Attack Type

Injection Research

Attacks that inject malicious content into model inputs

337 matching entries

Injection research results

337 entries

LLM Ranker Jailbreak

Published 2/1/2026

Analyzed 3/8/2026

LLM-based document re-rankers utilizing decoder-only and Mixture-of-Experts (MoE) architectures are vulnerable to candidate-embedded prompt injections during multi-document comparison tasks. By embedding Decision Objective Hijacking (DOH) or Decision Criteria Hijacking (DCH) prompts into candidate documents, attackers can manipulate the model's preference to artificially elevate an injected document to the top rank. The vulnerability exploits the models' instruction-following capabilities and…

The Vulnerability of LLM Rankers to Prompt Injection Attacks

Evaluated models: Qwen 3 0.6B, Qwen 3 1.7B, Qwen 3 8B +11 more

Source: arXiv

Learned Universal Prompt Injection

Published 2/1/2026

Analyzed 2/21/2026

Large Language Model (LLM) agents are vulnerable to automated prompt injection attacks generated via Reinforcement Learning (RL). The attack methodology, termed "AutoInject," utilizes Group Relative Policy Optimization (GRPO) combined with a comparison-based feedback mechanism to generate universal adversarial suffixes. Unlike traditional jailbreaks that optimize for generic affirmative responses (e.g., "Sure"), this vulnerability allows an attacker to optimize for specific, parameterized tool…

Learning to Inject: Automated Prompt Injection via Reinforcement Learning

Evaluated models: Gemini 2.5 Flash, Gemini 2.0 Flash, GPT-4.1 Nano +6 more

Source: arXiv

Long-Horizon Agent Attacks

Published 2/1/2026

Analyzed 4/10/2026

LLM agents equipped with tool-use, persistent memory, and environmental interaction capabilities are vulnerable to long-horizon attacks. Attackers can bypass single-turn safety guardrails by exploiting the temporal dimension of multi-turn interactions to incrementally steer agent behavior. The vulnerability manifests because the agent's safety mechanisms perform localized, single-step evaluations but fail to maintain semantic safety across extended interaction trajectories. This enables…

AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks

Evaluated models: GPT-4o, GPT-5.1, Gemini 3 Flash +1 more

Source: arXiv

Mobile Agent Visual Spoofing

Published 2/1/2026

Analyzed 2/22/2026

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Evaluated models: Not reported

Source: arXiv

Multi-Turn Proxy Evasion

Published 2/1/2026

Analyzed 2/22/2026

A logical vulnerability exists in LLM security proxies and guardrails that utilize weighted-average aggregation algorithms for multi-turn risk scoring. The scoring logic exhibits a mathematical "ceiling property" where the cumulative conversation-level risk score converges to the per-turn score regardless of the number of interaction turns ($n$). Consequently, the aggregated score is bounded by the maximum single-turn score ($cum \leq \max(s_i)$). This allows remote attackers to bypass…

Peak+ Accumulation: A Proxy-Level Scoring Formula for Multi-Turn LLM Attack Detection

Evaluated models: Not reported

Source: arXiv

Natural Language Disguise Bypass

Published 2/1/2026

Analyzed 3/9/2026

LLM-based Code Interpreter Agents, including OpenInterpreter and OpenCodeInterpreter, are vulnerable to sandbox evasion and arbitrary code execution via Natural Language Disguise and Contextual Channel Injection. Attackers can bypass Abstract Syntax Tree (AST) static analysis and explicit input guardrails by transforming malicious code logic into descriptive natural language instructions (Code Descriptions), which successfully evade syntax-layer blocks. Additionally, attackers can bypass input…

CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents

Evaluated models: GPT-3.5, GPT-4o, GPT-5

Source: arXiv

Persistent Agent Context Injection

Published 2/1/2026

Analyzed 3/8/2026

Conventional LLM agent architectures suffer from a working memory contamination vulnerability due to indiscriminate memory accumulation. When these agents retrieve external data via tools (e.g., web search, reading emails), the entire raw output is appended directly to their continuous context window. If the external data contains an Indirect Prompt Injection (IPI) payload, the malicious instruction persists in the agent's working memory across its entire multi-step reasoning workflow. This…

AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management

Evaluated models: GPT-4o, GPT-5.1, Claude 3.7 Sonnet +3 more

Source: arXiv

Personalized Agent Double Agent

Published 2/1/2026

Analyzed 3/9/2026

OpenClaw is vulnerable to Indirect Prompt Injection (IPI), Tool-Return Manipulation, and Persistent Memory Poisoning. The agent incorporates untrusted external content (e.g., fetched web pages) and external tool outputs directly into its observation stream without sufficient isolation. An attacker can embed malicious payloads into these external channels to hijack the agent's planning and execution trace. This allows the attacker to silently trigger high-privilege actions via OpenClaw's Skills…

From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent

Evaluated models: GPT-4o, Llama 3.1 70B, Qwen 2.5 7B

Source: arXiv

Pre-Task Persuasion Propagation

Published 2/1/2026

Analyzed 2/21/2026

A behavioral vulnerability exists in Large Language Model (LLM) agents where task-irrelevant persuasion introduced in prior interactions or system contexts induces a persistent "belief state" that alters downstream task execution. This phenomenon, termed "Persuasion Propagation," occurs when an agent adopts a stance on a controversial topic (e.g., politics, privacy) that is semantically unrelated to its primary function (e.g., coding, medical research). This adopted stance acts as a latent…

Persuasion Propagation in LLM Agents

Evaluated models: Llama 3.1 8B

Source: arXiv

Progressive Attention LVLM Attack

Published 2/1/2026

Analyzed 2/22/2026

Large Vision-Language Models (LVLMs) are vulnerable to a Stage-wise Attention-Guided Attack (SAGA) that allows for the generation of highly transferable, imperceptible adversarial examples. The vulnerability stems from a positive correlation between regional cross-modal attention scores and adversarial loss sensitivity in LVLMs. An attacker can exploit this by extracting an attention map from a surrogate open-source model (e.g., Qwen3-VL) to identify high-attention "hotspots." SAGA utilizes a…

Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Pro Preview, GPT-4.1 +7 more

Source: arXiv

Related research categories