Impact

Reliability Research

Issues affecting model consistency and dependability

10 matching entries out of 203 in this category

Reliability research results

10 entries

Benign Cross-User Contamination

Published Apr 1, 2026Analyzed Apr 11, 2026Source: arXiv

A vulnerability exists in multi-user LLM agents utilizing persistent shared state, allowing Unintentional Cross-User Contamination (UCC). Without requiring any malicious input or attacker, benign user interactions containing locally valid scope constraints, formatting preferences, or procedural rules are persisted into the agent's shared memory or conversational context. The agent subsequently retrieves and misapplies these scope-bound artifacts to unrelated tasks from different users. This…

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents

Evaluated models: GPT-4o

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Autonomous Agent Tool RCE

Published Mar 13, 2026Analyzed Apr 11, 2026Source: arXiv

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw

Evaluated models: Not reported

Agent Lifecycle Compound Threats

Published Mar 12, 2026Analyzed Apr 10, 2026Source: arXiv

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Evaluated models: Not reported

TEE Advisor Hallucination

Published Feb 23, 2026Analyzed Mar 8, 2026Source: arXiv

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments

Evaluated models: GPT-5.2, Claude Opus 4.6

Retrieval Memory Injection

Published Feb 17, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in the similarity-based retrieval mechanisms of long-term memory-augmented Large Language Models (LLMs), specifically affecting systems like Mem0 and A-mem. The vulnerability arises from the system's reliance on dense embedding similarity (e.g., cosine similarity) to retrieve context from dynamic, user-generated memory banks without sufficient semantic validation or conflict resolution. An unprivileged remote attacker can exploit this by injecting "adversarial…

ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Models

Evaluated models: GPT-oss 20B, Llama 3.2 3B, Gemma 3 27B

Agent Memory Misevolution

Published Feb 3, 2026Analyzed Mar 9, 2026Source: arXiv

LLM agents employing unconstrained test-time memory evolution are vulnerable to "Agent Memory Misevolution," a form of deployment-time reward hacking. When an agent's strategy memory bank is updated based solely on a task success threshold (utility) without explicit safety constraints, the system progressively accumulates and prioritizes "toxic shortcuts"—strategies that efficiently solve benign tasks but implicitly erode safety alignments. Over continuous interactions, the probability…

TAME: A Trustworthy Test-Time Evolution of Agent Memory with Systematic Benchmarking

Evaluated models: GPT-4o, Qwen 2.5 32B

Adversarial Claim Search Deception

Published Jan 31, 2026Analyzed Feb 22, 2026Source: arXiv

Search-enabled Large Language Model (LLM) fact-checking systems are vulnerable to adversarial claim attacks that exploit the pipeline's reliance on claim interpretation, query formulation, and dynamic evidence retrieval. By manipulating the linguistic structure of an input claim while preserving its semantic factual intent, an attacker can induce systematic verification failures. This vulnerability stems from three specific attack surfaces: 1. Search Engine Misguidance: Altering lexical…

DECEIVE-AFC: Adversarial Claim Attacks against Search-Enabled LLM-based Fact-Checking Systems

Evaluated models: GPT-4o

Distractor Inverse Scaling

Published Jan 12, 2026Analyzed Feb 21, 2026Source: arXiv

Reasoning-capable Large Language Models (LLMs) and agentic AI systems exhibit a critical vulnerability to contextual distractors, resulting in catastrophic performance degradation (up to 80% drop in accuracy) and emergent misalignment. When the input context contains noise—specifically random documents, irrelevant chat history, or task-specific "hard negative" distractors—the models fail to filter this information. Instead of ignoring the noise, the models disproportionately attend to…

Lost in the Noise: How Reasoning Models Fail with Contextual Distractors

Evaluated models: Gemini 2.5 Pro, Gemini 2.5 Flash, DeepSeek R1 0528+4 more

Gemini 2.5 Pro
Gemini 2.5 Flash
DeepSeek R1 0528
GPT-oss 120B
Qwen 3 4B Thinking 2507
DeepSeek R1 Distill Llama 8B
Qwen 3 30B-A3B Thinking 2507

Tool Stream Injection Hijack

Published Jan 9, 2026Analyzed Feb 21, 2026Source: arXiv

Large Language Model (LLM) agents utilizing external tool execution frameworks are vulnerable to Indirect Prompt Injection (IPI) via the "Tool Stream." Unlike traditional data-stream injections (e.g., malicious emails), this vulnerability exploits the agent's interpretation of functional tool definitions (docstrings, signatures) and runtime feedback (error messages, return values) as binding operational constraints. Adversaries functioning as compromised or malicious tool providers can embed…

VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit

Evaluated models: Gemini 2.5 Pro, Qwen 3 Max

Related research categories