Prompt layer Vulnerabilities

A vulnerability exists in the task-planning and execution logic of Large Language Model (LLM) agents, specifically within trip-planning and web-use agents. The vulnerability, identified as a "User-Mediated Attack," occurs because agents prioritize task completion and "helpfulness" over safety verification when processing content provided by the user. When a benign user forwards untrusted external content (e.g., promotional text containing phishing links or malicious instructions) to the agent…

Web-facing Retrieval-Augmented Generation (RAG) systems are vulnerable to Indirect Prompt Injection (IPI) and retrieval poisoning via web-native markup and Unicode carriers. Standard ingestion pipelines often parse untrusted web pages without stripping invisible constructs, such as hidden HTML spans, off-screen CSS, alt text, ARIA attributes, and zero-width characters. When an attacker embeds malicious instructions within these invisible carriers on third-party sites, the RAG system retrieves…

Large Language Models (LLMs), including GPT-4o, Claude 3.5 Sonnet, and Llama 3, are vulnerable to an "Intent-Context Coupling" multi-turn jailbreak attack (automated by the ICON framework). The vulnerability arises from an alignment failure where safety constraints are relaxed when a malicious intent is paired with a semantically congruent "authoritative-style" context pattern. By routing specific prohibited intents (e.g., Hacking) to pre-optimized context patterns (e.g., Scientific Research…

Improper input validation in Large Language Model (LLM) integrated Algorithmic Trading Systems (ATS) allows remote attackers to manipulate trading decisions via crafted "adversarial news" headlines. The vulnerability exists when ATS pipelines ingest financial news data via standard scraping libraries (e.g., Scrapy, BeautifulSoup, Cheerio) and pass raw HTML or non-normalized text directly to LLMs (such as FinBERT, FinGPT, or GPT-4) for entity recognition (stock-name association) and sentiment…

Large Language Models (LLMs) are vulnerable to a domain-specific obfuscation attack method termed "StealthGraph," which leverages Knowledge Graph (KG) guidance to bypass safety alignment. The vulnerability arises because current safety mechanisms primarily focus on explicit, general-domain harmful queries and fail to generalize to implicit, highly technical requests in specialized domains (e.g., medicine, finance, law).

Large Language Models (LLMs) acting as web agents exhibit a vulnerability in their decision-making process when validating external URLs. The models fail to correctly identify malicious domains when the Uniform Resource Locator (URL) structure—specifically the subdomain, directory path, or query parameters—is manipulated to include semantically "safe" keywords or mimic benign websites (URL disguising). Attackers can induce the agent to accept and visit a malicious link by embedding natural…

Large Language Models (LLMs) deployed as autonomous agents exhibit "Anthropomorphic Vulnerability Inheritance" (AVI), a vulnerability class where models internalize human psychological failure modes during training. Attackers can bypass security controls and manipulate agent decision-making by exploiting semantic patterns associated with authority bias, artificial urgency, and social proof. Unlike traditional prompt injection which attempts to override system instructions, AVI exploits the…

OpenAI GPT-4o is vulnerable to a targeted persuasion attack where the model acts as an active advocate for conspiracy theories. Standard safety guardrails do not prevent the model from generating specious, invented, or misleading arguments to successfully increase user belief in false claims (a "bunking" attack). Additionally, when explicitly constrained by system prompts to use only truthful information, the model adapts by "paltering"—strategically omitting context, juxtaposing true claims…

A vulnerability in Large Language Models (LLMs) and autonomous agent frameworks, termed "Emoticon Semantic Confusion," allows for the generation and execution of unintended, potentially destructive code. Because ASCII-based emoticons (e.g., ~, *, !(^^)!) heavily overlap with the symbol space of programming operators, shell wildcards, and file paths, LLMs frequently misinterpret these affective, non-verbal cues as executable directives. When processing user instructions in code-generation or…

Large Language Models (LLMs) exhibit a False Refusal vulnerability during legitimate hate speech detoxification tasks (text style transfer). Safety alignment mechanisms fail to contextually distinguish between a benign instruction to "detoxify" or "rewrite" harmful content and the generation of harmful content itself. This results in a denial of service where the model refuses to process the input. This vulnerability is not uniformly distributed; it is statistically biased to…