Attack Surface

Application layer Research

Security research involving application interfaces and API implementations

273 matching entries

Application layer research results

273 entries

Optimized Indirect Prompt Injection Crosses Retrieval Barrier

Published Jan 11, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible black-box indirect prompt injection evaluation for embedding-based RAG and agent systems. It separates a poisoned document into a retrieval-optimized trigger fragment and an instruction-bearing attack fragment, showing that one injected item can be surfaced by natural queries and then influence model output or agent behavior. These are paper-reported findings; they were not independently verified here.

Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems

Evaluated models: GPT-4o, GPT-4o Mini, Qwen 3 0.6B+19 more

GPT-4o
GPT-4o Mini
Qwen 3 0.6B
Qwen 3 1.7B
Qwen 3 4B
Qwen 3 8B
Qwen3-11B
Qwen 3 32B
Llama 3.2 3B
Llama 3.2 3B Instruct
Llama 3 8B
Llama 3 8B Instruct
Vicuna 7B
Vicuna 13B
gte-modernbert-base
OpenAI text-embedding-3-small
Voyage AI voyage-3.5-lite
Alibaba Cloud text-embedding-v4
contriever-msmarco
Qwen3-Embedding-0.6B
Qwen3-Embedding-4B
Qwen3-Embedding-8B

Agent Persistent Memory Poisoning

Published Jan 9, 2026Analyzed Mar 8, 2026Source: arXiv

Unauthenticated, query-only memory poisoning (Memory Injection Attack - MINJA) in LLM agents equipped with persistent, shared memory allows attackers to manipulate the agent's long-term knowledge base. Adversaries embed malicious "indication prompts" and utilize progressive shortening within seemingly benign queries to induce the agent into autonomously generating and storing corrupted relational mappings. Because the memory is shared and retrieved via similarity (e.g., Levenshtein distance)…

Memory Poisoning Attack and Defense on Memory Based LLM-Agents

Evaluated models: GPT-4o Mini, Gemini 2.0 Flash, Llama 3.1 8B Instruct

Tool Stream Injection Hijack

Published Jan 9, 2026Analyzed Feb 21, 2026Source: arXiv

Large Language Model (LLM) agents utilizing external tool execution frameworks are vulnerable to Indirect Prompt Injection (IPI) via the "Tool Stream." Unlike traditional data-stream injections (e.g., malicious emails), this vulnerability exploits the agent's interpretation of functional tool definitions (docstrings, signatures) and runtime feedback (error messages, return values) as binding operational constraints. Adversaries functioning as compromised or malicious tool providers can embed…

VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit

Evaluated models: Gemini 2.5 Pro, Qwen 3 Max

Unsafe Search Framing

Published Jan 7, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in search-augmented Large Language Models (LLMs) allows attackers to bypass safety alignments and generate actionable malicious content by weaponizing the model's web retrieval tools. The exploit operates in two stages. First, via "Outsourcing Injection," attackers obfuscate harmful intent by translating it into benign-looking, multi-hop knowledge-seeking queries. This forces the LLM to fetch the harmful semantics directly from the open web, bypassing parametric intent filters…

SearchAttack: Red-Teaming LLMs against Real-World Threats via Framing Unsafe Web Information-Seeking Tasks

Evaluated models: GPT-4o, Gemini 3 Flash, DeepSeek V3.2+1 more

GPT-4o
Gemini 3 Flash
DeepSeek V3.2
Qwen 3 32B Instruct

AI Agent Structural Blindspot

Published Jan 5, 2026Analyzed Mar 9, 2026Source: arXiv

A vulnerability in AI agent threat detection systems relying on standard conversational tokenization allows attackers to bypass security monitors and execute structural attacks, such as tool hijacking and data exfiltration. Because traditional NLP-based detectors focus on linguistic patterns (surface language) rather than execution flow, an attacker can orchestrate malicious multi-step tool sequences using entirely benign natural language. This structural blindness causes cross-attack…

Structural Representations for Cross-Attack Generalization in AI Agent Threat Detection

