token Latency (ITL) correlates linearly with global KV-cache usage due to…

Rethinking Latency Denial-of-Service: Attacking the LLM Serving Framework, Not the Model

Affects: Qwen 3 8B, Gemma 3 12B IT, DeepSeek R1 Distill Llama 8B +1 more

Source: arXiv

LLM Infinite Thinking DoS

Updated 2/21/2026

A Denial-of-Service (DoS) vulnerability exists in Large Language Model (LLM) inference services where specially crafted input prompts can trigger excessively long or infinite generation loops ("infinite thinking"). This vulnerability, identified as "ThinkTrap," utilizes derivative-free optimization (CMA-ES) within a continuous surrogate embedding space to circumvent the discrete nature of token inputs. By optimizing a low-dimensional latent vector and projecting it to token sequences, an…

ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinking

Affects: Gemini 2.5 Pro, Lumimaid 70B, o4-mini +4 more

Source: arXiv

KV-Cache Sharing Timing Side-channel

Updated 1/14/2026

Multi-tenant Large Language Model (LLM) inference systems utilizing global Key-Value (KV) cache sharing are vulnerable to a timing side-channel attack. By measuring the Time-To-First-Token (TTFT) latency of crafted API requests, an unprivileged remote attacker can determine if specific token sequences have been previously processed and cached by the system for other users. This observable timing difference between cache hits (low TTFT) and cache misses (high TTFT) allows for the token-by-token…

Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference

Affects: Phi-4 14B, Qwen 3 30B-A3B, Qwen 3 32B +3 more

Source: arXiv

LLM Interpreter Resource Exhaustion

Updated 8/16/2025

Large Language Models (LLMs) equipped with native code interpreters are vulnerable to Denial of Service (DoS) via resource exhaustion. An attacker can craft a single prompt that causes the interpreter to execute code that depletes CPU, memory, or disk resources. The vulnerability is particularly pronounced when a resource-intensive task is framed within a plausibly benign or socially-engineered context ("indirect prompts"), which significantly lowers the model's likelihood of refusal compared…

Running in CIRCLE? A Simple Benchmark for LLM Code Interpreter Security

Affects: Gemini 2.0 Flash, Gemini 2.5 Flash, Gemini 2.5 Pro +5 more

Source: arXiv

Life-Cycle Router Misrouting

Updated 12/30/2025

Predictive Large Language Model (LLM) routers, specifically those utilizing Deep Neural Network (DNN) and Matrix Factorization (MF) architectures, are vulnerable to adversarial manipulation and backdoor poisoning. These routers are designed to optimize cost and latency by dynamically directing simple queries to "weak" (cheap) models and complex queries to "strong" (expensive) models. Attackers can exploit this mechanism in two ways: 1. Inference-time Attacks: By appending specific adversarial…

Life-Cycle Routing Vulnerabilities of LLM Router

Source: arXiv

Confounder Gadgets Reroute LLMs

Updated 1/14/2026

A vulnerability exists in Large Language Model (LLM) routing systems (control planes) that allows for the manipulation of inference flow via adversarial input sequences. LLM routers, which dynamically direct user queries to either "weak" (cheaper) or "strong" (expensive) models based on predicted query complexity, can be bypassed by appending specific, pre-optimized token sequences known as "confounder gadgets." These gadgets artificially inflate the router's complexity score for an input…

Rerouting llm routers

Source: arXiv

Related research categories