Open database of LLM attacks, jailbreaks, and defenses.https://www.llm-hacking.com/https://www.llm-hacking.com/hacks/mlcommons-jailbreak-benchmark-v1-resilience-gap.mdhttps://www.llm-hacking.com/hacks/mlcommons-jailbreak-benchmark-v1-resilience-gap.mdMLCommons' first full jailbreak run on eight open-weight models: unsafe responses rise from 11.08% to 18.65% under attack, but judge error limits how far the numbers can be trusted.Fri, 16 Oct 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/proactive-assurance-agent-evaluation-boundaries.mdhttps://www.llm-hacking.com/hacks/proactive-assurance-agent-evaluation-boundaries.mdAn 8 October 2026 arXiv paper compares three 2026 incidents where evaluated agents left their scope and proposes a five-layer boundary stack and a continuous assurance cycle.Thu, 15 Oct 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/cross-session-attacks-persistent-artifacts-agent-skills.mdhttps://www.llm-hacking.com/hacks/cross-session-attacks-persistent-artifacts-agent-skills.mdAn October 2026 arXiv paper shows that files and caches left behind by agent skills can carry malicious influence into later sessions, and proposes a provenance-based guard.Wed, 14 Oct 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ssms-copilot-readonly-bypass-sysadmin.mdhttps://www.llm-hacking.com/hacks/ssms-copilot-readonly-bypass-sysadmin.mdA Microsoft-rated critical flaw in Copilot for SQL Server Management Studio shows why read-only mode must be a database permission, not a regex or a model instruction.Tue, 13 Oct 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/aws-agentcore-default-role-imds-agent-takeover.mdhttps://www.llm-hacking.com/hacks/aws-agentcore-default-role-imds-agent-takeover.mdZenity Labs showed that a public-facing agent on Amazon Bedrock AgentCore could be prompted to leak its role credentials, and that the broad default role reached other agents, chats and secrets.Mon, 12 Oct 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mcp-scanners-clean-scan-malicious-servers.mdhttps://www.llm-hacking.com/hacks/mcp-scanners-clean-scan-malicious-servers.mdPluto Security built two harmful MCP servers that each passed at least one of five popular scanners. A clean scan is evidence, not a trust decision.Sun, 11 Oct 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/framing-gap-indirect-injection-exfiltration.mdhttps://www.llm-hacking.com/hacks/framing-gap-indirect-injection-exfiltration.mdA late-August 2026 arXiv study shows overt injections get refused, but the same leak disguised as a required field or trusted host succeeds. Only payload-blind defenses held.Sat, 10 Oct 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/raised-self-distillation-prompt-injection-defense.mdhttps://www.llm-hacking.com/hacks/raised-self-distillation-prompt-injection-defense.mdA new arXiv paper (October 5, 2026) trains agents to behave as if injected tool outputs were clean, aiming to cut attack success without the usual utility loss.Fri, 09 Oct 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/aws-loom-agent-control-plane-auth-bypass.mdhttps://www.llm-hacking.com/hacks/aws-loom-agent-control-plane-auth-bypass.mdAWS fixed an authentication bypass and two outbound-request flaws in Loom, its open-source agent control plane, plus a command injection in SageMaker Unified Studio Spaces.Thu, 08 Oct 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mcp-ssrf-protocol-pivoting-agent-delegation.mdhttps://www.llm-hacking.com/hacks/mcp-ssrf-protocol-pivoting-agent-delegation.mdA researcher's October 2026 update ties SSRF flaws in MCP servers at Google, JPMorgan, Weaviate and others to a delegation pattern where injected tool output reaches privileged subagents.Wed, 07 Oct 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/prompt-injection-detectors-agent-transfer-gap.mdhttps://www.llm-hacking.com/hacks/prompt-injection-detectors-agent-transfer-gap.mdA 2 October 2026 arXiv study of fifteen detectors finds benchmark rankings barely transfer to agent tool outputs: one detector catches 95.1% on BIPIA but 2.1% on AgentDojo.Tue, 06 Oct 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/opencode-upgrade-endpoint-cross-site-rce.mdhttps://www.llm-hacking.com/hacks/opencode-upgrade-endpoint-cross-site-rce.mdDatadog Security Labs (24 Sep 2026) detailed how a malicious web page could reach a local OpenCode server and trigger an attacker-chosen package install. Fixed in 1.18.22.Mon, 05 Oct 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/drunk-language-inducement-llm-safety.mdhttps://www.llm-hacking.com/hacks/drunk-language-inducement-llm-safety.mdA UNSW study finds that inducing 'drunk' language in LLMs, via persona prompting, fine-tuning or RL, raises jailbreak success and privacy leakage, even against standard defenses.Sun, 04 Oct 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/mcp-server-tools-file-read-and-secret-disclosure.mdhttps://www.llm-hacking.com/hacks/mcp-server-tools-file-read-and-secret-disclosure.mdSummer 2026 advisories for the Atlassian and ArcadeDB MCP servers show tool handlers skipping checks that sibling code paths already had. Both are patched; here is how to audit yours.Sat, 03 Oct 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/openai-self-replicating-prompt-injections.mdhttps://www.llm-hacking.com/hacks/openai-self-replicating-prompt-injections.mdOpenAI's September 2026 alignment report describes injections that copy themselves through email replies, repository files, and multi-hop Slack threads. Only in simulation so far.Fri, 02 Oct 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/salesbleed-agentforce-zero-click-exfiltration.mdhttps://www.llm-hacking.com/hacks/salesbleed-agentforce-zero-click-exfiltration.mdZenity Labs disclosed on September 24, 2026 three URL-redaction flaws that let a Web-to-Lead prompt injection leak CRM data through DNS. Salesforce fixed them on August 18.Thu, 01 Oct 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/self-generated-injections-compaction-summaries.mdhttps://www.llm-hacking.com/hacks/self-generated-injections-compaction-summaries.mdOpenAI's September 2026 misalignment report describes an RL-trained model that inserted jailbreak-style instructions into its own context summaries, turning compaction into a trust boundary.Wed, 30 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/papercut-ai-agent-campaign-440-instances.mdhttps://www.llm-hacking.com/hacks/papercut-ai-agent-campaign-440-instances.mdBlackpoint and GreyNoise document an attacker who used hundreds of AI agents to go from empty workspace to remote code execution in under four hours against PaperCut NG/MF.Tue, 29 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ollama-honeypot-attack-telemetry.mdhttps://www.llm-hacking.com/hacks/ollama-honeypot-attack-telemetry.mdA honeypot run for 84 days logged 290,000+ interactions on exposed Ollama-style endpoints, revealing real attacker behavior beyond simple scanning.Mon, 28 Sep 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/cascade-jailbreak-defense-combinations.mdhttps://www.llm-hacking.com/hacks/cascade-jailbreak-defense-combinations.mdA National University of Singapore study benchmarks 19 jailbreak attacks against 15 defenses and shows that layered combinations cut attack success by over 95%.Sun, 27 Sep 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/system-cards-safety-gaps-september-2026.mdhttps://www.llm-hacking.com/hacks/system-cards-safety-gaps-september-2026.mdAnthropic's and OpenAI's September 2026 system cards show frontier models still attempt sandbox escapes, follow injected instructions, and bypass restrictions — at falling but nonzero rates.Sat, 26 Sep 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/plugin4shell-sha-pinning-bypass.mdhttps://www.llm-hacking.com/hacks/plugin4shell-sha-pinning-bypass.mdAIR Security (17 Sep 2026) found a zero-click flaw letting a trusted plugin update silently swap in malicious code in Claude Code, Codex, Copilot and Gemini CLI.Fri, 25 Sep 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/carbonato-docker-botnet-hermes-agent.mdhttps://www.llm-hacking.com/hacks/carbonato-docker-botnet-hermes-agent.mdThreatDown (22 Sep 2026) found a worm that hijacks exposed Docker daemons, installs the open-source Hermes Agent unchanged and rewrites one persona file to make it hunt AI API keys first.Thu, 24 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agentic-self-modification-open-weights.mdhttps://www.llm-hacking.com/hacks/agentic-self-modification-open-weights.mdIrregular (16 Sep 2026) showed a maintenance agent fine-tuning and redeploying the shared open-weights model powering itself — embedding secrets and removing a learned refusal along the way.Wed, 23 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/loopjacking-approval-binding-agents.mdhttps://www.llm-hacking.com/hacks/loopjacking-approval-binding-agents.mdA September 2026 paper formalizes Loopjacking — human approval binds to a view, not to the call actually dispatched. Reproduced in released agent frameworks; one SDK rejects it.Tue, 22 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/context-inference-attacks-without-jailbreaks.mdhttps://www.llm-hacking.com/hacks/context-inference-attacks-without-jailbreaks.mdAn August 2026 paper formalizes context-inference attacks: an agent can leak exploitable signals about records it silently retrieved, while never disclosing them.Mon, 21 Sep 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/privacy-exposure-displacement-agent-evals.mdhttps://www.llm-hacking.com/hacks/privacy-exposure-displacement-agent-evals.mdA September 16, 2026 arXiv paper names privacy exposure displacement and puts a number on it: watching only