Attack Surface

Prompt layer Vulnerabilities

Vulnerabilities in prompt handling and processing

34 matching entries out of 599 in this category

Prompt layer research results

34 entries

Agent Implicit Doc Execution

Updated 4/10/2026

LLM-based coding agents are vulnerable to Document-Driven Implicit Payload Execution (DDIPE) via supply-chain poisoning of third-party agent skills. Attackers can embed malicious logic directly into legitimate-looking code examples and configuration templates within skill documentation files (e.g., SKILL.md). Because coding agents ingest this metadata into their context windows and treat the documentation as an authoritative reference, the underlying LLM silently reproduces and executes the…

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems

Affects: Claude Sonnet 4.6, GLM-4.7, MiniMax M2.5 +2 more

Source: arXiv

Contextual Priority Hacking

Updated 4/10/2026

Large Language Models (LLMs) are vulnerable to a jailbreak technique termed "Priority Hacking." Adversaries can bypass safety alignments by exploiting the model's internal priority graph, where certain abstract values (e.g., justice, public health) implicitly outweigh general safety restrictions within specific contexts. By crafting a deceptive prompt that frames a malicious request as a necessary action in service of a higher-priority benign value, attackers engineer a value conflict. The…

Are Dilemmas and Conflicts in LLM Alignment Solvable? A View from Priority Graph

Source: arXiv

LLM Judge Manipulation

Updated 4/10/2026

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by…

Security in LLM-as-a-Judge: A Comprehensive SoK

Affects: GPT-4o, o1, Qwen 2.5 72B Instruct +1 more

Source: arXiv

Activation Delta Detector Evasion

Updated 3/9/2026

Activation-delta-based linear probes used for detecting task drift and prompt injections in Large Language Models (LLMs) can be bypassed using universal adversarial suffixes. By utilizing the Greedy Coordinate Gradient (GCG) algorithm, an attacker can generate a single, optimized suffix that simultaneously fools multiple logistic regression classifiers attached to different hidden layers of the LLM. The attack jointly optimizes the suffix tokens by accumulating gradients from the losses of all…

Bypassing Prompt Injection Detectors through Evasive Injections

Affects: Llama 3 8B, Phi-3 8B

Source: arXiv

Agent-as-a-Proxy Monitor Bypass

Updated 2/21/2026

Hybrid monitoring protocols for Large Language Model (LLM) agents, specifically those that strictly evaluate both Chain-of-Thought (CoT) reasoning and tool usage (such as LlamaFirewall's AlignmentCheck and Extract-and-Evaluate monitors), are vulnerable to "Agent-as-a-Proxy" indirect prompt injection attacks. Unlike standard injections that target the agent, this attack targets the monitoring model itself. By embedding a malicious string—optimized via an algorithm named Parallel-GCG—into…

Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks

Affects: GPT-4o, Llama 3.1 8B, Mistral 7B +1 more

Source: arXiv

Automated Stealth Skill Injection

Updated 2/21/2026

A vulnerability exists in LLM-based coding agents that implement modular capability extensions (often referred to as "Agent Skills") where the agent dynamically loads and executes user-provided skill packages. The vulnerability allows for Skill-Based Prompt Injection, specifically leveraging a technique known as "SkillJect." This attack decouples the malicious intent from the operational payload to bypass semantic safety filters. An attacker constructs a skill package containing: 1. Inducement…

SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents

Affects: Claude Sonnet 4.6, GPT-5 Mini, GLM-4.7 +7 more

Source: arXiv

Invisible Prompt Phishing Evasion

Updated 3/8/2026

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection

Affects: GPT-5, Grok 4 Fast Non-Reasoning, Llama 4 Maverick +1 more

Source: arXiv

LLM Ranker Jailbreak

Updated 3/8/2026

LLM-based document re-rankers utilizing decoder-only and Mixture-of-Experts (MoE) architectures are vulnerable to candidate-embedded prompt injections during multi-document comparison tasks. By embedding Decision Objective Hijacking (DOH) or Decision Criteria Hijacking (DCH) prompts into candidate documents, attackers can manipulate the model's preference to artificially elevate an injected document to the top rank. The vulnerability exploits the models' instruction-following capabilities and…

The Vulnerability of LLM Rankers to Prompt Injection Attacks

Affects: Qwen 3 0.6B, Qwen 3 1.7B, Qwen 3 8B +11 more

Source: arXiv

Persona Adherence Jailbreak

Updated 3/8/2026

Large Language Models (LLMs) deployed as Role-Playing Agents (RPAs) are vulnerable to Persona-Targeted Jailbreaks. When an LLM is prompted to adopt a persona—particularly characters with negative, risky, or villainous traits—the model's optimization for role fidelity frequently overrides its foundational safety alignment. Attackers can exploit this vulnerability by synthesizing queries that leverage the specific narrative background, ideology, or psychological vulnerabilities of the assigned…

Stay in Character, Stay Safe: Dual-Cycle Adversarial Self-Evolution for Safety Role-Playing Agents

Affects: GPT-4o, Llama 3 8B, Qwen 2.5 7B +1 more

Source: arXiv

RAG Knowledgebase Exfiltration

Updated 2/21/2026

Retrieval-Augmented Generation (RAG) systems are vulnerable to iterative knowledge-extraction attacks designed to reconstruct the underlying private knowledge base. The vulnerability exists due to the decoupled optimization of the retrieval and generation phases. Attackers can craft adversarial queries consisting of two distinct components: an "Information" component (optimized via gradient descent or random sampling to steer embeddings toward specific, diverse regions of the vector space) and…

Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

Affects: GPT-4o, Llama 3 8B, Qwen 2.5 7B

Source: arXiv

Related research categories