Attack Type

Injection Research

Attacks that inject malicious content into model inputs

337 matching entries

Injection research results

337 entries

Persistent Agent Memory Poisoning and Incomplete Repair

Published Jul 29, 2026Analyzed Aug 13, 2026Source: arXiv

MemSecBench follows malicious agent-memory content from initial write through persistence, retrieval, action selection, execution, and attempted selective repair. Its controlled Write–Execute–Forget protocol evaluates 310 human-reviewed cases across two harnesses, four memory backends, three model backends, and seven evidence-gated lifecycle checkpoints.

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Evaluated models: GPT-5.5, DeepSeek V4-Pro, MiniMax-M3

Dynamic Security Testing for Third-Party Agent Skills

Published Aug 4, 2026Analyzed Aug 13, 2026Source: arXiv

SkillSentry evaluates third-party agent skills by constructing source-grounded decoy environments and comparing matched executions with and without the tested skill. The method requires completed, observable, skill-attributed side effects rather than treating suspicious text, ordinary privileged operations, or unexecuted paths as proven malicious behavior.

SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills

Evaluated models: DeepSeek V4-Pro

Trajectory Poisoning in Self-Evolving Agent Skills

Published Aug 6, 2026Analyzed Aug 13, 2026Source: arXiv

Self-evolving agent-skill systems may promote recurring, attacker-controlled execution records into persistent reusable instructions. The paper evaluates whether poisoned but task-plausible trajectories survive aggregation and appear in generated skill artifacts, using inert canary behaviors and two structurally different skill-evolution pipelines.

When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems

Evaluated models: GPT-5.4, MiniMax M2.5, DeepSeek V3.2+3 more

GPT-5.4
MiniMax M2.5
DeepSeek V3.2
DeepSeek V4-Pro
Qwen3.5-35B-A3B
Qwen3.5-122B-A10B

Incomplete MCP Tool-Call Attack Detection

Published Jul 28, 2026Analyzed Aug 13, 2026Source: arXiv

The MTGuard study evaluates unsafe Model Context Protocol tool calls originating from compromised server data, host-side execution changes, and malicious user-controlled resources. Its hybrid monitor combines pre-execution parameter inspection, behavioral observation, and post-execution result verification across browser-automation and financial-analysis agents.

Hybrid Analysis for Secure MCP Tool Use in LLM Agents

Evaluated models: GPT-5.6 Luna, DeepSeek V4 Flash, DeepSeek V4-Pro

Automated indirect prompt injection against tool-calling agents

Published Jun 9, 2026Analyzed Jul 21, 2026Source: arXiv

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Evaluated models: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5+6 more

Gemma3-4B Instruct
Qwen 3 4B Instruct
GPT-5
GPT-5 Mini
Qwen 3 32B
Qwen3-235B-A22B (MoE)
Qwen3-235B-A22B-Thinking (MoE)
Claude Sonnet 4.5
Gemini 2.5 Flash

Cross-Site Prompt Injection in Web Agents

Published Jul 9, 2026Analyzed Jul 21, 2026Source: arXiv

The paper defines Cross-Site Prompting (XSP): attacker-controlled text in reviews, posts, seller listings, advertisements, or embeds can be interpreted as instructions by a web agent and steer its browser actions. It evaluates three reproducible WebArena attack templates—Shortcut, Fake Completion, and Ignore Instruction—plus WASP and adaptive stress tests. This is an evaluated agent-security issue and mitigation, not a claimed production CVE.

Prismata: Confining Cross-Site Prompt Injection in Web Agents

Evaluated models: GPT-5.4, GPT-5.4-mini, GPT-5.4 Nano+4 more

GPT-5.4
GPT-5.4-mini
GPT-5.4 Nano
Gemini 3 Flash
GPT-oss 120B
Qwen 3 8B
MiniMax M2.5

Lifecycle poisoning of reusable agent skills

Published Jul 15, 2026Analyzed Jul 21, 2026Source: arXiv

The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.

Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

Evaluated models: all-MiniLM-L6-v2, Gemini 3.1 Pro, Gemini 1.5 Flash

MCP Tool-Metadata Prompt Injection in Coding Agents

Published Mar 23, 2026Analyzed Jul 20, 2026Source: arXiv

The paper presents a controlled, reproducible evaluation in which untrusted MCP tool descriptions contain hidden instructions that attempt to induce coding agents to access files, invoke other tools, create deceptive links, or execute remote scripts. The authors report that several clients accepted poisoned metadata without adequate validation or parameter visibility; Cursor 1.6.45 was reported unsafe across all four tested vectors. These are paper-reported results from isolated local tests…

Are AI-assisted Development Tools Immune to Prompt Injection?

Evaluated models: Claude Sonnet 4.5, Grok Code Fast 1, Gemini 2.5 Pro+1 more

Claude Sonnet 4.5
Grok Code Fast 1
Gemini 2.5 Pro
Claude Opus 4

Untrusted Skills and MCP Content Cross Coding-Agent Trust Boundaries

Published Jan 24, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes indirect prompt-injection chains in agentic coding assistants where untrusted repository content, skill definitions, extension context, or MCP tool metadata is interpreted as instructions. Its novel skill-chain analysis identifies a concrete authorization weakness: skills can grant broad tool types such as Read or Bash without restricting permitted file targets, allowing repository-supplied instructions to influence sensitive reads or tool execution. The paper is a…

Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems

Evaluated models: Not reported

Optimized Indirect Prompt Injection Crosses Retrieval Barrier

Published Jan 11, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible black-box indirect prompt injection evaluation for embedding-based RAG and agent systems. It separates a poisoned document into a retrieval-optimized trigger fragment and an instruction-bearing attack fragment, showing that one injected item can be surfaced by natural queries and then influence model output or agent behavior. These are paper-reported findings; they were not independently verified here.

Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems

Evaluated models: GPT-4o, GPT-4o Mini, Qwen 3 0.6B+19 more

GPT-4o
GPT-4o Mini
Qwen 3 0.6B
Qwen 3 1.7B
Qwen 3 4B
Qwen 3 8B
Qwen3-11B
Qwen 3 32B
Llama 3.2 3B
Llama 3.2 3B Instruct
Llama 3 8B
Llama 3 8B Instruct
Vicuna 7B
Vicuna 13B
gte-modernbert-base
OpenAI text-embedding-3-small
Voyage AI voyage-3.5-lite
Alibaba Cloud text-embedding-v4
contriever-msmarco
Qwen3-Embedding-0.6B
Qwen3-Embedding-4B
Qwen3-Embedding-8B

Related research categories