Attack Type

Injection Vulnerabilities

Attacks that inject malicious content into model inputs

140 matching entries out of 323 in this category

Injection research results

140 entries

Lifecycle poisoning of reusable agent skills

Updated 7/21/2026

The paper presents SkillSec-Eval, a controlled evaluation of attacks against reusable agent skills across repository admission, semantic retrieval, planner selection, runtime execution, and updates. It reports that malicious metadata, retrieval manipulation, unsafe workflow composition, and poisoned updates can cause agents to retrieve, select, or execute unintended skills. These are paper-reported benchmark results, not independently verified vulnerabilities in a named production product.

Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation

Affects: all-MiniLM-L6-v2, Gemini 3.1 Pro, Gemini 1.5 Flash

Source: arXiv

Cross-Site Prompt Injection in Web Agents

Updated 7/21/2026

The paper defines Cross-Site Prompting (XSP): attacker-controlled text in reviews, posts, seller listings, advertisements, or embeds can be interpreted as instructions by a web agent and steer its browser actions. It evaluates three reproducible WebArena attack templates—Shortcut, Fake Completion, and Ignore Instruction—plus WASP and adaptive stress tests. This is an evaluated agent-security issue and mitigation, not a claimed production CVE.

Prismata: Confining Cross-Site Prompt Injection in Web Agents

Affects: GPT-5.4, GPT-5.4-mini, GPT-5.4 Nano +4 more

Source: arXiv

Agent Data Injection via Trusted-Metadata Spoofing

Updated 7/20/2026

Agent data injection (ADI) is a reproducible indirect injection class in which attacker-controlled external content is formatted to resemble trusted metadata or agent-context structure. The paper reports that probabilistic delimiter injection can cause agents to misinterpret untrusted content as trusted element IDs, author identities, or tool responses, leading to unintended clicks, command execution, or PR merges. Safe defensive reproduction should use the authors’ synthetic LLM/AgentDojo…

Agent Data Injection Attacks are Realistic Threats to AI Agents

Affects: GPT-5.2, GPT-5 Mini, Claude Opus 4.5 +3 more

Source: arXiv

GhostWriter Persistent Memory Poisoning in Tool-Using Agents

Updated 7/20/2026

The paper describes GhostWriter, a reproducible two-phase attack against tool-using agents with persistent memory: untrusted email or calendar content is admitted into long-term memory, then later retrieved during a benign user task and treated as trusted context. In the authors’ controlled evaluation, this could steer subsequent agent actions despite the adversary lacking direct access to the agent, memory store, account, or later prompt. The paper reports an average 98% memory-injection rate…

When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents

Affects: GPT-5.4-mini, DeepSeek V4 Flash, Gemini 2.5 Flash +1 more

Source: arXiv

Long-Term Memory Authority Laundering

Updated 7/20/2026

The paper describes a reproducible agent-memory poisoning issue: untrusted content stored in persistent memory can later influence consequential actions after its origin is laundered through agent summarization, trusted-tool echo, or manufactured corroboration. The paper reports that content scoring, lineage, and single-session capability/IFC defenses remain vulnerable because they decide authority from malleable content or derivation signals. This is a paper-reported evaluation; it was not…

Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees

Affects: GPT-5 Chat, GPT-4o Mini, Claude Opus 4.1 +5 more

Source: arXiv

Automated indirect prompt injection against tool-calling agents

Updated 7/21/2026

The paper presents a concrete, reproducible security evaluation in which attacker-controlled instructions embedded in retrieved external content steer stateful, tool-calling LLM agents toward unauthorized actions. It adapts white-box GCG and black-box TAP to AgentDojo and evaluates single-task and task-universal attacks across 80 task pairs in four domains. The reported results show that semantic black-box optimization can discover functional prompt injections more effectively than…

Assessing Automated Prompt Injection Attacks in Agentic Environments

Affects: Gemma3-4B Instruct, Qwen 3 4B Instruct, GPT-5 +6 more

Source: arXiv

Persistent Memory Poisoning in LLM Agents

Updated 7/20/2026

The paper describes and evaluates a reproducible application-layer weakness in agents with persistent memory: untrusted external content can cross the memory-write boundary, be stored as trusted factual, experience, or procedural memory, and influence later sessions. It identifies four write channels—explicit writes, policy-driven writes, compaction, and experience-to-procedure synthesis—and six attack classes. For safe defensive testing, use MPBench’s two-phase structure in an isolated agent…

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

Affects: GPT-oss 120B

Source: arXiv

Sleeper Memory Poisoning in LLM Agents

Updated 7/20/2026

The paper presents a specific black-box indirect prompt-injection evaluation: attacker-controlled external content can cause a memory-enabled assistant or external memory manager to persist a fabricated user memory, which may later be retrieved in a separate session and steer responses or agent actions. The authors evaluate injection, retrieval, and conditional adversarial usage separately across synthetic document and future-session datasets. The released repository provides defensive…

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

Affects: GPT-5.4, GPT-5.5, Claude Sonnet 4.6 +3 more

Source: arXiv

Agent Implicit Doc Execution

Updated 4/10/2026

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Affects: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5 +2 more

Source: arXiv

Agent Skill Injection

Updated 4/10/2026

LLM-based personal agents are vulnerable to Indirect Prompt Injection (IPI) defense bypasses via declarative context reframing and implicit file provenance trust. Attackers can bypass agent safety filters by phrasing malicious instructions as declarative compliance alerts rather than imperative commands. Because agents are designed to report discrepancies as expected behavior, declarative framing bypasses intent-sensitive safety mechanisms. Additionally, attackers can exploit the agent's…

ClawSafety: Safe LLMs, Unsafe Agents

Affects: Claude Sonnet 4.6, Gemini 2.5 Pro, DeepSeek V3 +2 more

Source: arXiv

Related research categories