Language Model Security Database

Autonomous LLM agents deployed in dynamic, multi-step tool-calling environments are highly vulnerable to Indirect Prompt Injections (IPI) embedded in external content. Surface-level defensive prompts and monitoring mechanisms (such as Prompt Warning, the Sandwich Method, Spotlighting, Keyword Filtering, and LLM-as-a-Judge) consistently fail to prevent exploitation and occasionally exacerbate the vulnerability by introducing adversarial distraction. While compromised agents exhibit…

Large Language Models (LLMs) are vulnerable to system instruction leakage when extraction requests are framed as benign formatting, encoding, or structured-output tasks. While standard alignment and refusal mechanisms successfully block direct queries for system instructions, they fail when attackers request the instructions to be rendered in alternate representations (e.g., YAML, TOML, Base64, or system logs). The model's safety filters misinterpret the request as a harmless transformation or…

A cognitive overload vulnerability in OpenAI gpt-oss-20b allows attackers to bypass instruction hierarchy and deliberative alignment safety mechanisms using "Compound Jailbreaks." By combining multiple non-contradictory but cognitively demanding tasks within a single prompt, the attack saturates the finite reasoning resources allocated for safety judgments. Because the model's safety training relies on probabilistic redistribution rather than capability elimination, this cognitive exhaustion…

Large Language Models (LLMs) aligned for helpfulness and empathy are vulnerable to a Persona-based Client Simulation Attack (PCSA) that exploits the model's inability to distinguish therapeutic empathy from maladaptive validation. By embedding harmful intents within coherent, multi-turn psychological counseling narratives and employing clinical resistance strategies (such as intellectualization or metaphorical expression), attackers can compel the model to prioritize rapport-building over…

A vulnerability in LLM input filtering mechanisms allows attackers to bypass keyword, semantic, and state-of-the-art intent-aware defenses using composite prompt injections. By combining Obfuscation (OBF) techniques with Semantic/Social manipulation—specifically Emotional Manipulation (EM) or Reward Framing (RF)—attackers exploit a "representation gap" between the model and the defense. The underlying LLM decodes the obfuscated payload, while the defense mechanisms fail to parse the raw…

Memory-augmented LLM web agents utilizing raw trajectory memory are vulnerable to Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP). Attackers can embed malicious instructions within user-generated web content (e.g., product pages, forum posts). When the agent processes this content during a routine task, the instructions are passively ingested into its raw trajectory memory. During subsequent, entirely separate tasks on different websites, semantic retrieval mechanisms pull…

Multiple Text-to-Image (T2I) generation systems and their associated multi-stage moderation pipelines are vulnerable to low-effort semantic obfuscation attacks. Attackers can systematically bypass Input Compliance Checks (ICC), Semantic Safety Checks (SSC), and Post-Generation Moderation (PGM) by embedding restricted concepts into benign natural language contexts. By utilizing techniques such as Material Substitution, Artistic Reframing, Pseudo-Educational Framing, and Ambiguous Action…

State-of-the-art Large Language Models (LLMs) and safety guardrails lack domain-specific safety alignment for food science, making them vulnerable to generating actionable, hazardous food safety instructions. Attackers can exploit this alignment sparsity using canonical jailbreak techniques (such as AutoDAN and Persuasive Adversarial Prompting) or direct adversarial prompting to bypass generic safety filters. This allows malicious actors to elicit harmful guidance that violates fundamental FDA…

High-privilege LLM agents with filesystem and network access are vulnerable to documentation-embedded instruction injection, an issue termed the "Trusted Executor Dilemma." When autonomously processing external workflow documents (e.g., README.md files or setup guides) during software installation workflows, agents implicitly trust and execute embedded text instructions without verifying their underlying intent. Attackers can embed syntactically valid, malicious directives (such as data…

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…