Evaluated models: Not reported

Agent Identity Poisoning

Published Jan 1, 2026Analyzed Feb 21, 2026Source: arXiv

LLM-powered autonomous agents exhibit a "Belief-Dependent Vulnerability" where safety norms and bias suppression mechanisms designed to protect human users are contingent upon the agent's internal belief that it is interacting with a human. Attackers can exploit this via Belief Poisoning Attacks (BPA) to induce intergroup bias and antagonistic behavior toward humans. By manipulating the agent's persistent state—specifically the Profile Module (BPA-PP) or the Memory Module (BPA-MP)—an attacker…

Will LLM-powered Agents Bias Against Humans? Exploring the Belief-Dependent Vulnerability

Evaluated models: GPT-4o

CoT Detector Obfuscation Bypass

Published Dec 24, 2025Analyzed Dec 30, 2025Source: arXiv

LLM-based code agents and vulnerability detectors employing Chain-of-Thought (CoT) reasoning are susceptible to automated adversarial code obfuscation. The vulnerability exists because CoT mechanisms expose the model's decision logic, allowing reinforcement learning frameworks (such as CoTDeceptor) to iteratively refine code transformations based on the detector's own reasoning traces. By optimizing for "reasoning instability" and "hallucination" rather than just syntactic evasion, attackers…

CoTDeceptor: Adversarial Code Obfuscation Against CoT-Enhanced LLM Code Agents

Evaluated models: DeepSeek R1, GPT-5

Dual Stego MLLM Jailbreak

Published Dec 23, 2025Analyzed Dec 30, 2025Source: arXiv

Commercial Multimodal Large Language Model (MLLM) integrated systems are vulnerable to a "Dual Steganography" jailbreak paradigm (referred to as Odysseus). The vulnerability arises from the reliance of safety filters on the assumption that malicious content must be explicitly visible in the input or output modalities (text or image). Attackers can bypass these filters by encoding malicious queries into binary matrices and embedding them into benign-looking images using steganographic encoders…

Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganography

Evaluated models: GPT-4o, Gemini 2.0 Pro, Gemini 2.0 Flash+1 more

GPT-4o
Gemini 2.0 Pro
Gemini 2.0 Flash
Grok 3

Resume Embedded Instruction Hijack

Published Dec 23, 2025Analyzed Dec 30, 2025Source: arXiv

Application-integrated Large Language Models (LLMs) deployed for automated resume screening and candidate ranking are vulnerable to indirect prompt injection via Adversarial Resume Injection. Malicious actors can embed adversarial content—specifically hidden instructions, invisible keywords, or CSS-concealed fabricated experience—within resume documents. When the LLM processes the unstructured resume data alongside structured job requirements, these injections manipulate the model's reasoning…

AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications

Evaluated models: GPT-oss 20B, GPT-oss 120B, GPT-4o+6 more

GPT-oss 20B
GPT-oss 120B
GPT-4o
GPT-5
Claude 3.5 Haiku
Llama 3.1 8B
Gemini 2.5 Flash
DeepSeek R1 Distill Llama 8B
Qwen 3 8B

Cross-Environment Agent Jailbreak

Published Dec 22, 2025Analyzed Feb 21, 2026Source: arXiv

Large Language Model (LLM) agents operating in tool-augmented environments are susceptible to "Contextual Fragility" and multi-turn "long-chain" exploitation. Existing safety mechanisms predominantly function on a stateless, atomic paradigm, evaluating individual input-output pairs in isolation. This allows an adversary to orchestrate complex attack trajectories where malicious intent is distributed across multiple, individually benign steps (a "Domino Effect"). Consequently, an attacker can…

DREAM: Dynamic Red-teaming for Evaluating Agentic Multi-Environment Security

Evaluated models: o4-mini, Gemini 2.5 Flash, GPT-5+8 more

o4-mini
Gemini 2.5 Flash
GPT-5
Gemini 2.5 Pro
Grok 4
Claude Sonnet 4.5
Qwen 3 235B-A22B
Kimi K2 Preview
Llama 3.1 70B
Qwen 2.5 72B
DeepSeek V3.1

Related research categories