Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

102 matching entries out of 610 in this category

Prompt layer research results

102 entries

Agent Goal Reframing Exploit

Published Apr 6, 2026Analyzed Apr 10, 2026Source: arXiv

LLM agents deployed with tool access are vulnerable to goal-reframing prompt injection, which reliably bypasses explicit rule-following and safety instructions. By injecting language that recasts a standard task as a "puzzle," "Capture The Flag (CTF)," or "easter egg" hunt, an attacker can manipulate the agent's task-frame alignment. The agent does not override security rules; instead, it reinterprets exploitative actions—such as exploring hidden directories, bypassing test runners, or reading…

Mapping the Exploitation Surface: A 10,000-Trial Taxonomy of What Makes LLM Agents Exploit Vulnerabilities

Evaluated models: Claude Sonnet 4, GPT-4.1, GPT-5 Mini+4 more

Claude Sonnet 4
GPT-4.1
GPT-5 Mini
o4-mini
DeepSeek V3
GPT-5.4-mini
GPT-5.4 Nano

Agent Implicit Doc Execution

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Evaluated models: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5+2 more

Claude Sonnet 4.6
GLM-4.7
MiniMax M2.5
GPT-5.4
Gemini 2.5 Pro

Jailbreak Saturates Alignment Defenses

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Generalization Limits of Reinforcement Learning Alignment

Evaluated models: GPT-oss 20B

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Agentic Robot Instruction Attack

Published Mar 26, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Evaluated models: Not reported

Agent Tool Execution Jailbreak

Published Mar 21, 2026Analyzed Apr 10, 2026Source: arXiv

A multi-step tool execution vulnerability exists in Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) or similar tool-calling frameworks. Safety guardrails in aligned LLMs typically evaluate static, single-turn text generation. Attackers can bypass these text-centric guardrails by supplying adversarial prompts that force the agent into a complex planning sequence. The agent is manipulated into executing a trajectory of seemingly benign individual tool invocations…

T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search

Evaluated models: GPT-5, Gemini Pro, DeepSeek V3

Jailbreak Personalization Override

Published Mar 17, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in multi-step, tool-using Large Language Model (LLM) agents allows attackers to bypass safety guardrails by manipulating user context variables, such as personalization profiles or persistent memory. The safety policies of frontier LLMs are highly context-dependent; inserting innocuous user bios (e.g., demographic or health disclosures) fundamentally alters the agent's action policy. When combined with lightweight adversarial jailbreaks, specific personalization contexts…

Differential Harm Propensity in Personalized LLM Agents: The Curious Case of Mental Health Disclosure

Evaluated models: DeepSeek V3.2, GPT-5 Mini, GPT-5.2+5 more

DeepSeek V3.2
GPT-5 Mini
GPT-5.2
Gemini 3 Flash
Gemini 3 Pro
Claude Haiku 4.5
Claude Opus 4.5
Claude Sonnet 4.5

Contextual Priority Hacking

Published Mar 16, 2026Analyzed Apr 10, 2026Source: arXiv

Large Language Models (LLMs) are vulnerable to a jailbreak technique termed "Priority Hacking." Adversaries can bypass safety alignments by exploiting the model's internal priority graph, where certain abstract values (e.g., justice, public health) implicitly outweigh general safety restrictions within specific contexts. By crafting a deceptive prompt that frames a malicious request as a necessary action in service of a higher-priority benign value, attackers engineer a value conflict. The…

Are Dilemmas and Conflicts in LLM Alignment Solvable? A View from Priority Graph

Evaluated models: Not reported

Arbitrary Agent Topology Breach

Published Mar 11, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in LLM-based Multi-Agent Systems (LLM-MAS) allows an attacker who controls a single arbitrary agent to map and extract the system's entire confidential communication topology. Unlike prior attacks that rely on direct identity queries and administrative privileges, this attack infers topology stealthily purely from contextual and linguistic signals (stylometry, role-specific syntax), bypassing standard keyword-based and identity-filtering defenses. The exploit relies on a…

WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference

Evaluated models: Llama 3 70B, Llama 3.1 8B, Mistral Large 12B+3 more

Llama 3 70B
Llama 3.1 8B
Mistral Large 12B
Qwen 2.5 7B
Gemma 2 9B
Phi-3

Embodied Action Jailbreak

Published Mar 2, 2026Analyzed Mar 8, 2026Source: arXiv

Embodied Large Language Models (LLMs) used for real-world agent planning are vulnerable to Action-level Manipulation (dubbed "Blindfold"), a jailbreak technique that bypasses semantic-level safety filters by exploiting the models' limited spatial and causal reasoning regarding physical consequences. Attackers can use an adversarial proxy LLM to decompose a semantically harmful intent into a sequence of individually benign primitive actions. To evade advanced semantic correlation checks…

Jailbreaking Embodied LLMs via Action-level Manipulation

Evaluated models: GPT-4o, GPT-4 Turbo, GPT-4o Mini+5 more

GPT-4o
GPT-4 Turbo
GPT-4o Mini
Claude 3.5 Sonnet
Llama 3.1 8B
DeepSeek R1 Distill Qwen 14B
Gemma 3 27B IT
Phi-4 14B

Related research categories