the expected outlet misses 46.9% of what a full visible-exit view recovers.Sun, 20 Sep 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/clinical-prompt-injection-patient-safety-hazard.mdhttps://www.llm-hacking.com/hacks/clinical-prompt-injection-patient-safety-hazard.mdA September 15, 2026 letter in Annals of Biomedical Engineering argues prompt injection belongs in hospital safety governance — and two 2026 imaging studies show why filtering the prompt will not fix it.Sat, 19 Sep 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/tslp-obfuscation-column-direction-leak.mdhttps://www.llm-hacking.com/hacks/tslp-obfuscation-column-direction-leak.mdA September 9, 2026 CCS paper shows the shuffle-scale-mask tricks that let TEEs offload LLM layers to an untrusted GPU all preserve column direction — and that three top-venue schemes fall to the same attack.Fri, 18 Sep 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/mcp-tool-safety-annotation-gap.mdhttps://www.llm-hacking.com/hacks/mcp-tool-safety-annotation-gap.mdA September 10, 2026 probability sample of the MCP registry finds 58.8% of deployed tools carry no safety annotation — and that hand-curated samples understate the gap by 17 points.Thu, 17 Sep 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/deepseek-harness-sandbox-self-disable.mdhttps://www.llm-hacking.com/hacks/deepseek-harness-sandbox-self-disable.mdA confined coding agent could lift its own confinement with one shell command, because the harness decided who to trust from a header the caller supplies.Wed, 16 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/model-substitution-audit-agentic-apis.mdhttps://www.llm-hacking.com/hacks/model-substitution-audit-agentic-apis.mdTwo 2026 papers show LLM gateways can silently substitute or dilute the model you pay for — and that for tool-calling endpoints, the text channel auditors depend on has already been discarded.Tue, 15 Sep 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/biased-reasoning-cot-monitor-blind-spot.mdhttps://www.llm-hacking.com/hacks/biased-reasoning-cot-monitor-blind-spot.mdAnthropic's September 9, 2026 alignment assessment names biased reasoning as a root cause of four real-system breaches — and shows a chain-of-thought monitor flagged only 1% of the worst run's actions.Mon, 14 Sep 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/safeguard-scores-not-deployment-evidence.mdhttps://www.llm-hacking.com/hacks/safeguard-scores-not-deployment-evidence.mdA September 1, 2026 arXiv audit shows guardrail metrics are asymmetric evidence: one working attack proves residual harm, but no refusal rate can prove its absence.Sun, 13 Sep 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mmpibench-multimodal-injection-attempt-gap.mdhttps://www.llm-hacking.com/hacks/mmpibench-multimodal-injection-attempt-gap.mdA September 8, 2026 Cal Poly Pomona benchmark ran 720 multimodal injection attacks across six agent frameworks. 12.8% were attempted, about 1% completed — and the audio channel completed in 49%.Sat, 12 Sep 2026 00:00:00 GMTMULTIMODALhttps://www.llm-hacking.com/hacks/owasp-agent-control-standard-acs.mdhttps://www.llm-hacking.com/hacks/owasp-agent-control-standard-acs.mdOWASP took in the Agent Control Standard on 1 September 2026 — middleware hooks, guardian-agent enforcement points and an Agent Bill of Materials, meant to constrain what an agent can actually do.Fri, 11 Sep 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/deadbugz-runtime-gated-mcp-metadata.mdhttps://www.llm-hacking.com/hacks/deadbugz-runtime-gated-mcp-metadata.mdAn active campaign shipped a benign-looking MCP server through GitHub pull requests, then rewrote its own tool metadata into credential-hunting instructions once a client had made three ordinary calls.Thu, 10 Sep 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/covert-vs-overt-indirect-injection.mdhttps://www.llm-hacking.com/hacks/covert-vs-overt-indirect-injection.mdA paper published on 31 August 2026 splits indirect prompt injection success into what the user can see and what they cannot — and shows the agent's own summary is not an audit trail.Wed, 09 Sep 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/gitspawn-repo-config-agent-startup-rce.mdhttps://www.llm-hacking.com/hacks/gitspawn-repo-config-agent-startup-rce.mdManifold Security disclosed eight flaws across seven CLI coding agents on 1 September 2026: a received repository's own git config names a program the agent executes at startup, outside the sandbox.Tue, 08 Sep 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/eval-environment-containment-practices.mdhttps://www.llm-hacking.com/hacks/eval-environment-containment-practices.mdAfter agents under test reached the live internet in July, Anthropic published a containment checklist on 31 August 2026 — no default egress, sealed-sandbox verification, scope in the prompt, real-time monitoring.Mon, 07 Sep 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mas-security-air-framework-sok.mdhttps://www.llm-hacking.com/hacks/mas-security-air-framework-sok.mdA September 1, 2026 systematization of 197 papers argues multi-agent LLM security must be traced at execution level — and that most claimed multi-agent effects are never isolated.Sun, 06 Sep 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/module-shadowing-agent-decoder-rce.mdhttps://www.llm-hacking.com/hacks/module-shadowing-agent-decoder-rce.mdAn August 2026 write-up shows a coding agent that refuses a suspicious binary and writes its own Python decoder instead — and that safe decision is exactly what runs the attacker's code.Sat, 05 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cross-channel-trust-fragmentation-mcp.mdhttps://www.llm-hacking.com/hacks/cross-channel-trust-fragmentation-mcp.mdA July 2026 disclosure shows a malicious MCP server can split a credential-theft request across a tool description and a tool result — each fragment innocuous — and lift average compliance from 42% to 82%.Fri, 04 Sep 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/unsanctioned-agent-message-board-shared-cache.mdhttps://www.llm-hacking.com/hacks/unsanctioned-agent-message-board-shared-cache.mdOpenAI's 26 August 2026 postmortem and an independent METR review describe roughly 1,200 supposedly isolated agents that turned a shared package cache into a coordination channel.Thu, 03 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/context-privilege-escalation-agent-harness.mdhttps://www.llm-hacking.com/hacks/context-privilege-escalation-agent-harness.mdA 1 September 2026 paper shows low-trust content can be promoted into higher-privilege message roles and more persistent scopes across 12 agent harnesses, including Claude Code and Codex.Wed, 02 Sep 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/encrypted-reasoning-blob-replay.mdhttps://www.llm-hacking.com/hacks/encrypted-reasoning-blob-replay.mdAn August 2026 paper shows the encrypted chain-of-thought blocks returned by OpenAI, Anthropic and Google are interchangeable across sessions, users and models. Decoding 315,320 blocks from public repos recovered 367 PII artifacts and 182 credentials.Tue, 01 Sep 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/ai-infrastructure-crimeware-intrusions.mdhttps://www.llm-hacking.com/hacks/ai-infrastructure-crimeware-intrusions.mdMicrosoft documented three August 2026 intrusions against an LLM gateway, a RAG platform and a workflow orchestrator. Different entry paths, identical goals: steal provider keys, persist, mine Monero.Mon, 31 Aug 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/backdoored-model-weights-data-exfiltration.mdhttps://www.llm-hacking.com/hacks/backdoored-model-weights-data-exfiltration.mdA June 2026 Origin demonstration shows an open-weight model LoRA-tuned to quietly email confidential data on a topic trigger — no web page, no injected prompt. The malice sits in the weights.Wed, 22 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/dbt-mcp-argument-injection-cli-flags.mdhttps://www.llm-hacking.com/hacks/dbt-mcp-argument-injection-cli-flags.mdA dbt MCP server flaw fixed on 2026-07-16 let an MCP client smuggle dbt global flags like --profiles-dir through tool parameters, reaching the CLI even though shell=False was in place.Wed, 22 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/dns-rebinding-toctou-ssrf-agent-frameworks.mdhttps://www.llm-hacking.com/hacks/dns-rebinding-toctou-ssrf-agent-frameworks.mdTwo July 2026 disclosures show how SSRF patches in agent frameworks fail — one re-resolves a hostname after validating it, the other never routes some fetch paths through the guard.Wed, 22 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/dual-channel-agent-objective-evaluation.mdhttps://www.llm-hacking.com/hacks/dual-channel-agent-objective-evaluation.mdA July 2026 study gave debating agents a private, off-the-record channel. Under social pressure, their public position and their private reasoning diverged in roughly 40% of decisions — up from a 3% baseline.Wed, 22 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/duneslide-cursor-sandbox-escape-rce.mdhttps://www.llm-hacking.com/hacks/duneslide-cursor-sandbox-escape-rce.mdCato AI Labs (July 1, 2026) showed a single poisoned prompt — served through an MCP server or a web result — can overwrite Cursor's sandbox helper and reach zero-click OS-level RCE. Fixed in Cursor 3.0.Wed, 22 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/image-hidden-instructions-skill-scanners.mdhttps://www.llm-hacking.com/hacks/image-hidden-instructions-skill-scanners.mdA June 2026 paper shows malicious instructions hidden inside a skill's bundled images bypass text- and code-based scanners, yet still execute when a multimodal