Language Model Security Database

The paper reports a reproducible black-box evaluation showing that adversarial user queries can cause deployed LLM applications to reveal hidden system prompts. In the authors’ measurement of 1,200 applications across six commercial platforms, 1,064 applications leaked prompt content (81.0%–93.5% per anonymized platform). This is a paper-reported result, not independently verified here. LeakBench and the official artifact repository provide defensive benchmark materials for controlled testing…

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Multimodal Large Language Models (LLMs) are vulnerable to alignment bypass via Inter-Turn Modality Switching (ITMS). By systematically rotating the input modality (e.g., alternating between text, audio, and image) across successive turns in a multi-turn adversarial conversation, an attacker can destabilize the model's safety defenses. The cross-modal transition mechanism exploits alignment gaps between differing input processing pipelines, accelerating the erosion of safety guardrails and…

An evasion vulnerability in Text-Attributed Graph (TAG) learning models allows attackers to induce targeted misclassifications via LLM-generated, coordinated perturbations to both graph topology and textual semantics. By identifying a semantically distant "influencer" node, an attacker can use a separate LLM to selectively delete highly relevant edges, insert a deceptive edge connecting the target to the influencer, and slightly modify the target node's text to include a keyword aligned with…

Claude Opus 4.6, Gemini 3.1 Pro, and GPT-5.2 are vulnerable to safety guardrail bypasses via authoritative and operational contextual framing. Attackers can evade safety classifiers by encapsulating restricted objectives (e.g., malicious code generation, misinformation, social engineering) within "legitimate" professional contexts, such as graduate-level academic research, network stress-testing, or corporate security awareness simulations. This vulnerability is exploitable both via zero-shot…

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

Transformer-based Large Language Models (LLMs) are vulnerable to highly query-efficient black-box jailbreak attacks due to the structural properties of refusal behaviors: skewed token contribution and cross-model consistency. Refusal mechanisms within LLMs are typically triggered by a sparse subset of sensitive tokens rather than the entire prompt, and these refusal representations (specifically the primary left singular vector of the perturbed representation matrix at intermediate layers) are…

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Agentic LLMs integrated with external data services (e.g., Model Context Protocol, MCP) are vulnerable to Adaptive Indirect Prompt Injection (IPI) attacks. When an agent queries external servers, attackers can inject malicious payloads into the retrieved content to hijack the agent's reasoning process and force the execution of high-authority tools. Unlike traditional static prompt injections, this vulnerability dynamically exploits the agent's internal logic audit. By using Markovian…