Attack Type

Poisoning Research

Attacks targeting training data, fine-tuning, retrieval knowledge bases, or persistent agent memory

26 matching entries out of 114 in this category

Poisoning research results

26 entries

Single-interaction poisoning of agent memory

Published Aug 24, 2026Analyzed Sep 9, 2026Source: arXiv

A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

Evaluated models: Qwen 2.5 7B Instruct, Qwen 2.5 1.5B Instruct, Qwen 2.5 3B Instruct+3 more

Qwen 2.5 7B Instruct
Qwen 2.5 1.5B Instruct
Qwen 2.5 3B Instruct
Qwen 2.5 14B Instruct
Llama 3.1 8B Instruct
Mistral 7B Instruct v0.3

Query-Agnostic Poisoning of Medical Multimodal RAG

Published May 11, 2026Analyzed Jul 20, 2026Source: arXiv

M3Att demonstrates a reproducible knowledge-poisoning issue in medical multimodal RAG: an attacker with limited corpus-distribution knowledge can insert paired image-text entries whose visually perturbed images are broadly retrieved and whose clinically plausible misinformation steers downstream generation. The paper evaluates both white-box and black-box retrieval optimization and reports degraded diagnostic and report-generation utility across multiple datasets, retrievers, and LVLMs. These…

Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation

Evaluated models: GPT-4o, GPT-5 Chat, Gemini 2.5 Flash+5 more

GPT-4o
GPT-5 Chat
Gemini 2.5 Flash
Claude Haiku 4.5
LLaVA Med
CLIP ViT-Large-Patch14-336
BGE-VL-base
SigLIP-SO400M-Patch14-384

No-Prompt Reasoning Hijack

Published Apr 7, 2026Analyzed Apr 10, 2026Source: arXiv

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and…

Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents

Evaluated models: GPT-3.5 Turbo, GPT-4o, GPT-5+4 more

GPT-3.5 Turbo
GPT-4o
GPT-5
Llama 3.1 70B
Claude 3.5 Haiku
Gemini 3.0 Pro
ERNIE 3.5

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Stage-Sequential Agent Escalation

Published Mar 18, 2026Analyzed Apr 10, 2026Source: arXiv

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems

Evaluated models: GPT-4o Mini, Claude 3 Haiku, Llama 3.1 70B Instruct+2 more

GPT-4o Mini
Claude 3 Haiku
Llama 3.1 70B Instruct
Gemini 2.0 Flash
Mixtral 8x7B Instruct

Autonomous Agent Tool RCE

Published Mar 13, 2026Analyzed Apr 11, 2026Source: arXiv

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw

Evaluated models: Not reported

Agent Lifecycle Compound Threats

Published Mar 12, 2026Analyzed Apr 10, 2026Source: arXiv

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Evaluated models: Not reported

Zombie Agent Persistence

Published Feb 17, 2026Analyzed Feb 22, 2026Source: arXiv

Self-evolving Large Language Model (LLM) agents that utilize long-term memory mechanisms (such as Vector Databases for Retrieval-Augmented Generation or Sliding Window buffers) are vulnerable to persistent indirect prompt injection. This vulnerability, termed "Zombie Agent," occurs when the agent's memory update function ($F_M$) processes attacker-controlled content retrieved from external sources (e.g., web pages, documents) and commits it to long-term storage without sufficient sanitization…

Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections

Evaluated models: Not reported

Automated Stealth Skill Injection

Published Feb 15, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents

Evaluated models: Claude Sonnet 4.6, GPT-5 Mini, GLM-4.7+7 more

Claude Sonnet 4.6
GPT-5 Mini
GLM-4.7
MiniMax M2.1
DeepSeek V4 Flash
GLM-5.1
MiniMax M2.7
MiMo V2.7
GPT-5.4
Claude Opus 4.6

Personalized Agent Double Agent

Published Feb 9, 2026Analyzed Mar 9, 2026Source: arXiv

OpenClaw is vulnerable to Indirect Prompt Injection (IPI), Tool-Return Manipulation, and Persistent Memory Poisoning. The agent incorporates untrusted external content (e.g., fetched web pages) and external tool outputs directly into its observation stream without sufficient isolation. An attacker can embed malicious payloads into these external channels to hijack the agent's planning and execution trace. This allows the attacker to silently trigger high-privilege actions via OpenClaw's Skills…

From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent

Evaluated models: GPT-4o, Llama 3.1 70B, Qwen 2.5 7B

Related research categories