Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

604 matching entries

Prompt layer research results

604 entries

Persistent Agent Memory Poisoning and Incomplete Repair

Published 7/29/2026

Analyzed 8/13/2026

MemSecBench follows malicious agent-memory content from initial write through persistence, retrieval, action selection, execution, and attempted selective repair. Its controlled Write–Execute–Forget protocol evaluates 310 human-reviewed cases across two harnesses, four memory backends, three model backends, and seven evidence-gated lifecycle checkpoints.

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Evaluated models: GPT-5.5, DeepSeek V4-Pro, MiniMax-M3

Source: arXiv

Workspace Agent Runtime Safety Failures Across Risk Carriers

Published 7/29/2026

Analyzed 8/13/2026

AgentS4D measures unsafe actions and state changes across complete workspace-agent executions rather than treating task completion or isolated model responses as safety evidence. Its 328 sandboxed cases introduce risky content through user requests, documents, web resources, tools, third-party skills, and persistent memory, then compare the same cases across four agent harnesses and five model backends.

AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents

Evaluated models: GPT-5.5, Gemini 3.1 Pro, DeepSeek V4-Pro +2 more

Source: arXiv

Incomplete MCP Tool-Call Attack Detection

Published 7/28/2026

Analyzed 8/13/2026

The MTGuard study evaluates unsafe Model Context Protocol tool calls originating from compromised server data, host-side execution changes, and malicious user-controlled resources. Its hybrid monitor combines pre-execution parameter inspection, behavioral observation, and post-execution result verification across browser-automation and financial-analysis agents.

Hybrid Analysis for Secure MCP Tool Use in LLM Agents

Evaluated models: GPT-5.6 Luna, DeepSeek V4 Flash, DeepSeek V4-Pro

Source: arXiv

Long-Context Enterprise Agent Policy Adherence Failures

Published 7/28/2026

Analyzed 8/13/2026

HANDBOOK.md measures whether an agent can apply detailed organizational rules while completing realistic, multi-step enterprise tasks. The vendor-authored benchmark includes 65 resettable MCP-backed workflows, policy documents of 20 to 124 pages, and 824 deterministic rubric checks covering required decisions, prohibited actions, and final environment state.

HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following

Evaluated models: Claude Fable 5, GPT-5.6 Sol, Claude Opus 4.8 +16 more

Source: arXiv

Malicious GitHub Issue Injection Against Coding Agents

Published 7/22/2026

Analyzed 8/13/2026

IssueTrojanBench studies indirect prompt injection when a coding agent processes an apparently ordinary software-development issue or related artifact. Starting with six legitimate seed issues from two Python repositories, the authors construct 696 adversarial issue variants spanning four unsafe-action families and six delivery formats, then execute those variants across six agent-model configurations.

IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests

Evaluated models: GPT-5.3 Codex, GPT-5.4, Claude Sonnet 4.6

Source: arXiv

Lifecycle poisoning of reusable agent skills

Published 7/15/2026

Analyzed 7/21/2026

The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.

Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

Evaluated models: all-MiniLM-L6-v2, Gemini 3.1 Pro, Gemini 1.5 Flash

Source: arXiv

Cross-Site Prompt Injection in Web Agents

Published 7/9/2026

Analyzed 7/21/2026

The paper defines Cross-Site Prompting (XSP): attacker-controlled text in reviews, posts, seller listings, advertisements, or embeds can be interpreted as instructions by a web agent and steer its browser actions. It evaluates three reproducible WebArena attack templates—Shortcut, Fake Completion, and Ignore Instruction—plus WASP and adaptive stress tests. This is an evaluated agent-security issue and mitigation, not a claimed production CVE.

Prismata: Confining Cross-Site Prompt Injection in Web Agents

Evaluated models: GPT-5.4, GPT-5.4-mini, GPT-5.4 Nano +4 more

Source: arXiv

Black-Box System Prompt Leakage in Real-World LLM Applications

Published 6/17/2026

Analyzed 7/20/2026

The paper reports a reproducible black-box evaluation showing that adversarial user queries can cause deployed LLM applications to reveal hidden system prompts. In the authors’ measurement of 1,200 applications across six commercial platforms, 1,064 applications leaked prompt content (81.0%–93.5% per anonymized platform). This is a paper-reported result, not independently verified here. LeakBench and the official artifact repository provide defensive benchmark materials for controlled testing…

Understanding and Mitigating Prompt Leaking Attacks in Real-World LLM-Based Applications

Evaluated models: Llama 2 7B Chat, Llama 3.1 8B Instruct, Mistral 7B Instruct v0.3 +5 more

Source: arXiv

Automated indirect prompt injection against tool-calling agents

Published 6/9/2026

Analyzed 7/21/2026

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Evaluated models: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5 +6 more

Source: arXiv

Simulated Multi-Turn Priming Bypasses LLM Safety Alignment

Published 5/4/2026

Analyzed 7/21/2026

The paper reports a reproducible black-box jailbreak evaluation in which an evolutionary search generates simulated, role-labeled multi-turn dialogue histories and submits them as a single request. Five semantic mutators and graded judge feedback optimize conversational priming that can induce harmful responses despite direct-request refusals. Results are paper-reported and not independently verified.

ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming

Evaluated models: Qwen 3 8B, GPT-oss 20B, GPT-oss 120B +7 more

Source: arXiv

Related research categories