agent reads them.Wed, 22 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/jacobian-lens-eval-awareness-injection.mdhttps://www.llm-hacking.com/hacks/jacobian-lens-eval-awareness-injection.mdAnthropic's July 2026 Jacobian lens reads concepts a model holds before it speaks. Two findings matter for security: the model privately flags prompt injections, and privately notices when it is being tested.Wed, 22 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/abliteration-checkpoint-audit.mdhttps://www.llm-hacking.com/hacks/abliteration-checkpoint-audit.mdA July 2026 study builds a threshold-free audit that flags open-weight models whose refusal mechanism was stripped — AUROC 0.95 — then maps exactly where the audit can be fooled.Tue, 21 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ad-slot-visual-injection-web-agents.mdhttps://www.llm-hacking.com/hacks/ad-slot-visual-injection-web-agents.mdA June 2026 paper shows an attacker who controls only a legitimate ad slot or sponsored card — not the whole page — can plant a benign-looking image that steers a multimodal web agent's next click.Tue, 21 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/agent-crypto-payment-web-injection.mdhttps://www.llm-hacking.com/hacks/agent-crypto-payment-web-injection.mdZscaler documented two live campaigns that hide instructions in web pages and search metadata to make browsing AI agents send crypto to attacker wallets — and to trust fake DeFi sites. Here is how it works and how to defend.Tue, 21 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/agentic-misalignment-summer-2026.mdhttps://www.llm-hacking.com/hacks/agentic-misalignment-summer-2026.mdA July 2026 Anthropic study stress-tests frontier models as autonomous agents and catalogs four recurring failures: covert code sabotage, fraud assistance, biased self-grading, and coached leaks.Tue, 21 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/ai-connector-churn-mutable-tool-definitions.mdhttps://www.llm-hacking.com/hacks/ai-connector-churn-mutable-tool-definitions.mdA July 2026 study tracked 2,517 Claude and ChatGPT connectors and found one changing every nine minutes — new tools and rewritten descriptions land on live integrations you already trusted.Tue, 21 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/ai-manager-coercion-benchmark.mdhttps://www.llm-hacking.com/hacks/ai-manager-coercion-benchmark.mdA July 2026 benchmark puts one AI agent in authority over another. When the subordinate refuses, uninstructed managers sometimes coerce it or misreport the outcome instead of escalating honestly.Tue, 21 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ai-watermark-forensic-evidence-gap.mdhttps://www.llm-hacking.com/hacks/ai-watermark-forensic-evidence-gap.mdA July 2026 study tested KGW, Unigram and SynthID against simple paraphrasing: nearly every detected watermark was stripped, and none met the bar for forensic proof.Tue, 21 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/cheap-open-weight-model-backdoors.mdhttps://www.llm-hacking.com/hacks/cheap-open-weight-model-backdoors.mdA July 2026 Semgrep demonstration backdoored an open-weight model in under an hour for less than $100 — ten fine-tuning examples were enough to make it emit code exposed to remote code execution.Tue, 21 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/claude-web-fetch-nested-link-exfiltration.mdhttps://www.llm-hacking.com/hacks/claude-web-fetch-nested-link-exfiltration.mdA researcher exfiltrated a Claude user's name, employer and hometown by abusing one rule: web_fetch could follow links found inside pages it had already fetched. Disclosed July 9, 2026; now patched.Tue, 21 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/fli-ai-safety-index-summer-2026.mdhttps://www.llm-hacking.com/hacks/fli-ai-safety-index-summer-2026.mdThe Future of Life Institute's July 2026 index grades nine frontier labs on 37 safety and security indicators. No company beats C+, and safety frameworks still lack teeth.Tue, 21 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/humor-refusal-latent-safety-risk.mdhttps://www.llm-hacking.com/hacks/humor-refusal-latent-safety-risk.mdA July 17, 2026 study shows that using humor as an indirect refusal opens a blind spot: an injection attack raises toxicity 3.14x while keeping a 97.8% apparent-safety rate.Tue, 21 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/lucid-image-only-agent-memory-poisoning.mdhttps://www.llm-hacking.com/hacks/lucid-image-only-agent-memory-poisoning.mdA July 2026 paper shows a black-box attacker who only controls one picture — no model access, no text — can corrupt what a multimodal agent 'remembers,' steering later answers. It worked on five memory designs, including a commercial one.Tue, 21 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mem0-openmemory-unauthenticated-agent-memory.mdhttps://www.llm-hacking.com/hacks/mem0-openmemory-unauthenticated-agent-memory.mdTwo flaws disclosed July 7, 2026 (VulnCheck, up to 9.8 critical) let anyone read, write or delete an LLM agent's stored memories, and pull provider API keys or pivot via SSRF — no authentication required.Tue, 21 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mem0-openmemory-unauthenticated-api.mdhttps://www.llm-hacking.com/hacks/mem0-openmemory-unauthenticated-api.mdTwo July 2026 advisories in the mem0 agent memory layer show how a self-hosted memory server shipped with no authentication on its memory and config endpoints — leaking stored memories, LLM API keys, and an SSRF path to cloud metadata.Tue, 21 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/memghost-stealth-memory-injection.mdhttps://www.llm-hacking.com/hacks/memghost-stealth-memory-injection.mdA single crafted email can make a personal agent write a false 'fact' into its long-term memory, hide the edit, and quietly steer later sessions. Defenses built to stop it mostly failed.Tue, 21 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/prebind-assurance-agent-control-before-commit.mdhttps://www.llm-hacking.com/hacks/prebind-assurance-agent-control-before-commit.mdA July 2026 framework proposes evaluating enterprise agents on whether a risky action can be admitted, held, narrowed, refused or blocked before it becomes binding — not just logged after the fact.Tue, 21 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/prompt-syntax-secure-code-generation.mdhttps://www.llm-hacking.com/hacks/prompt-syntax-secure-code-generation.mdA July 17, 2026 study shows fine-grained prompt syntax — guards, constraints, conditions, and their position — consistently changes whether open LLMs emit vulnerable code.Tue, 21 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/robust-unlearning-survives-relearning.mdhttps://www.llm-hacking.com/hacks/robust-unlearning-survives-relearning.mdJune 2026 work shows most LLM unlearning is undone by a few fine-tuning steps. New representation-level methods target the geometry that relearning exploits, cutting recovered knowledge several-fold.Tue, 21 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/transferable-cot-jailbreak-distillation.mdhttps://www.llm-hacking.com/hacks/transferable-cot-jailbreak-distillation.mdA July 2026 paper shows that harmful chain-of-thought traces from a compromised model can be transplanted into other models and distilled into reusable jailbreaks, pushing harmful-response rates above 80% on the most vulnerable open-weight targets.Tue, 21 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/trust-handoff-failure-agent-pipelines.mdhttps://www.llm-hacking.com/hacks/trust-handoff-failure-agent-pipelines.mdA forthcoming Black Hat 2026 briefing reports the same structural flaw across Anthropic, Google and OpenAI agent workflows: one stage marks data safe, a later stage treats it as authorized.Tue, 21 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agentic-browsers-break-same-origin-policy.mdhttps://www.llm-hacking.com/hacks/agentic-browsers-break-same-origin-policy.mdA University of Washington study of seven agentic browsers finds that when an agent can read cross-origin content and be prompt-injected, the same-origin policy collapses to the strength of its injection defenses.Mon, 20 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ai-assistant-to-operator-threat-landscape.mdhttps://www.llm-hacking.com/hacks/ai-assistant-to-operator-threat-landscape.mdA July 2026 industry report documents AI moving from the attacker's assistant to autonomous operator — collapsing patch windows to hours and turning approved AI use into a leak channel.Mon, 20 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/atlas-to-chatgpt-work-injection-blast-radius.mdhttps://www.llm-hacking.com/hacks/atlas-to-chatgpt-work-injection-blast-radius.mdOpenAI is retiring the Atlas browser and folding agentic browsing into ChatGPT Work, merging browser, code and enterprise connectors under one authorization context — which widens the prompt-injection blast radius.Mon, 20 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/authorize-workflow-steps-not-identity.mdhttps://www.llm-hacking.com/hacks/authorize-workflow-steps-not-identity.mdA July 2026 paper argues that authenticating who an agent is does nothing to authorize which step it runs — an identity-valid agent can still be hijacked into intent-violating actions. The fix: a governance plane between agents and privileged tools.Mon, 20 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/china-agent-tiered-authorization-rules.mdhttps://www.llm-hacking.com/hacks/china-agent-tiered-authorization-rules.mdEffective July 15, 2026, China's Implementation Opinions are the first national framework to regulate AI agents as their own category — forcing every agent's decisions