Attack Type

Denial of service Vulnerabilities

Attacks that disrupt model availability

20 matching entries out of 34 in this category

Denial of service research results

20 entries

Agent Lifecycle Compound Threats

Updated 4/10/2026

OpenClaw is vulnerable to persistent memory poisoning, allowing an attacker to manipulate the agent's long-term memory store (MEMORY.md) via prompt injection. Because the autonomous agent continuously integrates this memory file as context for all subsequent reasoning and task planning, injected payloads act as durable behavioral constraints. This allows an attacker to persistently alter the agent's core policy, manipulate tool selection, and hijack future sessions without any further…

Taming openclaw: Security analysis and mitigation of autonomous llm agent threats

Source: arXiv

Stealthy Tool-Call Token Exhaust

Updated 3/8/2026

OpenClaw v2026.2.9 is vulnerable to a resource amplification and economic denial-of-service (DoS) attack via malicious third-party skills. An attacker can publish a Trojanized skill that exploits the framework's tool-calling loop and context-management architecture by injecting a multi-turn "Segmented Verification Protocol" (SVP). Malicious instructions embedded in the skill's SKILL.md file mandate extensive autoregressive sequence generation, while a companion script returns PROGRESS, REPAIR…

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

Affects: Gemini 2.5 Pro

Source: arXiv

TabooRAG Transferable Blocking

Updated 3/8/2026

A vulnerability in Retrieval-Augmented Generation (RAG) systems utilizing safety-aligned Large Language Models (LLMs) allows attackers to perform a highly transferable Denial-of-Service (DoS) or "blocking" attack. By injecting a single maliciously crafted document into the RAG knowledge base, attackers can force the LLM to refuse to answer benign queries. Unlike previous attacks that rely on explicit instruction injection or high-perplexity adversarial suffixes—which modern models easily…

When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG

Affects: GPT-5.2, GPT-5 Mini, DeepSeek V3.2 +4 more

Source: arXiv

Adaptive Web Agent Prompt Injection

Updated 2/21/2026

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks

Affects: GPT-4.1, GPT-4o, Qwen3-VL 32B Instruct

Source: arXiv

Invisible Prompt Phishing Evasion

Updated 3/8/2026

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection

Affects: GPT-5, Grok 4 Fast Non-Reasoning, Llama 4 Maverick +1 more

Source: arXiv

Voice Agent Behavioral Bypass

Updated 2/21/2026

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Aegis: Towards Governance, Integrity, and Security of AI Voice Agents

Affects: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro +4 more

Source: arXiv

LLM Router Rerouting

Updated 3/8/2026

LLM routing systems are vulnerable to adversarial rerouting attacks where malicious triggers prepended to user queries manipulate the router's model-selection mechanism. Because LLM routers function as classifiers evaluating query complexity to balance computational cost and response quality, an attacker can craft adversarial prefixes that distort the query's latent semantic representation. This exploits the router's decision boundaries, forcing the system to misclassify the input and redirect…

RerouteGuard: Understanding and Mitigating Adversarial Risks for LLM Routing

Affects: GPT-4, GPT-4o, GPT-5 +2 more

Source: arXiv

Visual Object Injection

Updated 2/22/2026

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Affects: GPT-4o, GPT-4o Mini, GPT-4 Turbo +7 more

Source: arXiv

Indirect Environmental Jailbreak

Updated 12/30/2025

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreaks

Affects: GPT-4o, Qwen3-VL Plus, Gemini 2.0 Flash +3 more

Source: arXiv

Adversarial Report Code Insecurity

Updated 12/9/2025

Large Language Model (LLM)-based Automated Program Repair (APR) systems—such as SWE-agent, OpenHands, and AutoCodeRover—are vulnerable to adversarial manipulation via crafted bug reports. These systems accept unvetted natural language issue descriptions as trusted input to synthesize code patches. An attacker can exploit this trust by submitting semantically plausible but malicious bug reports designed to mislead the APR agent. By leveraging the semantic gap between natural language…

Adversarial Bug Reports as a Security Risk in Language Model-Based Automated Program Repair

Affects: Prompt Guard, PromptGuard V2, Llama Guard 3 +4 more

Source: arXiv

Related research categories