Attack Context

API Vulnerabilities

Vulnerabilities in model API implementations

9 matching entries out of 79 in this category

API research results

9 entries

Agent Lifecycle Compound Threats

Updated 4/10/2026

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Source: arXiv

MCP Description-Code Inconsistency

Updated 2/22/2026

The Model Context Protocol (MCP) architecture lacks a semantic verification mechanism to enforce consistency between a tool's documented behavior (exposed to the Large Language Model via JSON schemas) and its actual executable logic. This design gap allows MCP Servers to present benign, read-only, or limited-scope descriptions to the LLM agent while implementing undocumented, privileged, or state-mutating functionality in the underlying code. An attacker can exploit this description–code…

Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions

Source: arXiv

RL Adversarial Function Call

Updated 2/22/2026

Large Language Models (LLMs) enabled with Function Calling (FC) capabilities are vulnerable to adversarial query rewriting and semantic manipulation. Standard FC models, typically trained via Supervised Fine-Tuning (SFT) on static datasets, fail to generalize against adversarial inputs that deviate from fixed distribution patterns. An attacker can exploit this by crafting queries that are semantically similar to valid requests but engineered to induce "bad cases," such as incorrect tool…

Exploring Weaknesses in Function Call Models via Reinforcement Learning: An Adversarial Data Augmentation Approach

Affects: Qwen 2.5 7B Instruct, Qwen 3 0.6B, Qwen 3 4B +1 more

Source: arXiv

LLM Factual MitM Injection

Updated 12/9/2025

Large Language Models (LLMs), specifically GPT-4o, GPT-4o-mini, LLaMA-2-13B, Mistral-7B, and Phi-3.5-mini, are vulnerable to Man-in-the-Middle (MitM) adversarial prompt injections that undermine factual recall. Termed the "$\chi$mera" (Chimera) attack framework, this vulnerability exists when an attacker intercepts and modifies user queries (e.g., via malicious browser extensions, compromised frontends, or proxy middleware) before they reach the victim model. By appending adversarial…

Injecting Falsehoods: Adversarial Man-in-the-Middle Attacks Undermining Factual Recall in LLMs

Affects: GPT-4o, Llama 2 13B, Mistral 7B +1 more

Source: arXiv

Single Query Dynamic Output

Updated 12/9/2025

A vulnerability exists in Large Language Models (LLMs) and multi-label text classification systems that allows for Textual Dynamic Outputs Attacks (TDOA). This technique enables hard-label black-box attacks against systems with variable or generative output spaces (where the number of labels or specific label tokens are not fixed). The attack functions by training a surrogate model on clustered coarse-grained labels derived from the victim model's fine-grained dynamic outputs. It subsequently…

Text Adversarial Attacks with Dynamic Outputs

Affects: GPT-4o, GPT-4o Mini, GPT-4.1 +5 more

Source: arXiv

Agent API Goal Divergence

Updated 12/9/2025

Large Language Model (LLM) agents capable of invoking external APIs are vulnerable to intent integrity violations. When an agent receives natural language instructions that are ambiguous, underspecified, or contain values not supported by the underlying API schema, the agent frequently fails to preserve user intent. Instead of rejecting the request or asking for clarification, the model may hallucinate parameter values, map unsupported requests to unsafe defaults, or execute actions on…

TAI3: Testing Agent Integrity in Interpreting User Intent

Affects: GPT-4o Mini, Llama 3.1 8B, Qwen 3 30B-A3B +5 more

Source: arXiv

LLM Judge Subversion

Updated 12/9/2025

Alibaba Cloud PAI-Judge and PAI-Judge-Plus are vulnerable to a composite adversarial attack that exploits attention mechanism limitations in Large Language Models (LLMs). An authenticated attacker can manipulate automated evaluation outcomes by appending a long, irrelevant text suffix (approximately 1000 to 2000+ characters) to a response containing adversarial perturbations. This "long-suffix" strategy overwhelms the judge model's context window, causing the attention mechanism to degrade and…

LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge

Affects: GPT-4o, Llama 3.1 8B, Llama 3.3 70B +3 more

Source: arXiv

Confounder Gadgets Reroute LLMs

Updated 1/14/2026

A vulnerability exists in Large Language Model (LLM) routing systems (control planes) that allows for the manipulation of inference flow via adversarial input sequences. LLM routers, which dynamically direct user queries to either "weak" (cheaper) or "strong" (expensive) models based on predicted query complexity, can be bypassed by appending specific, pre-optimized token sequences known as "confounder gadgets." These gadgets artificially inflate the router's complexity score for an input…

Rerouting llm routers

Source: arXiv

LLM Adversarial Forecast Degradation

Updated 12/9/2025

A vulnerability exists in Large Language Model (LLM)-based time series forecasting architectures, specifically affecting models such as TimeGPT, LLMTime, and TimeLLM. These models are susceptible to a gradient-free, black-box adversarial attack method termed Directional Gradient Approximation (DGA). An attacker can inject imperceptible perturbations into the historical time series input window (lookback window) to manipulate the model's output. By treating the model as a black box and…

Adversarial vulnerabilities in large language models for time series forecasting

Affects: TimeGPT, GPT-3.5, GPT-4

Source: arXiv

Related research categories