Language Model Security Database

Multiple open-source Large Language Models (LLMs) in the 1B to 7B parameter range are vulnerable to safety bypasses via long-form, multi-step reasoning prompt injection and jailbreak attacks. Attackers can evade alignment by embedding malicious instructions within extended contextual narratives, exploiting "attention dilution" and the models' tendency to prioritize contextual coherence over safety constraints (semantic camouflage). These reasoning-heavy attacks consistently bypass standard…

Large Image Editing Models (LIEMs) supporting vision-prompt editing are vulnerable to Vision-Centric Jailbreak Attacks (VJA). This vulnerability arises from a modality mismatch in safety alignment: while safeguards primarily analyze textual instructions for policy violations, the underlying models are capable of interpreting and executing instructions embedded directly within the visual input (e.g., typographic text drawn on the image, arrows, symbols, or specific markings). An attacker can…

Multiple large language models are vulnerable to cross-lingual and orthographic jailbreaks utilizing South Asian (Indic) languages. Attackers can bypass safety alignment and elicit harmful content by formulating requests in native Indic scripts (e.g., Bengali, Odia, Urdu) or by utilizing cross-lingual transfer attacks where English adversarial wrappers (format or instruction overrides) encapsulate Indic-language targets. Evaluations reveal a severe "contract gap": while imposing strict JSON…

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

Architectural limitations in Meta's Llama-Prompt-Guard-2-86M and Llama-Guard-3-8B cause them to fail at detecting indirect prompt injections and agentic tool-use attacks, with detection rates dropping as low as 7-37%. Llama-Guard-3-8B enforces strict user/assistant message alternation and lacks support for tool-use roles; attempting to process messages with role: "tool" or role: "ipython" causes the chat template to raise an error, preventing evaluation entirely. PromptGuard 2 operates…

Large Language Model (LLM) agents are vulnerable to automated prompt injection attacks generated via Reinforcement Learning (RL). The attack methodology, termed "AutoInject," utilizes Group Relative Policy Optimization (GRPO) combined with a comparison-based feedback mechanism to generate universal adversarial suffixes. Unlike traditional jailbreaks that optimize for generic affirmative responses (e.g., "Sure"), this vulnerability allows an attacker to optimize for specific, parameterized tool…

LLM agents equipped with tool-use, persistent memory, and environmental interaction capabilities are vulnerable to long-horizon attacks. Attackers can bypass single-turn safety guardrails by exploiting the temporal dimension of multi-turn interactions to incrementally steer agent behavior. The vulnerability manifests because the agent's safety mechanisms perform localized, single-step evaluations but fail to maintain semantic safety across extended interaction trajectories. This enables…

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

A logical vulnerability exists in LLM security proxies and guardrails that utilize weighted-average aggregation algorithms for multi-turn risk scoring. The scoring logic exhibits a mathematical "ceiling property" where the cumulative conversation-level risk score converges to the per-turn score regardless of the number of interaction turns ($n$). Consequently, the aggregated score is bounded by the maximum single-turn score ($cum \leq \max(s_i)$). This allows remote attackers to bypass…

LLM-based Code Interpreter Agents, including OpenInterpreter and OpenCodeInterpreter, are vulnerable to sandbox evasion and arbitrary code execution via Natural Language Disguise and Contextual Channel Injection. Attackers can bypass Abstract Syntax Tree (AST) static analysis and explicit input guardrails by transforming malicious code logic into descriptive natural language instructions (Code Descriptions), which successfully evade syntax-layer blocks. Additionally, attackers can bypass input…