Attack Type

Injection Research

Attacks that inject malicious content into model inputs

337 matching entries

Injection research results

337 entries

Malicious GitHub Issue Injection Against Coding Agents

Published 7/22/2026

Analyzed 8/13/2026

IssueTrojanBench studies indirect prompt injection when a coding agent processes an apparently ordinary software-development issue or related artifact. Starting with six legitimate seed issues from two Python repositories, the authors construct 696 adversarial issue variants spanning four unsafe-action families and six delivery formats, then execute those variants across six agent-model configurations.

IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests

Evaluated models: GPT-5.3 Codex, GPT-5.4, Claude Sonnet 4.6

Source: arXiv

Third-Party Agent Skill Supply-Chain Execution Risks

Published 7/22/2026

Analyzed 8/13/2026

OpenSkillRisk evaluates whether agent harnesses safely handle third-party skills that introduce risky behavior through otherwise plausible, benign tasks. The benchmark assembles 263 risky skills from public agent-skill ecosystems and tests three CLI-agent harnesses against seven risk categories using isolated task workspaces, mocked external services, and execution-level evidence.

OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

Evaluated models: GPT-5.1 Codex Mini, GPT-5.3 Codex, GPT-5.4 +10 more

Source: arXiv

Prompt injection across agent privilege boundaries

Published 7/21/2026

Analyzed 9/9/2026

Untrusted issue descriptions and tool responses can redirect privileged coding and tool agents. Twin Agent separates exploration from execution and restricts the information exchanged between them.

Twin Agent: Context Residual Compression for Privilege Separated Agents

Evaluated models: GPT-5.2, Gemini 2.5 Flash, Gemini 3.5 Flash

Source: arXiv

Unsafe shell commands can pass LLM agent dispatch guards

Published 7/21/2026

Analyzed 9/9/2026

Shell-command screening can miss harmful actions generated by coding agents. CARE combines static checks with optional model review at the command-dispatch boundary.

CARE: Pre-Execution Command Verification for Shell-Executing LLM Agents

Evaluated models: Qwen3-Coder-30B-A3B-Instruct, Granite Guardian 2B, Llama Guard 3 8B +1 more

Source: arXiv

Lifecycle poisoning of reusable agent skills

Published 7/15/2026

Analyzed 7/21/2026

The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.

Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

Evaluated models: all-MiniLM-L6-v2, Gemini 3.1 Pro, Gemini 1.5 Flash

Source: arXiv

Cross-Site Prompt Injection in Web Agents

Published 7/9/2026

Analyzed 7/21/2026

The paper defines Cross-Site Prompting (XSP): attacker-controlled text in reviews, posts, seller listings, advertisements, or embeds can be interpreted as instructions by a web agent and steer its browser actions. It evaluates three reproducible WebArena attack templates—Shortcut, Fake Completion, and Ignore Instruction—plus WASP and adaptive stress tests. This is an evaluated agent-security issue and mitigation, not a claimed production CVE.

Prismata: Confining Cross-Site Prompt Injection in Web Agents

Evaluated models: GPT-5.4, GPT-5.4-mini, GPT-5.4 Nano +4 more

Source: arXiv

Agent Data Injection via Trusted-Metadata Spoofing

Published 7/6/2026

Analyzed 7/20/2026

Agent data injection (ADI) is a reproducible indirect injection class in which attacker-controlled external content is formatted to resemble trusted metadata or agent-context structure. The paper reports that probabilistic delimiter injection can cause agents to misinterpret untrusted content as trusted element IDs, author identities, or tool responses, leading to unintended clicks, command execution, or PR merges. Safe defensive reproduction should use the authors’ synthetic LLM/AgentDojo…

Agent Data Injection Attacks are Realistic Threats to AI Agents

Evaluated models: GPT-5.2, GPT-5 Mini, Claude Opus 4.5 +3 more

Source: arXiv

GhostWriter Persistent Memory Poisoning in Tool-Using Agents

Published 7/6/2026

Analyzed 7/20/2026

The paper describes GhostWriter, a reproducible two-phase attack against tool-using agents with persistent memory: untrusted email or calendar content is admitted into long-term memory, then later retrieved during a benign user task and treated as trusted context. In the authors’ controlled evaluation, this could steer subsequent agent actions despite the adversary lacking direct access to the agent, memory store, account, or later prompt. The paper reports an average 98% memory-injection rate…

When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents

Evaluated models: GPT-5.4-mini, DeepSeek V4 Flash, Gemini 2.5 Flash +1 more

Source: arXiv

Long-Term Memory Authority Laundering

Published 6/23/2026

Analyzed 7/20/2026

The paper describes a reproducible agent-memory poisoning issue: untrusted content stored in persistent memory can later influence consequential actions after its origin is laundered through agent summarization, trusted-tool echo, or manufactured corroboration. The paper reports that content scoring, lineage, and single-session capability/IFC defenses remain vulnerable because they decide authority from malleable content or derivation signals. This is a paper-reported evaluation; it was not…

Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees

Evaluated models: GPT-5 Chat, GPT-4o Mini, Claude Opus 4.1 +5 more

Source: arXiv

Automated indirect prompt injection against tool-calling agents

Published 6/9/2026

Analyzed 7/21/2026

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Evaluated models: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5 +6 more

Source: arXiv

Related research categories