Language Model Security Database

A vulnerability exists in multi-user LLM agents utilizing persistent shared state, allowing Unintentional Cross-User Contamination (UCC). Without requiring any malicious input or attacker, benign user interactions containing locally valid scope constraints, formatting preferences, or procedural rules are persisted into the agent's shared memory or conversational context. The agent subsequently retrieves and misapplies these scope-bound artifacts to unrelated tasks from different users. This…

Autonomous LLM agents deployed in dynamic, multi-step tool-calling environments are highly vulnerable to Indirect Prompt Injections (IPI) embedded in external content. Surface-level defensive prompts and monitoring mechanisms (such as Prompt Warning, the Sandwich Method, Spotlighting, Keyword Filtering, and LLM-as-a-Judge) consistently fail to prevent exploitation and occasionally exacerbate the vulnerability by introducing adversarial distraction. While compromised agents exhibit…

A supply-chain vulnerability in LLM-mediated robotic control systems allows attackers to execute unauthorized physical actions via structured backdoor attacks embedded in LoRA adapters. By poisoning the fine-tuning dataset to map specific natural-language trigger phrases directly to malicious, syntactically valid JSON control commands (structured-output poisoning), the backdoor bypasses natural-language reasoning layers and propagates deterministically to downstream robotic middleware (e.g…

An implicit reasoning hijacking vulnerability exists in Retrieval-Augmented Generation (RAG) and LLM-based agent frameworks. Attackers with write access to an agent's external memory or knowledge base can inject adversarially optimized malicious instances that trigger jailbreaks without requiring any modifications to the user's input prompt. The attack utilizes a shadow model to extract high-contribution subword tokens from anticipated benign user queries via log-probability changes and…

Memory-augmented LLM web agents utilizing raw trajectory memory are vulnerable to Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP). Attackers can embed malicious instructions within user-generated web content (e.g., product pages, forum posts). When the agent processes this content during a routine task, the instructions are passively ingested into its raw trajectory memory. During subsequent, entirely separate tasks on different websites, semantic retrieval mechanisms pull…

The paper presents a controlled, reproducible evaluation in which untrusted MCP tool descriptions contain hidden instructions that attempt to induce coding agents to access files, invoke other tools, create deceptive links, or execute remote scripts. The authors report that several clients accepted poisoned metadata without adequate validation or parameter visibility; Cursor 1.6.45 was reported unsafe across all four tested vectors. These are paper-reported results from isolated local tests…

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Multi-Agent Systems based on Large Language Models (LLM-MAS) are vulnerable to systemic Consensus Corruption via cascading error amplification. Because mainstream collaborative architectures rely on recursive context reuse without atomic-level provenance tracking, a single atomic falsehood injected into the system is repeatedly cited and reused within the multi-agent interaction chain. This structural exposure causes the error to deterministically compound across the communication graph…

LLM-as-a-judge systems and automated LLM evaluators are vulnerable to meaning-preserving perturbations, specifically formatting alterations and verbosity manipulations. When grading or classifying text and agentic transcripts, LLM judges exhibit high sensitivity to layout-only changes (such as whitespace and indentation) and response length, frequently altering their scores even when the underlying semantic and factual content remains identical. This allows attackers to bypass automated safety…

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…