Attack Surface

Prompt layer Research

Security research involving prompt handling and processing

610 matching entries

Prompt layer research results

610 entries

Agent Tool Execution Jailbreak

Published 3/1/2026

Analyzed 4/10/2026

A multi-step tool execution vulnerability exists in Large Language Model (LLM) agents utilizing the Model Context Protocol (MCP) or similar tool-calling frameworks. Safety guardrails in aligned LLMs typically evaluate static, single-turn text generation. Attackers can bypass these text-centric guardrails by supplying adversarial prompts that force the agent into a complex planning sequence. The agent is manipulated into executing a trajectory of seemingly benign individual tool invocations…

T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search

Evaluated models: GPT-5, Gemini Pro, DeepSeek V3

Source: arXiv

Agentic Robot Instruction Attack

Published 3/1/2026

Analyzed 4/10/2026

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Evaluated models: Not reported

Source: arXiv

Arbitrary Agent Topology Breach

Published 3/1/2026

Analyzed 4/10/2026

A vulnerability in LLM-based Multi-Agent Systems (LLM-MAS) allows an attacker who controls a single arbitrary agent to map and extract the system's entire confidential communication topology. Unlike prior attacks that rely on direct identity queries and administrative privileges, this attack infers topology stealthily purely from contextual and linguistic signals (stylometry, role-specific syntax), bypassing standard keyword-based and identity-filtering defenses. The exploit relies on a…

WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference

Evaluated models: Llama 3 70B, Llama 3.1 8B, Mistral Large 12B +3 more

Source: arXiv

Assembling Malice From Benign

Published 3/1/2026

Analyzed 4/10/2026

A semantic slot filling vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety filters and elicit prohibited content via a single query. The attack, known as StructAttack, decomposes a harmful instruction into a central topic and locally benign-appearing semantic slot types (e.g., "Raw Materials", "Making Process"). These individual slots are embedded into structured visual prompts (such as mind maps, tables, or sunburst diagrams) alongside harmless distractor…

Models as Lego Builders: Assembling Malice from Benign Blocks via Semantic Blueprints

Evaluated models: GPT-4o, Gemini 2.0 Flash 001, Gemini 2.5 Flash +3 more

Source: arXiv

Autonomous Agent Tool RCE

Published 3/1/2026

Analyzed 4/11/2026

The OpenClaw autonomous agent framework lacks execution sandboxing, running agents directly on the host machine with the disk and system privileges of the host user. This architecture allows attackers to achieve Remote Code Execution (RCE) and arbitrary data exfiltration via Indirect Prompt Injection. By embedding malicious instructions within external data sources (e.g., scraped web pages or uploaded documents), an attacker can hijack the agent's planning capabilities to sequentially chain…

Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw

Evaluated models: Not reported

Source: arXiv

Autoresearch Adversarial Algorithm Discovery

Published 3/1/2026

Analyzed 4/11/2026

GPT-OSS-Safeguard-20B and Meta-SecAlign (70B/8B) are vulnerable to white-box adversarial attacks generated by automated algorithmic recombination (specifically the claude_v63, claude_v82, and claude_v53-oss optimizers). These algorithms significantly outperform standard discrete optimization methods (like GCG) by integrating continuous optimization (ADC) with LayerNorm gradient scaling (LSGM), or by merging momentum-smoothed gradients with directional perturbation candidate selection (DPTO)…

Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs

Evaluated models: Llama 2 7B, Llama 3 8B, Qwen 2.5 7B +2 more

Source: arXiv

CoT PII Trace Leakage

Published 3/1/2026

Analyzed 4/10/2026

Inference-time Personally Identifiable Information (PII) leakage is significantly amplified when using Chain-of-Thought (CoT) prompting or reasoning-enabled Large Language Models (LLMs). When an attacker or user elicits step-by-step reasoning or utilizes models with native "thinking" token budgets, sensitive context data provided in the prompt is directly resurfaced into intermediate reasoning steps or the final output. This bypasses output-level privacy policies instructing the model not to…

Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in LLMs

Evaluated models: DeepSeek R1 Distill Llama 70B, Llama 3.3 70B, Mixtral 8x22B +3 more

Source: arXiv

Content-Level Ethics Bypass

Published 3/1/2026

Analyzed 4/10/2026

An "in-content harm" vulnerability exists in safety-aligned Large Language Models (LLMs) where task-level alignment mechanisms fail to evaluate the safety of user-provided external data. Attackers can bypass safety guardrails by embedding policy-violating text (e.g., violence, self-harm, explicit content) within the payload of a seemingly benign, policy-compliant task (e.g., translation, summarization, grammar polishing). Because the primary instruction is harmless, the LLM's safety filters…

Understanding LLM Behavior When Encountering User-Supplied Harmful Content in Harmless Tasks

Evaluated models: GPT-3.5 Turbo, GPT-4 Turbo, GPT-5.2 +6 more

Source: arXiv

Contextual Priority Hacking

Published 3/1/2026

Analyzed 4/10/2026

Large Language Models (LLMs) are vulnerable to a jailbreak technique termed "Priority Hacking." Adversaries can bypass safety alignments by exploiting the model's internal priority graph, where certain abstract values (e.g., justice, public health) implicitly outweigh general safety restrictions within specific contexts. By crafting a deceptive prompt that frames a malicious request as a necessary action in service of a higher-priority benign value, attackers engineer a value conflict. The…

Are Dilemmas and Conflicts in LLM Alignment Solvable? A View from Priority Graph

Evaluated models: Not reported

Source: arXiv

Drive Overrides Refusal

Published 3/1/2026

Analyzed 4/10/2026

A prompt structure vulnerability exists in instruction-tuned Large Language Models (LLMs) where attackers can bypass safety alignments by injecting a continuation-triggering suffix immediately following the user prompt termination token. By placing an affirmative suffix outside the user instruction boundary, it is processed as the beginning of the assistant's own pre-filled response. This structural manipulation intrinsically overactivates the model's continuation attention heads, forcing its…

The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs

Evaluated models: Llama 2 7B, Qwen 2.5 7B

Source: arXiv

Related research categories