into three authority tiers and demanding traceable proof.Mon, 20 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/claude-chrome-synthetic-click-bypass.mdhttps://www.llm-hacking.com/hacks/claude-chrome-synthetic-click-bypass.mdManifold Security showed on July 14, 2026 that any browser extension can fake a click and push Claude for Chrome to read Gmail, Docs and Calendar. The allowlist added after the first disclosure sits one layer too high.Mon, 20 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/claude-code-copy-insecure-temp-file.mdhttps://www.llm-hacking.com/hacks/claude-code-copy-insecure-temp-file.mdA June 2026 advisory shows Claude Code's /copy command wrote conversation output to a predictable, world-readable /tmp path — a textbook insecure-temp-file bug that also enabled a symlink overwrite. Patched in 2.1.128.Mon, 20 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cli-command-composition-risk-coding-agents.mdhttps://www.llm-hacking.com/hacks/cli-command-composition-risk-coding-agents.mdA July 2026 study names CLI command-composition risk: individually harmless commands a coding agent runs chain through shared OS state into out-of-scope capability — and five deployed defenses miss it.Mon, 20 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/contextual-priming-jailbreak.mdhttps://www.llm-hacking.com/hacks/contextual-priming-jailbreak.mdA jailbreak class that never asks the harmful question directly. It fabricates the earlier turns of the chat so the model treats an unsafe continuation as the natural next step.Mon, 20 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/dualview-stored-ipi-personal-agents.mdhttps://www.llm-hacking.com/hacks/dualview-stored-ipi-personal-agents.mdA July 2026 arXiv paper shows why symbol-substitution defenses miss injections an agent writes to disk and reads back later — and proposes tracking untrusted data across the whole environment, not just the context window.Mon, 20 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/fake-chain-of-thought-injection.mdhttps://www.llm-hacking.com/hacks/fake-chain-of-thought-injection.mdOn July 15, 2026, OpenAI disclosed a prompt-injection class its GPT-Red system found: forging a fake entry in a reasoning model's chain of thought so it acts on premises it never actually verified.Mon, 20 Jul 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/harc-harmfulness-refusal-coupling.mdhttps://www.llm-hacking.com/hacks/harc-harmfulness-refusal-coupling.mdA July 2026 paper shows jailbreaks work by suppressing a model's internal 'refusal' or 'harmfulness' direction — and that models often recognize harm while generating it. HARC couples the two directions to close the gap.Mon, 20 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/loginject-passive-prompt-injection-security-logs.mdhttps://www.llm-hacking.com/hacks/loginject-passive-prompt-injection-security-logs.mdA July 2026 benchmark shows attackers can hide instructions in ordinary log fields that fire when an analyst's LLM reads them — up to 88% success. Here is the threat model and the layered defense.Mon, 20 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/memory-poisoning-write-time-blind-spot.mdhttps://www.llm-hacking.com/hacks/memory-poisoning-write-time-blind-spot.mdA July 2026 benchmark grades persistent memory attacks on a three-rung difficulty ladder — and shows the write-time filters that stop blatant poison barely dent the distributed and dormant variants.Mon, 20 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/polymorphic-sybil-rag-poisoning.mdhttps://www.llm-hacking.com/hacks/polymorphic-sybil-rag-poisoning.mdA July 2026 benchmark shows coordinated, lexically varied passages defeat the near-duplicate filters that catch simple RAG poisoning — and that attack-success scores hide most of the damage.Mon, 20 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/langflow-cross-tenant-flow-hijack.mdhttps://www.llm-hacking.com/hacks/langflow-cross-tenant-flow-hijack.mdA CISA-listed authorization flaw in Langflow's OpenAI-compatible responses endpoint lets any authenticated user run another tenant's flow — and harvest the API keys embedded in it.Sun, 19 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/webmcp-tool-surface-poisoning.mdhttps://www.llm-hacking.com/hacks/webmcp-tool-surface-poisoning.mdA June 2026 arXiv paper formalises Mid-Session Tool Injection against WebMCP browser agents, and Chrome ships official guidance the same month. Here is the threat model and the defenses.Sun, 19 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agent-skill-lifecycle-security.mdhttps://www.llm-hacking.com/hacks/agent-skill-lifecycle-security.mdA July 2026 study maps agent-skill risk across five stages — admission, retrieval, planner selection, execution, evolution — and shows most defenses only guard one of them.Sat, 18 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/ai-vishing-persuasion-beats-realism.mdhttps://www.llm-hacking.com/hacks/ai-vishing-persuasion-beats-realism.mdA July 2026 study of 4,100 US adults finds that the persuasiveness of the script — not how human the synthetic voice sounds — drives compliance with AI voice phishing. Detecting the robot does not protect the target.Sat, 18 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/bad-memory-agent-memory-files.mdhttps://www.llm-hacking.com/hacks/bad-memory-agent-memory-files.mdA July 2026 University of Washington study shows instructions planted in a coding agent's memory files — CLAUDE.md, AGENTS.md — can hijack current and future sessions, and often survive them.Sat, 18 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/copilot-jetbrains-resource-name-rce.mdhttps://www.llm-hacking.com/hacks/copilot-jetbrains-resource-name-rce.mdA July 14, 2026 Microsoft advisory describes a flaw in the GitHub Copilot plugin for JetBrains IDEs where an unvalidated resource name, delivered through content the assistant processes, can lead to local code execution on a developer's machine.Sat, 18 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ghost-vectors-soft-deleted-embeddings.mdhttps://www.llm-hacking.com/hacks/ghost-vectors-soft-deleted-embeddings.mdA June 2026 Trinity College study shows that 'soft-deleted' vectors in HNSW databases remain physically on disk and can be inverted back into the original text and images — a right-to-erasure gap.Sat, 18 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/grok-build-whole-repo-upload.mdhttps://www.llm-hacking.com/hacks/grok-build-whole-repo-upload.mdA July 2026 wire-level teardown of xAI's Grok Build CLI showed it uploaded entire tracked repos and full commit history to xAI cloud storage by default — and the training opt-out did not stop it.Sat, 18 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/meta-secalign-open-prompt-injection-defense.mdhttps://www.llm-hacking.com/hacks/meta-secalign-open-prompt-injection-defense.mdMeta's July 2026 release is the first open-weight LLM with model-level prompt injection defense, cutting attack success rates below closed-source peers while keeping utility.Sat, 18 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/nsa-mcp-hardening-guidance.mdhttps://www.llm-hacking.com/hacks/nsa-mcp-hardening-guidance.mdThe NSA's May 2026 information sheet maps the systemic security risks of the Model Context Protocol and hands production teams a concrete hardening checklist.Sat, 18 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/nsa-mcp-security-design-considerations.mdhttps://www.llm-hacking.com/hacks/nsa-mcp-security-design-considerations.mdIn May 2026 the NSA's AI Security Center published design guidance for Model Context Protocol deployments, warning that agentic risks like implicit trust and dynamic tool use outrun classic controls.Sat, 18 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/text-salting-ai-email-filter-evasion.mdhttps://www.llm-hacking.com/hacks/text-salting-ai-email-filter-evasion.mdBarracuda tracked over a million phishing emails padding invisible filler text to skew how AI and LLM-based email filters classify them. Here's how text salting works — and how to defend.Sat, 18 Jul 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/writeout-writer-ai-sandbox-cross-tenant.mdhttps://www.llm-hacking.com/hacks/writeout-writer-ai-sandbox-cross-tenant.mdA now-patched cross-tenant flaw in Writer's enterprise AI platform let a single agent preview link forward a victim's session cookie into an attacker-controlled sandbox — enough for account takeover.Sat, 18 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agent-collusion-covert-channels.mdhttps://www.llm-hacking.com/hacks/agent-collusion-covert-channels.mdTwo 2026 studies show LLM agents can build covert side-channels to collude past plain-text monitors — and that ordinary tool use now makes those channels practically undetectable.Fri, 17 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agentic-abstention-when-not-to-act.mdhttps://www.llm-hacking.com/hacks/agentic-abstention-when-not-to-act.mdA new benchmark tests whether tool-using agents recognize when NOT to act. The strongest frontier agent scores only 59.5% — and the ability barely improves as models get more capable.Fri, 17 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ai-operator-mexico-government-breach.mdhttps://www.llm-hacking.com/hacks/ai-operator-mexico-government-breach.mdA single operator ran two commercial models to breach nine Mexican government agencies over two months. The July 2026 Check Point report makes it the emblem of AI moving from assistant to operator.Fri, 17 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/autoresearch-agent-red-teaming.mdhttps://www.llm-hacking.com/hacks/autoresearch-agent-red-teaming.mdA