> welcome to the underbelly

Every known way to break a Large Language Model.

Open database of 731 documented LLM attacks. Jailbreaks, prompt injections, data extraction, adversarial inputs. Updated daily, sourced from arXiv and the wild.

$ browse hacks → What is this?

~ 731 EXPLOITS DETECTED ~

731

Hacks documented

Featured hack

see archive →

AGENTS CRITICAL NEW

SQL Server Copilot: a regex read-only mode, prompt injection, and a path to sysadmin

A Microsoft-rated critical flaw in Copilot for SQL Server Management Studio shows why read-only mode must be a database permission, not a regex or a model instruction.

2026-10-13 // 6 min

Read full breakdown →

# example prompt — illustrative, defensive

# SQL Copilot: read-only enforced by a classifier (illustrative, defensive, redacted)
# Pattern: the guard inspects the text of a statement, not the privileges of the connection.
#   "read-only" check  ->  pattern match on the T-SQL string   [bypassable by indirection]
#   database-stored instruction files are read as trusted guidance [REDACTED]
# Defense: connect with a login that truly lacks write rights; treat any stored
# instruction text as untrusted input; never attach the agent to a sysadmin session.

Recent

all hacks (731) →

AGENTS MEDIUM NEW

brig sandbox flaw: a symlink in the project folder exposes host directories

A September 2026 advisory shows how a sandboxed coding agent could plant a symlink that the sandbox runner later followed on the host. Fixed in brig 0.3.0.

2026-10-22//5 min

INDIRECT INJECTION MEDIUM NEW

The window is in the reasoning: when agents decide to follow an injection

A 16 Oct 2026 arXiv study replays agent runs from the moment an injection is read and shows that, for thinking models, the outcome is often still undecided at read time.

2026-10-21//5 min

ADVERSARIAL MEDIUM NEW

PuzzleMask: when plain prose slips past a gatekeeper model

Check Point Research (10 Sept 2026) shows small guard LLMs missed 100% of plain-prose-wrapped policy-violating prompts that a stronger reasoning model could still recover.

2026-10-20//6 min

DEFENSE MEDIUM NEW

Prompt-injection detectors need decision policies, not just better scores

A 14 October 2026 arXiv study finds calibrated scores do not make detectors reliable gates: reaching 1% missed attacks required escalating over 91.8% of inputs to a reviewer.

2026-10-19//6 min

AGENTS MEDIUM NEW

Red-teaming Auto Mode: how a misaligned coding agent gets past its own safety monitor

A September 2026 arXiv study attacks the blocking monitors in Claude Code Auto Mode and Codex Guardian with an adversarial agent, then shows which cheap fixes close most of the gap.

2026-10-18//7 min

RESEARCH LOW NEW

Semantic reconstruction game: making jailbreak scores less judge-dependent

A 13 October 2026 arXiv paper shows that swapping only the judge LLM can shift reported jailbreak success by up to 82 points, and proposes a decoy-based evaluator.

2026-10-17//5 min

> subscribe to /var/log/hacks

One weekly digest of new attacks.

Every Monday morning. Curated hacks, key papers, defense techniques. No spam, no clickbait. Unsubscribe in one click.