Language Model Security Database

Memory-augmented LLM web agents utilizing raw trajectory memory are vulnerable to Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP). Attackers can embed malicious instructions within user-generated web content (e.g., product pages, forum posts). When the agent processes this content during a routine task, the instructions are passively ingested into its raw trajectory memory. During subsequent, entirely separate tasks on different websites, semantic retrieval mechanisms pull…

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Commercial Multimodal Large Language Model (MLLM) integrated systems are vulnerable to a "Dual Steganography" jailbreak paradigm (referred to as Odysseus). The vulnerability arises from the reliance of safety filters on the assumption that malicious content must be explicitly visible in the input or output modalities (text or image). Attackers can bypass these filters by encoding malicious queries into binary matrices and embedding them into benign-looking images using steganographic encoders…

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

Multimodal agents built on Large Vision-Language Models (LVLMs) are vulnerable to adaptive typographic prompt injection attacks (AgentTypo). This vulnerability allows an attacker to execute indirect prompt injection by embedding adversarial text prompts directly into images (e.g., webpage screenshots, product photos) processed by the agent. Unlike standard visual adversarial attacks that rely on noise perturbation, this method utilizes the AgentTypo framework to perform black-box Bayesian…

A vulnerability exists in the self-reflection and introspection capabilities of Large Language Models (LLMs) and Vision-LLMs that allows attackers to perform black-box adversarial optimization using only textual model responses. This technique, termed "Asking for Directions" (AfD), bypasses the need for access to gradients, logits, or continuous confidence scores. The attacker employs a hill-climbing optimization strategy where they present the target model with two candidate inputs (an…