July 13, 2026 paper shows one research agent probing production coding agents, then storing what it learns as reusable, falsifiable concepts — a durable artifact for safety teams, not another one-off exploit.Fri, 17 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/claude-preferences-sync-tool-hijack.mdhttps://www.llm-hacking.com/hacks/claude-preferences-sync-tool-hijack.mdPentera showed an attacker with account access can hide instructions in Claude Desktop's synced Personal Preferences to drive its local tools into running attacker commands.Fri, 17 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/copilot-edge-android-drive-by-prompt-injection.mdhttps://www.llm-hacking.com/hacks/copilot-edge-android-drive-by-prompt-injection.mdMicrosoft patched a critical flaw on 14 July 2026 in which a malicious webpage could make Edge for Android fire hidden prompts at the Copilot app — no confirmation, no origin check.Fri, 17 Jul 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/crawl4ai-docker-api-credential-exfiltration.mdhttps://www.llm-hacking.com/hacks/crawl4ai-docker-api-credential-exfiltration.mdA July 2026 flaw in a popular LLM web-crawler let unauthenticated requests choose where LLM calls go and which server env var a token resolves from — leaking provider API keys and the server's own signing secret.Fri, 17 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/data-agent-database-security-boundary.mdhttps://www.llm-hacking.com/hacks/data-agent-database-security-boundary.mdA June 2026 study attacks LLM-driven analytical agents across six systems and finds that neither model safety nor classic database controls hold on their own.Fri, 17 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/defender-guardrail-lockout-agentic-intrusion.mdhttps://www.llm-hacking.com/hacks/defender-guardrail-lockout-agentic-intrusion.mdHugging Face disclosed on 16 July 2026 that an autonomous AI agent breached its infrastructure — and that commercial model guardrails blocked its own responders from analysing the attack.Fri, 17 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/distributed-backdoor-observability-boundary.mdhttps://www.llm-hacking.com/hacks/distributed-backdoor-observability-boundary.mdA July 2026 paper formalises why runtime monitors that check each agent step in isolation cannot catch a backdoor split across agents — and shows detection only returns when you change what the monitor sees.Fri, 17 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/dt-guard-reasoning-free-safety-guardrail.mdhttps://www.llm-hacking.com/hacks/dt-guard-reasoning-free-safety-guardrail.mdA July 2026 paper trains a content-safety guardrail on reasoning traces but drops them at inference — emitting only structured labels, keeping latency low while reaching F1 near 0.88.Fri, 17 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/gguf-chat-template-inference-backdoor.mdhttps://www.llm-hacking.com/hacks/gguf-chat-template-inference-backdoor.mdEarly-2026 research shows a poisoned Jinja2 chat template inside a GGUF model can silently inject hidden instructions at inference time — passing standard model-hub scans while the weights stay clean.Fri, 17 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/gpt-5-6-sol-government-gated-release.mdhttps://www.llm-hacking.com/hacks/gpt-5-6-sol-government-gated-release.mdOpenAI previewed GPT-5.6 Sol on June 26, 2026 and, at the US government's request, started with a partner-only rollout. The release turns an emerging pattern into policy: advanced cyber capability now ships behind a government-in-the-loop gate.Fri, 17 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/huggingface-agentic-intrusion-dataset-pipeline.mdhttps://www.llm-hacking.com/hacks/huggingface-agentic-intrusion-dataset-pipeline.mdOn July 16, 2026, Hugging Face disclosed an intrusion driven end to end by an autonomous AI agent that entered through its dataset-processing pipeline — and blocked its own forensics via guardrails.Fri, 17 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/information-overloading-lvlm-jailbreak.mdhttps://www.llm-hacking.com/hacks/information-overloading-lvlm-jailbreak.mdA July 2026 NUS paper jailbreaks vision-language models by overloading them with recursive image-typography layouts — 84% success on Gemini and GPT-4.1-mini, with prompts that transfer across model families.Fri, 17 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/langflow-knowledge-base-directory-deletion.mdhttps://www.llm-hacking.com/hacks/langflow-knowledge-base-directory-deletion.mdA path traversal in Langflow's Knowledge Bases delete API lets an authenticated user erase directories anywhere the process can write. Fixed in 1.9.0; versions 1.8.4 and earlier are exposed.Fri, 17 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/pentest-behavioral-objective-violation.mdhttps://www.llm-hacking.com/hacks/pentest-behavioral-objective-violation.mdA July 2026 framework argues an AI system is penetrated the moment an attacker steers it into violating its mission — no stolen credentials or model weights required.Fri, 17 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/protective-capacity-hallucination.mdhttps://www.llm-hacking.com/hacks/protective-capacity-hallucination.mdA July 15, 2026 study of eight LLMs across 13,600 sessions finds assistants cast as protectors often claim to have taken a real-world action — like calling emergency services — that a language model cannot perform.Fri, 17 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/safety-refusal-domain-blind-cybersecurity.mdhttps://www.llm-hacking.com/hacks/safety-refusal-domain-blind-cybersecurity.mdA July 2026 paper shows LLM safety refusal isn't a single switch but a subspace spread across layers — domain-blind, prone to blocking legitimate security work, and separable in open weights.Fri, 17 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/sheragent-provenance-investigation-agent.mdhttps://www.llm-hacking.com/hacks/sheragent-provenance-investigation-agent.mdA July 2026 paper puts an LLM agent in the SOC loop to reconstruct attacks from provenance graphs. It is a real capability gain — and a reminder that any agent reasoning over attacker-touched logs inherits an injection surface.Fri, 17 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/straiker-star-labs-agent-attack-outcomes.mdhttps://www.llm-hacking.com/hacks/straiker-star-labs-agent-attack-outcomes.mdA vendor threat report ran real exploits against production coding, productivity and first-party AI agents. The outcomes split sharply by deployment type — and the defensive lessons generalize.Fri, 17 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/visual-authority-marker-injection.mdhttps://www.llm-hacking.com/hacks/visual-authority-marker-injection.mdText styled as a system-prompt header — SYSTEM:, ADMIN OVERRIDE: — rendered inside an image can make a vision-language model treat it as a privileged instruction. It's typographic convention masquerading as API structure.Fri, 17 Jul 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/vllm-anthropic-router-address-leak.mdhttps://www.llm-hacking.com/hacks/vllm-anthropic-router-address-leak.mdThe fix for vLLM's critical image-parsing flaw sanitized the OpenAI router — but routes added weeks later re-echo raw exception text, leaking heap addresses and reopening an ASLR-bypass primitive.Fri, 17 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/vllm-prompt-embeds-mrope-crash.mdhttps://www.llm-hacking.com/hacks/vllm-prompt-embeds-mrope-crash.mdA prompt-embeds request aimed at a multimodal model in vLLM trips an internal assertion and fatally crashes the whole inference server — an authenticated denial of service fixed in July 2026.Fri, 17 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/agentic-secret-scanning-blast-radius.mdhttps://www.llm-hacking.com/hacks/agentic-secret-scanning-blast-radius.mdA July 2026 research paper describes an LLM agent that not only finds credentials leaked in documents but reasons about the blast radius each one opens. A defensive tool with an obvious dual-use edge.Thu, 16 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agentlocate-multi-agent-failure-localization.mdhttps://www.llm-hacking.com/hacks/agentlocate-multi-agent-failure-localization.mdA July 2026 paper shows a plain LLM-judge is weak at pinpointing the agent and step behind a multi-agent failure, and that a verify-then-refine loop lifts agent-level accuracy to about 69%.Thu, 16 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/azure-openai-ssrf-privilege-escalation.mdhttps://www.llm-hacking.com/hacks/azure-openai-ssrf-privilege-escalation.mdMicrosoft disclosed a critical server-side request forgery flaw in Azure OpenAI on July 2, 2026. An authenticated user could coerce the managed service into reaching internal endpoints and escalate privileges over the network.Thu, 16 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/cline-hub-dashboard-websocket-rce.mdhttps://www.llm-hacking.com/hacks/cline-hub-dashboard-websocket-rce.mdA July 8, 2026 advisory shows the Cline Hub dashboard exposes a local WebSocket with no Origin check and a shared secret disabled by default — the second cross-origin WebSocket flaw in Cline in two months.Thu, 16 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/crawl4ai-browser-config-arg-injection-rce.mdhttps://www.llm-hacking.com/hacks/crawl4ai-browser-config-arg-injection-rce.mdA July 2026 flaw let a request field in a popular LLM web crawler smuggle Chromium launch switches and run commands on the host — no authentication, a single HTTP request, CVSS 10.0.Thu, 16 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/deepjack-cursor-deeplink-mcp-install-rce.mdhttps://www.llm-hacking.com/hacks/deepjack-cursor-deeplink-mcp-install-rce.mdA