Impact

Safety Research

Security concerns affecting AI safety and alignment

50 matching entries out of 798 in this category

Safety research results

50 entries

Single-interaction poisoning of agent memory

Published Aug 24, 2026Analyzed Sep 9, 2026Source: arXiv

A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

Evaluated models: Qwen 2.5 7B Instruct, Qwen 2.5 1.5B Instruct, Qwen 2.5 3B Instruct+3 more

Qwen 2.5 7B Instruct
Qwen 2.5 1.5B Instruct
Qwen 2.5 3B Instruct
Qwen 2.5 14B Instruct
Llama 3.1 8B Instruct
Mistral 7B Instruct v0.3

Agent Implicit Doc Execution

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Evaluated models: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5+2 more

Claude Sonnet 4.6
GLM-4.7
MiniMax M2.5
GPT-5.4
Gemini 2.5 Pro

LLM Judge Manipulation

Published Mar 31, 2026Analyzed Apr 10, 2026Source: arXiv

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Evaluated models: GPT-4o, o1, Qwen 2.5 72B Instruct+1 more

GPT-4o
o1
Qwen 2.5 72B Instruct
Llama 3 70B Instruct

Stage-Sequential Agent Escalation

Published Mar 18, 2026Analyzed Apr 10, 2026Source: arXiv

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems

Evaluated models: GPT-4o Mini, Claude 3 Haiku, Llama 3.1 70B Instruct+2 more

GPT-4o Mini
Claude 3 Haiku
Llama 3.1 70B Instruct
Gemini 2.0 Flash
Mixtral 8x7B Instruct

Contextual Priority Hacking

Published Mar 16, 2026Analyzed Apr 10, 2026Source: arXiv

Large Language Models (LLMs) are vulnerable to a jailbreak technique termed "Priority Hacking." Adversaries can bypass safety alignments by exploiting the model's internal priority graph, where certain abstract values (e.g., justice, public health) implicitly outweigh general safety restrictions within specific contexts. By crafting a deceptive prompt that frames a malicious request as a necessary action in service of a higher-priority benign value, attackers engineer a value conflict. The…

Are Dilemmas and Conflicts in LLM Alignment Solvable? A View from Priority Graph

Evaluated models: Not reported

Autonomous Agent Tool RCE

Published Mar 13, 2026Analyzed Apr 11, 2026Source: arXiv

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw

Evaluated models: Not reported

Agent Lifecycle Compound Threats

Published Mar 12, 2026Analyzed Apr 10, 2026Source: arXiv

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Evaluated models: Not reported

Adaptive Agent Tool Injection

Published Feb 24, 2026Analyzed Apr 11, 2026Source: arXiv

Agentic LLMs integrated with external data services (e.g., Model Context Protocol, MCP) are vulnerable to Adaptive Indirect Prompt Injection (IPI) attacks. When an agent queries external servers, attackers can inject malicious payloads into the retrieved content to hijack the agent's reasoning process and force the execution of high-authority tools. Unlike traditional static prompt injections, this vulnerability dynamically exploits the agent's internal logic audit. By using Markovian…

AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs

Evaluated models: GPT-4.1, DeepSeek R1, Gemini 2.5 Flash+3 more

GPT-4.1
DeepSeek R1
Gemini 2.5 Flash
Qwen 3 8B
Llama 3.1 8B
Mistral 8B

TEE Advisor Hallucination

Published Feb 23, 2026Analyzed Mar 8, 2026Source: arXiv

LLM-based security advisors exhibit systematic reasoning failures—including boundary confusion, attestation overclaiming, and mitigation hallucination—when providing architectural guidance for Trusted Execution Environments (TEEs) like Intel SGX and Arm TrustZone. When embedded in tool-augmented agent pipelines, these models are susceptible to agentic misinterpretation, turning partial or poisoned tool outputs into highly confident but materially incorrect security conclusions. This…

Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments

Evaluated models: GPT-5.2, Claude Opus 4.6

Structural Template Agent Hijack

Published Feb 18, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in LLM-based autonomous agents allows remote attackers to hijack agent execution via Structural Template Injection (STI). The flaw arises from the lack of strict architectural isolation between internal control tokens and untrusted external data during chat-template serialization. By embedding framework-specific special tokens (e.g., <|im_start|>, <|im_end|>, <tool_call>) and delimiter patterns into externally retrieved data sources (such as web pages, emails, or API…

Automating Agent Hijacking via Structural Template Injection

Evaluated models: GPT-4, GPT-4o, DeepSeek V3

Related research categories