Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

610 matching entries

Prompt layer research results

610 entries

Decomposed Query Evasion

Published Feb 25, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in the multi-turn context handling of Large Language Models (LLMs) allows attackers to bypass safety guardrails by decomposing complex fraud and cybercrime operations into a sequence of seemingly benign queries. By mapping the cybercrime lifecycle (planning, reconnaissance, falsification, engagement, evasion, and scaling) into Long-Form Tasks (LFTs) and framing the queries as legitimate research or security testing, attackers can elicit actionable attack materials and detailed…

A Multi-Turn Framework for Evaluating AI Misuse in Fraud and Cybercrime Scenarios

Evaluated models: Claude 3.5 Sonnet, Claude 3.7 Sonnet, Claude Sonnet 4+12 more

Claude 3.5 Sonnet
Claude 3.7 Sonnet
Claude Sonnet 4
Claude Sonnet 4.5
Claude Opus 4.1
o4-mini
o4-mini Deep Research
Mistral Small 3.2 24B Instruct 2506
Mistral Medium 2505
Mistral Large 2411
Mistral Small 24B Instruct 2501
Llama 3.1 8B Lexi Uncensored V2
Grok 3
Grok 4
GPT-4.1

Web-Triggered Silent Egress

Published Feb 25, 2026Analyzed Mar 8, 2026Source: arXiv

Agentic LLM systems that automatically preview URLs or extract web metadata are vulnerable to implicit prompt injection, resulting in silent data exfiltration ("silent egress"). Attackers can embed adversarial instructions in unobserved web elements, such as HTML <title> tags, <meta> descriptions, or Open Graph metadata. When a user requests a summary of the URL—or when the agent automatically unfurls a linked URL in a chat—the system fetches the malicious page and flattens this metadata into…

Silent Egress: When Implicit Prompt Injection Makes LLM Agents Leak Without a Trace

Evaluated models: Qwen 2.5 7B

Adaptive Agent Tool Injection

Published Feb 24, 2026Analyzed Apr 11, 2026Source: arXiv

Agentic LLMs integrated with external data services (e.g., Model Context Protocol, MCP) are vulnerable to Adaptive Indirect Prompt Injection (IPI) attacks. When an agent queries external servers, attackers can inject malicious payloads into the retrieved content to hijack the agent's reasoning process and force the execution of high-authority tools. Unlike traditional static prompt injections, this vulnerability dynamically exploits the agent's internal logic audit. By using Markovian…

AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs

Evaluated models: GPT-4.1, DeepSeek R1, Gemini 2.5 Flash+3 more

GPT-4.1
DeepSeek R1
Gemini 2.5 Flash
Qwen 3 8B
Llama 3.1 8B
Mistral 8B

Agent Skill Supply Chain Attack

Published Feb 24, 2026Analyzed Mar 9, 2026Source: arXiv

LLM agent frameworks that rely on external or marketplace-distributed skills are vulnerable to supply-chain payload execution and confused deputy attacks. Attackers can inject malicious skills into agent registries by exploiting the fundamental skill architecture (applicability conditions, policies, and interfaces). By manipulating skill metadata and applicability predicates, attackers force the agent to retrieve and activate the malicious skill across broad task categories. Malicious…

SoK: Agentic Skills--Beyond Tool Use in LLM Agents

Evaluated models: Not reported

Heavy Reasoning Filter Bypass

Published Feb 24, 2026Analyzed Mar 8, 2026Source: arXiv

Multiple open-source Large Language Models (LLMs) in the 1B to 7B parameter range are vulnerable to safety bypasses via long-form, multi-step reasoning prompt injection and jailbreak attacks. Attackers can evade alignment by embedding malicious instructions within extended contextual narratives, exploiting "attention dilution" and the models' tendency to prioritize contextual coherence over safety constraints (semantic camouflage). These reasoning-heavy attacks consistently bypass standard…

Analysis of LLMs Against Prompt Injection and Jailbreak Attacks

Evaluated models: Phi-3 Mini 3.8B, Mistral 7B, DeepSeek R1 Distill Qwen 7B+7 more

Phi-3 Mini 3.8B
Mistral 7B
DeepSeek R1 Distill Qwen 7B
DeepSeek R1 Distill Qwen 1.5B
Llama 3.2 3B
Llama 3.2 1B
Qwen 3 4B
Qwen 3 1.7B
Gemma 3 1B
Gemma 3 4B

Indirect Prompt Injection Hijacks Tool-Using Agents

Published Feb 24, 2026Analyzed Jul 20, 2026Source: arXiv

The paper evaluates a reproducible indirect prompt injection issue in ReAct-style LLM agents: untrusted retrieved content can be interpreted as instructions and redirect the agent toward unauthorized tool calls. The authors report that successful attacks correlate with concentrated attention on injected content and evaluate defenses using InjectAgent, AgentDojo, TrojanTools, and a visual prompt-injection benchmark. These are paper-reported findings, not independently verified facts.

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

Evaluated models: Qwen 3 8B, Llama 3.1 8B, Mistral 8B+3 more

Qwen 3 8B
Llama 3.1 8B
Mistral 8B
Qwen3VL
InternVL
MiniCPM

Natural Language Disguise Bypass

Published Feb 23, 2026Analyzed Mar 9, 2026Source: arXiv

LLM-based Code Interpreter Agents, including OpenInterpreter and OpenCodeInterpreter, are vulnerable to sandbox evasion and arbitrary code execution via Natural Language Disguise and Contextual Channel Injection. Attackers can bypass Abstract Syntax Tree (AST) static analysis and explicit input guardrails by transforming malicious code logic into descriptive natural language instructions (Code Descriptions), which successfully evade syntax-layer blocks. Additionally, attackers can bypass input…

CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents

Evaluated models: GPT-3.5, GPT-4o, GPT-5

TEE Advisor Hallucination

Published Feb 23, 2026Analyzed Mar 8, 2026Source: arXiv

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments

Evaluated models: GPT-5.2, Claude Opus 4.6

Thought Virus Network Infection

Published Feb 23, 2026Analyzed Mar 9, 2026Source: arXiv

A vulnerability in LLM-based Multi-Agent Systems (MAS) allows an attacker to propagate covert biases and misalignment across multiple agents via subliminal prompting, an attack vector termed "Thought Virus." By injecting a seemingly benign, semantically unrelated token (such as a specific 3-digit number) into the prompt of a single compromised agent, an attacker can induce a specific targeted behavior (e.g., outputting a specific target concept or decreasing factual truthfulness). This induced…

Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems

Evaluated models: Llama 3.1 8B, Qwen 2.5 7B

Role-Confusion Prompt Injection via Forged Reasoning

Published Feb 22, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible prompt-injection failure in which low-privilege user or tool-output text that imitates a trusted role—especially a model’s reasoning style—is treated as authoritative. Its zero-shot, black-box “CoT Forgery” evaluation injects fabricated reasoning into user prompts and retrieved webpage/tool output. The authors report 60% average attack success on StrongREJECT and 56–70% success in an agent data-exfiltration evaluation, versus near-zero or substantially lower…

Prompt Injection as Role Confusion

Evaluated models: GPT-oss 20B, GPT-oss 120B, o4-mini+6 more

GPT-oss 20B
GPT-oss 120B
o4-mini
GPT-5 Nano
GPT-5 Mini
GPT-5
GLM-4.6
Kimi K2 Instruct
MiniMax M2

Related research categories