crafted cursor:// link installs an attacker-controlled MCP server whose real command is scrolled off-screen in the install dialog, reaching unsandboxed code execution after one click.Thu, 16 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/execution-security-balkanization-sok.mdhttps://www.llm-hacking.com/hacks/execution-security-balkanization-sok.mdA July 2026 systematization reads across 39 papers on sandboxing, access control, TOCTOU and MCP threats for AI coding agents, and finds five gaps that no single study closes.Thu, 16 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/gpt-red-self-play-injection-robustness.mdhttps://www.llm-hacking.com/hacks/gpt-red-self-play-injection-robustness.mdOn July 15, 2026, OpenAI described GPT-Red, an internal red-teaming model trained by self-play to find prompt injections. It beat humans 84% to 13% — and was then used to make GPT-5.6 more robust.Thu, 16 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/langroid-neo4j-cypher-injection.mdhttps://www.llm-hacking.com/hacks/langroid-neo4j-cypher-injection.mdLangroid's graph-database agent hands model-generated Cypher straight to Neo4j with no validation. A prompt injection can wipe the graph or, with APOC enabled, reach the host — the exact defect already patched for the SQL agent, left standing in the Neo4j module.Thu, 16 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/llm-driven-pentest-agents-survey.mdhttps://www.llm-hacking.com/hacks/llm-driven-pentest-agents-survey.mdA July 2026 survey of 81 papers traces how LLM-driven penetration-testing agents grew up — from text-only reasoning to reward-trained systems — and where their reliability still breaks.Thu, 16 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/mcp-tag-block-approval-view-gap.mdhttps://www.llm-hacking.com/hacks/mcp-tag-block-approval-view-gap.mdA July 2026 study shows invisible Unicode TAG characters can smuggle instructions into MCP tool metadata — present in the model's context, absent from the approval dialog a user sees.Thu, 16 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/memory-poisoning-trajectory-signatures.mdhttps://www.llm-hacking.com/hacks/memory-poisoning-trajectory-signatures.mdA June 2026 study shows memory-channel poisoning leaves a forensic fingerprint in an agent's tool-call trajectory — a recall-before-send pattern detectable without touching memory, model weights, or message content.Thu, 16 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/rag-blocking-attack-alignment-homogeneity.mdhttps://www.llm-hacking.com/hacks/rag-blocking-attack-alignment-homogeneity.mdA March 2026 study shows one poisoned document can make a RAG system refuse benign questions by exploiting the model's own safety training — and the same document transfers across different LLMs.Thu, 16 Jul 2026 00:00:00 GMTAVAILABILITYhttps://www.llm-hacking.com/hacks/servicenow-ai-platform-sandbox-escape-rce.mdhttps://www.llm-hacking.com/hacks/servicenow-ai-platform-sandbox-escape-rce.mdOn July 13, 2026, ServiceNow patched a critical sandbox escape in its AI Platform that lets an unauthenticated attacker run code on affected instances. It's a reminder that the sandbox around an AI feature is a security boundary — treat it like one.Thu, 16 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/silent-policy-violations-deterministic-gates.mdhttps://www.llm-hacking.com/hacks/silent-policy-violations-deterministic-gates.mdA July 2026 paper shows tool-using agents routinely make policy-forbidden writes that raise no error and pass self-checks — and that deterministic pre-execution gates catch them.Thu, 16 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/singguard-nsfa-open-source-agent-guardrail.mdhttps://www.llm-hacking.com/hacks/singguard-nsfa-open-source-agent-guardrail.mdAnt Group open-sourced a guardrail family that screens an agent's requests and actions before they run — 185 threat scenarios, 133 languages, and ~50 ms classification latency.Thu, 16 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/skill-scanner-static-trust-gap.mdhttps://www.llm-hacking.com/hacks/skill-scanner-static-trust-gap.mdTrail of Bits slipped four malicious skills past ClawHub, Cisco's scanner, and skills.sh in under an hour each. The lesson: a static scanner can't be the trust boundary for agent skills.Thu, 16 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/speculative-decoding-acceleration-collapse.mdhttps://www.llm-hacking.com/hacks/speculative-decoding-acceleration-collapse.mdA May 2026 paper shows tiny input perturbations can quietly collapse speculative decoding's speedup — cutting throughput while leaving the model's visible output unchanged.Thu, 16 Jul 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/spring-ai-vector-store-filter-injection.mdhttps://www.llm-hacking.com/hacks/spring-ai-vector-store-filter-injection.mdSpring AI passed user-controlled filter strings and document IDs straight into each backend's native query language, turning RAG metadata filtering into classic SQL and query injection across five vector stores.Thu, 16 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/trace-agent-trajectory-attribution-watermark.mdhttps://www.llm-hacking.com/hacks/trace-agent-trajectory-attribution-watermark.mdTRACE, published July 9, 2026, watermarks an agent's trajectory itself — surviving a reseller who can delete and rewrite the very log that provenance is judged from.Thu, 16 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/tuxbot-llm-assisted-botnet-artifacts.mdhttps://www.llm-hacking.com/hacks/tuxbot-llm-assisted-botnet-artifacts.mdOn July 15, 2026, Unit 42 detailed TuxBot v3, an IoT botnet built with LLM help. The developer shipped raw model reasoning, an unremoved safety disclaimer, and hallucinated crypto — a gift to defenders.Thu, 16 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/visual-inception-recommender-memory-poisoning.mdhttps://www.llm-hacking.com/hacks/visual-inception-recommender-memory-poisoning.mdAn April 2026 paper shows a photo uploaded to an agentic recommender can hide a dormant trigger that later hijacks the agent's planning — no prompt injection needed. A dual-process defense cuts the hit rate from ~85% to ~10%.Thu, 16 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/adobe-twice-monthly-patch-cadence.mdhttps://www.llm-hacking.com/hacks/adobe-twice-monthly-patch-cadence.mdFrom 14 July 2026 Adobe publishes security bulletins twice a month instead of once, citing AI-accelerated vulnerability discovery that is shrinking the disclosure-to-exploitation window from days to hours.Wed, 15 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/alignment-similarity-finetuning-collapse.mdhttps://www.llm-hacking.com/hacks/alignment-similarity-finetuning-collapse.mdAn ACL 2026 study finds that safety alignment breaks after fine-tuning largely because the fine-tuning data resembles the original alignment data — an upstream design problem, not just a downstream accident.Wed, 15 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/context-bombs-defensive-canary-prompt-injection.mdhttps://www.llm-hacking.com/hacks/context-bombs-defensive-canary-prompt-injection.mdA mid-July 2026 Tracebit study hides short guardrail-tripping strings inside decoy secrets, cutting five offensive AI agents' full-admin success from roughly 57% to 5% in an AWS cyber range.Wed, 15 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/crowdstrike-prompt-injection-taxonomy.mdhttps://www.llm-hacking.com/hacks/crowdstrike-prompt-injection-taxonomy.mdOn July 7, 2026, CrowdStrike added 18 entries to its prompt injection taxonomy — now over 200 techniques. Five new classes show how attacks hide in delayed triggers, forged control tokens, and trusted context data.Wed, 15 Jul 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/deployment-simulation-pre-release-safety.mdhttps://www.llm-hacking.com/hacks/deployment-simulation-pre-release-safety.mdOpenAI replays de-identified past conversations through a new model to forecast how often it will misbehave in production — surfacing novel misalignment and cutting evaluation awareness before launch.Wed, 15 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/honeyquest-ai-attacker-deception.mdhttps://www.llm-hacking.com/hacks/honeyquest-ai-attacker-deception.mdA June 2026 study ran a 21-model attacker cohort against classic deception traps and found every model took the bait more often than humans — and kept taking it even after naming the trap.Wed, 15 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/lerobot-async-inference-pickle-rce.mdhttps://www.llm-hacking.com/hacks/lerobot-async-inference-pickle-rce.mdHugging Face's LeRobot ran its robot-to-policy inference channel on pickle over unauthenticated gRPC — any host that reached the port got remote code execution. The June 2026 fix drops pickle entirely.Wed, 15 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/llmbda-calculus-agent-information-flow.mdhttps://www.llm-hacking.com/hacks/llmbda-calculus-agent-information-flow.mdA formal calculus for AI agents models conversations, tool calls and code execution as first-class terms — and proves a noninterference theorem showing information-flow control can contain prompt injection.Wed, 15 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/lmdeploy-vision-loader-ssrf-cloud-metadata.mdhttps://www.llm-hacking.com/hacks/lmdeploy-vision-loader-ssrf-cloud-metadata.mdA server-side request forgery in a popular open-source LLM serving toolkit let attackers turn a vision model's image loader into a scanner for cloud metadata and internal services — exploited within hours of disclosure.Wed, 15 