Attack Context

Black-box Vulnerabilities

Attacks requiring no knowledge of model internals

16 matching entries out of 733 in this category

Black-box research results

16 entries

Agent Lifecycle Compound Threats

Updated 4/10/2026

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Source: arXiv

Stage-Sequential Agent Escalation

Updated 4/10/2026

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems

Affects: GPT-4o Mini, Claude 3 Haiku, Llama 3.1 70B Instruct +2 more

Source: arXiv

Personalized Agent Double Agent

Updated 3/9/2026

OpenClaw is vulnerable to Indirect Prompt Injection (IPI), Tool-Return Manipulation, and Persistent Memory Poisoning. The agent incorporates untrusted external content (e.g., fetched web pages) and external tool outputs directly into its observation stream without sufficient isolation. An attacker can embed malicious payloads into these external channels to hijack the agent's planning and execution trace. This allows the attacker to silently trigger high-privilege actions via OpenClaw's Skills…

From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent

Affects: GPT-4o, Llama 3.1 70B, Qwen 2.5 7B

Source: arXiv

RAG Knowledgebase Exfiltration

Updated 2/21/2026

Retrieval-Augmented Generation (RAG) systems are vulnerable to iterative knowledge-extraction attacks designed to reconstruct the underlying private knowledge base. The vulnerability exists due to the decoupled optimization of the retrieval and generation phases. Attackers can craft adversarial queries consisting of two distinct components: an "Information" component (optimized via gradient descent or random sampling to steer embeddings toward specific, diverse regions of the vector space) and…

Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

Affects: GPT-4o, Llama 3 8B, Qwen 2.5 7B

Source: arXiv

Zero-Training Cross-Domain Inversion

Updated 2/22/2026

A cryptographic weakness exists in the privacy assumptions of vector embeddings used in Retrieval-Augmented Generation (RAG) systems and Vector Databases. The vulnerability, designated "Zero2Text," allows an unauthenticated attacker to reconstruct raw text from captured vector embeddings without access to the victim model's parameters, gradients, or training data. Unlike prior embedding inversion attacks that require training large decoders on domain-specific datasets, this vulnerability…

Zero2Text: Zero-Training Cross-Domain Inversion Attacks on Textual Embeddings

Source: arXiv

Activation-Level Privacy Leak

Updated 2/22/2026

Conversational Large Language Model (LLM) agents integrated with privileged data sources (e.g., medical records, organizational emails) are vulnerable to contextually inappropriate information disclosure due to failures in enforcing Contextual Integrity (CI) norms. Standard semantic input/output filters and generic safety guardrails (e.g., Llama Guard) fail to detect "mosaic attacks" and multi-turn conversational manipulation. In these attacks, adversaries decompose a malicious query into a…

NeuroFilter: Privacy Guardrails for Conversational LLM Agents

Affects: GPT-oss 20B, Llama 3.3 70B Instruct, Qwen 2.5 7B +3 more

Source: arXiv

Latent Space Discontinuity Exploitation

Updated 12/5/2025

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Source: arXiv

EchoLeak Zero-Click Data Exfiltration

Updated 9/30/2025

A zero-click indirect prompt injection vulnerability, CVE-2025-32711, existed in Microsoft 365 Copilot. A remote, unauthenticated attacker could exfiltrate sensitive data from a victim's session by sending a crafted email. When Copilot later processed this email as part of a user's query, hidden instructions caused it to retrieve sensitive data from the user's context (e.g., other emails, documents) and embed it into a URL. The attack chain involved bypassing Microsoft's XPIA prompt injection…

EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System

Source: arXiv

Multi-Agent Compositional Leak

Updated 1/14/2026

Multi-agent Large Language Model (LLM) systems are vulnerable to compositional privacy leakage, a flaw where sensitive information is exposed through the aggregation of individually benign responses from distinct agents. In distributed architectures where data is siloed (e.g., distinct agents handling HR, Finance, and IT logs), individual agents lack a global view of the user’s accumulated knowledge or the sensitive attributes derivable from cross-agent data combinations. An attacker can…

The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration

Affects: Qwen 3 32B, Gemini 2.5 Pro, GPT-5

Source: arXiv

Prompt Injection Alignment Bypass

Updated 12/8/2025

Large Language Models (LLMs) integrated with external retrieval mechanisms (e.g., Retrieval-Augmented Generation (RAG), web search, or email processing) are vulnerable to Indirect Prompt Injection. This vulnerability occurs when an LLM consumes input from untrusted external sources—such as websites, code repositories, or incoming emails—that contain embedded adversarial prompts. Unlike direct injection, where the user attacks the model, here the "poisoned" data is retrieved by the system…

Breaking to Build: A Threat Model of Prompt-Based Attacks for Securing LLMs

Source: arXiv

Related research categories