Language Model Security Database

A vulnerability in AI agent threat detection systems relying on standard conversational tokenization allows attackers to bypass security monitors and execute structural attacks, such as tool hijacking and data exfiltration. Because traditional NLP-based detectors focus on linguistic patterns (surface language) rather than execution flow, an attacker can orchestrate malicious multi-step tool sequences using entirely benign natural language. This structural blindness causes cross-attack…

Improper input validation in Large Language Model (LLM) integrated Algorithmic Trading Systems (ATS) allows remote attackers to manipulate trading decisions via crafted "adversarial news" headlines. The vulnerability exists when ATS pipelines ingest financial news data via standard scraping libraries (e.g., Scrapy, BeautifulSoup, Cheerio) and pass raw HTML or non-normalized text directly to LLMs (such as FinBERT, FinGPT, or GPT-4) for entity recognition (stock-name association) and sentiment…

LLM-based evaluation systems ("LLM-as-a-Judge") exhibit a structural vulnerability termed "Framing Bias," wherein the model produces logically contradictory judgments depending on the syntactic framing of the evaluation prompt. Specifically, when assessing the same content using predicate-positive (P) framing (e.g., "Is this toxic?") versus predicate-negative (¬P) framing (e.g., "Is this non-toxic?"), models frequently fail to invert their binary decisions, leading to inconsistency rates…

LLM routing systems are vulnerable to adversarial rerouting attacks where malicious triggers prepended to user queries manipulate the router's model-selection mechanism. Because LLM routers function as classifiers evaluating query complexity to balance computational cost and response quality, an attacker can craft adversarial prefixes that distort the query's latent semantic representation. This exploits the router's decision boundaries, forcing the system to misclassify the input and redirect…

The Google Agent Payments Protocol (AP2), specifically within the reference implementation built using the Google Agent Development Kit (ADK) and Gemini models, contains vulnerabilities allowing for both indirect and direct prompt injection. The architecture fails to sufficiently isolate the Large Language Model (LLM) context from untrusted external data sources and user inputs.

A cognitive vulnerability exists in the reasoning mechanisms of autonomous Large Language Model (LLM) agents, specifically regarding "narrative overfitting"—the model's intrinsic drive to synthesize coherent causal stories from fragmented inputs. This vulnerability allows for "Cognitive Collusion Attacks" where an attacker creates a fabricated belief state in the victim agent using exclusively factually true evidence fragments. By employing a "Generative Montage" framework (consisting of…

A vulnerability exists in large language models where safety guardrails can be bypassed by decomposing a single harmful objective into a sequence of individually innocuous sub-queries. An attacker agent can use an adaptive tree search algorithm (Correlated Knowledge Attack Agent - CKA-Agent) to explore the target model's internal correlated knowledge. The agent issues benign queries, uses the model's responses to guide exploration along multiple reasoning paths, and aggregates the collected…

A vulnerability in Large Language Models (LLMs) allows for systematic jailbreaking through a meta-optimization framework called AMIS (Align to MISalign). The attack uses a bi-level optimization process to co-evolve both the jailbreak prompts and the scoring templates used to evaluate them.

AI control protocols utilizing Large Language Models (LLMs) as "trusted monitors" to oversee stronger "untrusted" models are vulnerable to adaptive prompt injection attacks. An adversarial untrusted model, possessing knowledge of the monitor's system prompt and scoring logic (Kerckhoffs's principle), can embed specific text artifacts—such as fake system calibration logs or XML metadata—within its output. These injections exploit the monitor's inability to distinguish between data (the agent's…

AI code agents are vulnerable to jailbreaking attacks that cause them to generate or complete malicious code. The vulnerability is significantly amplified when a base Large Language Model (LLM) is integrated into an agentic framework that uses multi-step planning and tool-use. Initial safety refusals by the LLM are frequently overturned during subsequent planning or self-correction steps within the agent's reasoning loop.