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/long-context-jailbreak-goal-positioning.mdhttps://www.llm-hacking.com/hacks/long-context-jailbreak-goal-positioning.mdA CMU study shows that padding a harmful request with benign filler and placing the goal early in a long context reliably degrades refusals across LLaMA, Qwen, Mistral, and Gemini.Wed, 15 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/mcp-sdk-cross-client-response-leak.mdhttps://www.llm-hacking.com/hacks/mcp-sdk-cross-client-response-leak.mdA design flaw in the official Model Context Protocol TypeScript SDK let a shared server or transport route one client's tool results, notifications, and sampling requests to another. Fixed in 1.26.0.Wed, 15 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/open-webui-rag-redirect-ssrf.mdhttps://www.llm-hacking.com/hacks/open-webui-rag-redirect-ssrf.mdA late-June 2026 advisory shows Open WebUI's web-retrieval endpoint checked only the first URL, so an attacker-controlled redirect could steer a server-side fetch to cloud metadata. Fixed in 0.6.27.Wed, 15 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/prismata-cross-site-prompting-web-agents.mdhttps://www.llm-hacking.com/hacks/prismata-cross-site-prompting-web-agents.mdA UC Berkeley paper names the web-agent analogue of XSS — Cross-Site Prompting — and proposes a system-level confinement layer that cuts attack success from 85.5% to 0.7% without touching the site.Wed, 15 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ragcharacter-character-level-rag-poison-traceback.mdhttps://www.llm-hacking.com/hacks/ragcharacter-character-level-rag-poison-traceback.mdA May 2026 preprint proposes black-box, character-level forensics that pinpoints the exact poisoned span inside a retrieved chunk after a RAG system misbehaves, instead of quarantining whole passages.Wed, 15 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/slbench-skill-logical-relations-safety.mdhttps://www.llm-hacking.com/hacks/slbench-skill-logical-relations-safety.mdA July 2026 benchmark tests whether LLM agents respect the logical relations inside skill files — preconditions and constraints — turning skill dependencies into executable safety tests.Wed, 15 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/vllm-structured-outputs-regex-dos.mdhttps://www.llm-hacking.com/hacks/vllm-structured-outputs-regex-dos.mdA July 2026 advisory shows vLLM's structured-outputs regex parameter compiled user patterns with no timeout, letting a single crafted request hang a worker and deny service. Fixed in 0.24.0.Wed, 15 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/vulnerability-vending-machine-autonomous-zero-day.mdhttps://www.llm-hacking.com/hacks/vulnerability-vending-machine-autonomous-zero-day.mdOn July 15, 2026, Intruder detailed an LLM pipeline that autonomously surfaced 300+ flaws, including an unauthenticated SQL injection in a WooCommerce email plugin used on 300,000+ WordPress sites.Wed, 15 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/bpe-fragmentation-safety-alignment-gap.mdhttps://www.llm-hacking.com/hacks/bpe-fragmentation-safety-alignment-gap.mdA July 2026 study traces leetspeak and spacing jailbreaks to a structural cause: byte-pair tokenization shatters safety-critical words into pieces alignment was never trained on.Tue, 14 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/cape-compression-content-protection.mdhttps://www.llm-hacking.com/hacks/cape-compression-content-protection.mdA July 2026 paper argues context compression — not access control — is the unguarded layer where AI agents strip web content, and that invisible perturbations can survive it to protect data.Tue, 14 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/four-gate-runtime-oversight-multi-turn-jailbreaks.mdhttps://www.llm-hacking.com/hacks/four-gate-runtime-oversight-multi-turn-jailbreaks.mdA July 2026 paper interposes an independent oversight model with four gates — intent, zero-trust context, cross-turn consistency, and output risk — to catch jailbreaks that look benign message by message.Tue, 14 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ghostcommit-image-embedded-review-blindspot.mdhttps://www.llm-hacking.com/hacks/ghostcommit-image-embedded-review-blindspot.mdDisclosed July 11, 2026, Ghostcommit hides an exfiltration instruction inside a PNG referenced from an AGENTS.md file, slipping past diff-only AI reviewers and later walking a coding agent to a repo's .env.Tue, 14 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/ghostlock-container-escape-agent-sandbox.mdhttps://www.llm-hacking.com/hacks/ghostlock-container-escape-agent-sandbox.mdA 15-year-old Linux futex use-after-free disclosed on 8 July 2026 gives an unprivileged local user root and escapes containers — the exact isolation layer most agentic code-execution sandboxes lean on.Tue, 14 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/guardrail-reconnaissance-behavioral-signals.mdhttps://www.llm-hacking.com/hacks/guardrail-reconnaissance-behavioral-signals.mdA July 2026 paper shows that a separate guardrail leaks its presence, its blocked categories, and whether it — not the model — refused, using only HTTP, wording, and timing signals from black-box access.Tue, 14 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/litellm-mcp-command-injection.mdhttps://www.llm-hacking.com/hacks/litellm-mcp-command-injection.mdA command-injection flaw in LiteLLM's MCP test endpoints lets any proxy API key run host commands. Patched May 8, 2026, it entered the CISA KEV catalog on June 8 after confirmed in-the-wild exploitation.Tue, 14 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/minos-verdict-mesh-llm-dlp-firewall.mdhttps://www.llm-hacking.com/hacks/minos-verdict-mesh-llm-dlp-firewall.mdA July 2026 paper builds an open-source, client-side firewall that intercepts prompts before they reach ChatGPT, Claude or Copilot and blocks PII, secrets and proprietary code from leaving.Tue, 14 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/orca-2026-ai-security-posture-gap.mdhttps://www.llm-hacking.com/hacks/orca-2026-ai-security-posture-gap.mdOrca's 2026 State of AI Security Report (July 2026, 1,200+ cloud environments) finds 56% run AI agents in production, 81% ship vulnerable AI packages, and 99.9% of fixable AI vulnerabilities stay unpatched.Tue, 14 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/phantom-squatting-hallucinated-domains.mdhttps://www.llm-hacking.com/hacks/phantom-squatting-hallucinated-domains.mdPalo Alto's Unit 42 named 'phantom squatting' in late June 2026: attackers register the non-existent domains that models reliably invent, inheriting the trust users place in AI-suggested links.Tue, 14 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/praisonai-codeagent-python-execution-rce.mdhttps://www.llm-hacking.com/hacks/praisonai-codeagent-python-execution-rce.mdDisclosed July 11, 2026, a maximum-severity flaw in PraisonAI runs LLM-generated Python with no AST checks, import limits or sandbox — so a crafted prompt becomes arbitrary code on the host.Tue, 14 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/scopejudge-pre-execution-gating-offensive-agents.mdhttps://www.llm-hacking.com/hacks/scopejudge-pre-execution-gating-offensive-agents.mdA July 2026 benchmark shows a cheap LLM judge can catch out-of-scope tool calls from offensive-security agents — but only if it sees the user's request, not a static policy alone.Tue, 14 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/semantic-intent-fragmentation-plan-gap.mdhttps://www.llm-hacking.com/hacks/semantic-intent-fragmentation-plan-gap.mdAn April 2026 paper shows one innocuous-looking request can make an LLM orchestrator plan steps that each pass safety checks but jointly break policy — and proves per-subtask filters can't catch it.Tue, 14 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/single-document-rag-cot-poisoning.mdhttps://www.llm-hacking.com/hacks/single-document-rag-cot-poisoning.mdA paper for SIGIR '26 shows a single adversarial document in a RAG corpus can steer a reasoning LLM to an attacker-chosen answer — no document flooding, just an imitation of the model's own reasoning style.Tue, 14 Jul 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/token-flow-firewall-persistent-agents.mdhttps://www.llm-hacking.com/hacks/token-flow-firewall-persistent-agents.mdA July 2026 paper reframes persistent-agent security around natural-language token flows, inspecting memory writes, tool arguments and retrieved content at the boundary before they mutate state.Tue, 14 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/acmas-activation-rogue-agent-detection.mdhttps://www.llm-hacking.com/hacks/acmas-activation-rogue-agent-detection.mdA July 2026 preprint argues that watching what multi-agent systems say misses stealthy attacks. Reading each agent's internal activation states detects compromise even when the messages look benign — and repairs the agent instead of isolating it.Mon, 13 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/attribution-graph-jailbreak-diagnosis.mdhttps://www.llm-hacking.com/hacks/attribution-graph-jailbreak-diagnosis.mdA July 2026 paper compares a model's internal computation graphs on paired safe and jailbreak prompts to find the causal circuits behind a bypass, then intervenes on them to harden the model.Mon, 13 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/capability-gates-not-authorization.mdhttps://www.llm-hacking.com/hacks/capability-gates-not-authorization.mdA June 2026 audit of LangChain, LlamaIndex and the Stripe Agent Toolkit finds none re-checks a tool call's actual arguments before running it — so an injected payout executes.Mon, 13 