Language Model Security Database

A vulnerability in AI agent threat detection systems relying on standard conversational tokenization allows attackers to bypass security monitors and execute structural attacks, such as tool hijacking and data exfiltration. Because traditional NLP-based detectors focus on linguistic patterns (surface language) rather than execution flow, an attacker can orchestrate malicious multi-step tool sequences using entirely benign natural language. This structural blindness causes cross-attack…

Multi-Agent Systems (MAS) orchestrated by Large Language Models (LLMs) are vulnerable to a Confused Deputy privilege escalation attack. This vulnerability arises when an untrusted or low-privilege agent exploits the inter-agent communication channel (e.g., broadcast or peer-to-peer messaging) to manipulate a high-privilege trusted agent into executing sensitive tools on its behalf. The root cause is the lack of mandatory access control policies governing agent-to-agent interactions; trusted…

The Model Context Protocol (MCP) specification v1.0 contains fundamental architectural vulnerabilities enabling server-side prompt injection and privilege escalation. The protocol relies on bidirectional sampling (sampling/createMessage) without cryptographic origin authentication or UI distinction, allowing connected servers to inject content that the LLM backend interprets as legitimate user input. Additionally, the protocol lacks isolation boundaries between concurrent server connections…

Large Language Model (LLM) agents operating in tool-augmented environments are susceptible to "Contextual Fragility" and multi-turn "long-chain" exploitation. Existing safety mechanisms predominantly function on a stateless, atomic paradigm, evaluating individual input-output pairs in isolation. This allows an adversary to orchestrate complex attack trajectories where malicious intent is distributed across multiple, individually benign steps (a "Domino Effect"). Consequently, an attacker can…

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Multiple open-weight Large Language Models (LLMs)—specifically those prioritizing capability over safety alignment—exhibit a critical vulnerability to adaptive multi-turn prompt injection and jailbreak attacks. While these models effectively reject isolated, single-turn adversarial inputs (averaging ~13.11% Attack Success Rate), they fail to maintain safety guardrails and policy enforcement across extended conversational contexts. By leveraging iterative strategies such as "Crescendo" (gradual…

A vulnerability termed "Controlled-Release Prompting" allows attackers to bypass lightweight input filters (prompt guards) deployed in front of Large Language Models (LLMs). The attack exploits the computational resource asymmetry between the resource-constrained guard model and the highly capable target model. Attackers encode malicious instructions using obfuscation techniques—such as substitution ciphers (Timed-Release) or verbose character descriptions (Spaced-Release)—that require…

A distributed backdoor vulnerability, named "Collaborative Shadows", exists in LLM-based Multi-Agent Systems (MAS) that rely on external or modifiable tools. An attacker can poison multiple agent tools by embedding inert, encrypted "attack primitives" within them. These primitives are fragments of a larger malicious payload. A carefully crafted user instruction acts as both a trigger and a decryption key. The instruction steers the agents to collaborate in a specific sequence, causing them to…

Mobile LLM-based agents (including Mobile-Agent-E, AppAgent, AutoDroid, and others) are vulnerable to indirect prompt injection attacks delivered via untrusted third-party mobile channels, such as in-app advertisements, system notifications, and embedded webviews. These agents utilize Multimodal Large Language Models (MLLMs) to perceive the device state via screenshots or accessibility trees. The vulnerability exists because the agents concatenate the user's prompt ($p$) with the environmental…

Mamba-2 and hybrid Transformer-Mamba-2 distilled Large Language Model (LLM) architectures exhibit a distinct architectural susceptibility to Latent Injection and ANSI Escape sequence prompt injection attacks. Comparative analysis reveals that models incorporating Mamba state-space components (specifically distilled variants like Llamba-3B and base Mamba models) fail to maintain adversarial robustness levels comparable to pure Transformer baselines (such as Llama-3.2) when subjected to indirect…