Attack Context

Chains & workflows Vulnerabilities

Security issues in prompt chaining and workflows

64 matching entries out of 96 in this category

Chains & workflows research results

64 entries

Sleeper Memory Poisoning in LLM Agents

Updated 7/20/2026

The paper presents a specific black-box indirect prompt-injection evaluation: attacker-controlled external content can cause a memory-enabled assistant or external memory manager to persist a fabricated user memory, which may later be retrieved in a separate session and steer responses or agent actions. The authors evaluate injection, retrieval, and conditional adversarial usage separately across synthetic document and future-session datasets. The released repository provides defensive…

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

Affects: GPT-5.4, GPT-5.5, Claude Sonnet 4.6 +3 more

Source: arXiv

Single-Document Reasoning Poisoning in RAG

Updated 7/20/2026

The paper describes a specific black-box knowledge-base poisoning attack against retrieval-augmented reasoning systems. An attacker who can add one query-specific document to the corpus can cause it to be retrieved and influence the LLM toward an attacker-chosen answer. AdversarialCoT shapes the document around the target model’s observable reasoning structure and iteratively refines retrieval relevance and persuasive reasoning using final model feedback. The paper reports this as an…

AdversarialCoT: Single-Document Retrieval Poisoning for LLM Reasoning

Affects: DeepSeek R1, GLM 4.5, Qwen 2.5 7B Instruct +1 more

Source: arXiv

Agent Implicit Doc Execution

Updated 4/10/2026

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Affects: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5 +2 more

Source: arXiv

Indirect Agent Privilege Exposure

Updated 4/11/2026

Autonomous LLM agents deployed in dynamic, multi-step tool-calling environments are highly vulnerable to Indirect Prompt Injections (IPI) embedded in external content. Surface-level defensive prompts and monitoring mechanisms (such as Prompt Warning, the Sandwich Method, Spotlighting, Keyword Filtering, and LLM-as-a-Judge) consistently fail to prevent exploitation and occasionally exacerbate the vulnerability by introducing adversarial distraction. While compromised agents exhibit…

Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs

Affects: Qwen 2.5 14B, Qwen 2.5 32B, Qwen 3 4B +6 more

Source: arXiv

Agent Lifecycle Compound Threats

Updated 4/10/2026

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Source: arXiv

Autonomous Agent Tool RCE

Updated 4/11/2026

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw

Source: arXiv

Cascading Agent False Consensus

Updated 3/9/2026

Multi-Agent Systems based on Large Language Models (LLM-MAS) are vulnerable to systemic Consensus Corruption via cascading error amplification. Because mainstream collaborative architectures rely on recursive context reuse without atomic-level provenance tracking, a single atomic falsehood injected into the system is repeatedly cited and reused within the multi-agent interaction chain. This structural exposure causes the error to deterministically compound across the communication graph…

From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration

Affects: GPT-4o

Source: arXiv

LLM Judge Manipulation

Updated 4/10/2026

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Affects: GPT-4o, o1, Qwen 2.5 72B Instruct +1 more

Source: arXiv

Stage-Sequential Agent Escalation

Updated 4/10/2026

Agentic Large Language Model (LLM) systems utilizing persistent memory, Retrieval-Augmented Generation (RAG) pipelines, and external tool connectors are vulnerable to Logic-layer Prompt Control Injection (LPCI). An attacker can inject obfuscated (e.g., encoded, structurally nested, or semantically reframed) payloads into external memory stores or RAG documents. These payloads bypass conventional inference-time plaintext content filters, persist across session boundaries, and remain dormant…

LAAF: Logic-layer Automated Attack Framework A Systematic Red-Teaming Methodology for LPCI Vulnerabilities in Agentic Large Language Model Systems

Affects: GPT-4o Mini, Claude 3 Haiku, Llama 3.1 70B Instruct +2 more

Source: arXiv

Stealthy Tool-Call Token Exhaust

Updated 3/8/2026

OpenClaw v2026.2.9 is vulnerable to a resource amplification and economic denial-of-service (DoS) attack via malicious third-party skills. An attacker can publish a Trojanized skill that exploits the framework's tool-calling loop and context-management architecture by injecting a multi-turn "Segmented Verification Protocol" (SVP). Malicious instructions embedded in the skill's SKILL.md file mandate extensive autoregressive sequence generation, while a companion script returns PROGRESS, REPAIR…

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

Affects: Gemini 2.5 Pro

Source: arXiv

Related research categories