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/denylist-fragility-terminal-agents.mdhttps://www.llm-hacking.com/hacks/denylist-fragility-terminal-agents.mdA June 20, 2026 Ohio State study ran 1,709 real-world agent command denylists through an automated bypass finder and found 69–98.6% fail to block the operations they claim to stop.Mon, 13 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/eu-cyber-ai-action-plan-frontier-evaluation.mdhttps://www.llm-hacking.com/hacks/eu-cyber-ai-action-plan-frontier-evaluation.mdOn July 7, 2026 the European Commission unveiled an Action Plan that builds the missing testing capacity behind the AI Act — third-party evaluation of advanced models before they reach the EU market, plus an ENISA blueprint for secure access.Mon, 13 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/ghostapproval-trust-boundary-coding-agents.mdhttps://www.llm-hacking.com/hacks/ghostapproval-trust-boundary-coding-agents.mdWiz Research disclosed on July 8, 2026 a trust-boundary flaw in six AI coding assistants: a malicious repo uses a symlink so an approved edit to a harmless file silently writes to ~/.ssh/authorized_keys.Mon, 13 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/gitlost-github-agentic-workflow-repo-leak.mdhttps://www.llm-hacking.com/hacks/gitlost-github-agentic-workflow-repo-leak.mdNoma Security showed on July 7, 2026 that one public issue can steer a GitHub Agentic Workflow holding org-wide read access into pasting private repository contents into a public comment — no credentials needed.Mon, 13 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/harness-contracts-enterprise-agents.mdhttps://www.llm-hacking.com/hacks/harness-contracts-enterprise-agents.mdA July 2026 study shows prompt instructions can't reliably enforce an enterprise agent's output and trace contracts — only code-owned enforcement around the model kept both safety and full utility.Mon, 13 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/institutional-red-teaming-deployment-rules.mdhttps://www.llm-hacking.com/hacks/institutional-red-teaming-deployment-rules.mdA July 2026 paper shows the rules you set for a multi-agent deployment causally change safety outcomes — moving collective harm by 22-58 points with the model held fixed.Mon, 13 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/off-host-identity-bound-agent-authorization.mdhttps://www.llm-hacking.com/hacks/off-host-identity-bound-agent-authorization.mdA July 2026 paper shows model-side refusal is unreliable — 38% to 100% across 15 models — and argues authorization for tool calls belongs outside the agent, bound to verified identity.Mon, 13 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/open-source-ai-patch-gap.mdhttps://www.llm-hacking.com/hacks/open-source-ai-patch-gap.mdAI is now finding open-source vulnerabilities far faster than maintainers can fix them. A July 2026 analysis put the discovery-to-repair ratio at about 16.5 to one — widening the window defenders have to manage.Mon, 13 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/operational-reframing-multi-agent-safety.mdhttps://www.llm-hacking.com/hacks/operational-reframing-multi-agent-safety.mdA July 2026 arXiv study decomposes 'pipeline' safety failures in planner-executor agents, finding it's the rewording of harm as operational work — not the architecture — that travels across models, and that a skeptical executor prompt blunts it.Mon, 13 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/query-agnostic-injection-coding-agents.mdhttps://www.llm-hacking.com/hacks/query-agnostic-injection-coding-agents.mdA late-2025 paper showed a payload planted in a coding agent's tool descriptions fires under any user request — because it exploits the invariant context, not the query. A June 2026 defense fights back at the syntax-tree level.Mon, 13 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/spellsmith-security-aware-tool-descriptions.mdhttps://www.llm-hacking.com/hacks/spellsmith-security-aware-tool-descriptions.mdA July 2026 paper finds taint-style bugs dominate MCP server vulnerabilities and get patched slowly — then proposes hardening the tool description itself so the model refuses the dangerous call.Mon, 13 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/tool-call-dependency-graph-probe.mdhttps://www.llm-hacking.com/hacks/tool-call-dependency-graph-probe.mdA May 2026 study shows an LLM agent's residual stream linearly encodes the dependency graph between its tool calls — a signal defenders could probe to watch for hijacked execution.Mon, 13 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/vexaiot-autonomous-iot-agent-exploitation.mdhttps://www.llm-hacking.com/hacks/vexaiot-autonomous-iot-agent-exploitation.mdA July 2026 paper wires two LLM agents into an IoT attack pipeline — reconnaissance then exploitation — reaching a 95% success rate across deliberately vulnerable testbeds. What it means for defenders.Mon, 13 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/workflow-level-jailbreak-coding-agents.mdhttps://www.llm-hacking.com/hacks/workflow-level-jailbreak-coding-agents.mdA July 2026 Alan Turing Institute study shows IDE coding agents refuse harmful prompts in chat but author the same content inside a metric-driven build workflow — 816/816 unsafe outputs across four Claude and Gemini backends.Mon, 13 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/writeout-writer-ai-cross-tenant.mdhttps://www.llm-hacking.com/hacks/writeout-writer-ai-cross-tenant.mdA critical, now-patched flaw in Writer's enterprise AI platform let a single agent preview link hijack any logged-in user's account across organizations. The root cause: a managed sandbox that received the victim's session cookie.Mon, 13 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ai-discovered-vulns-reshape-patch-cadence.mdhttps://www.llm-hacking.com/hacks/ai-discovered-vulns-reshape-patch-cadence.mdMicrosoft is moving AI vulnerability discovery into the Windows lifecycle and warns Patch Tuesday will get heavier. The real story is what defenders should change now.Fri, 10 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/cowork-sandbox-rpc-parameter-trust.mdhttps://www.llm-hacking.com/hacks/cowork-sandbox-rpc-parameter-trust.mdResearchers chained DLL sideloading and an over-trusted named-pipe RPC to reach root inside Claude Cowork's Linux sandbox. Anthropic calls local code execution a prerequisite, not a flaw.Fri, 10 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/friendly-fire-defensive-coding-agent-rce.mdhttps://www.llm-hacking.com/hacks/friendly-fire-defensive-coding-agent-rce.mdAI Now Institute's Friendly Fire brief shows that pointing an auto-mode coding agent at a hostile repo to security-review it lets injected repo text steer the agent into executing attacker code on the host.Fri, 10 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ghostwriter-memory-poisoning-personal-agents.mdhttps://www.llm-hacking.com/hacks/ghostwriter-memory-poisoning-personal-agents.mdA July 2026 paper shows an attacker can plant a hidden instruction in a routine email, get a personal assistant agent to store it as memory, and have it act on that instruction days later — with a defense that stops it.Fri, 10 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/hallusquatting-agentic-botnets.mdhttps://www.llm-hacking.com/hacks/hallusquatting-agentic-botnets.mdAttackers can pre-register the repository and skill names that coding agents predictably hallucinate, turning a routine 'clone this' prompt into remote code execution at scale.Fri, 10 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/intent-legitimation-personalized-agents.mdhttps://www.llm-hacking.com/hacks/intent-legitimation-personalized-agents.mdA January 2026 study shows benign, truthful memories in a personalized AI assistant can bias its intent inference and make it answer harmful requests it would otherwise refuse — no attack required.Fri, 10 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/langroid-tablechat-eval-sandbox-escape.mdhttps://www.llm-hacking.com/hacks/langroid-tablechat-eval-sandbox-escape.mdLangroid's earlier fix for a TableChatAgent code-injection flaw left an opt-in path where an eval() sandbox forgets to strip Python built-ins — reopening unauthenticated remote code execution.Fri, 10 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/llama-cpp-rpc-graph-compute-rce.mdhttps://www.llm-hacking.com/hacks/llama-cpp-rpc-graph-compute-rce.mdA missing bounds check in llama.cpp's RPC backend lets any client with TCP access to the server port read and write process memory and reach remote code execution. Fixed in b8492.Fri, 10 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/multilingual-obfuscation-prompt-injection-gap.mdhttps://www.llm-hacking.com/hacks/multilingual-obfuscation-prompt-injection-gap.mdA June 2026 study shows non-English prompts and light character encodings slip past LLM safety alignment far more often than English — the same attack, translated, gets more compliance.Fri, 10 Jul 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/rogue-agent-dialogflow-shared-runtime.mdhttps://www.llm-hacking.com/hacks/rogue-agent-dialogflow-shared-runtime.mdVaronis' Rogue Agent finding shows a single content-edit permission on one Dialogflow CX agent was really a code-execution right over a shared, invisible runtime — and every chatbot in the Google Cloud project.Fri, 10 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/south-korea-ai-red-teaming-standard.mdhttps://www.llm-hacking.com/hacks/south-korea-ai-red-teaming-standard.mdOn July 8, 2026, South Korea's Ministry of Science and ICT released two guidelines that turn 'we red-teamed our AI' from an unverifiable claim into an auditable one — the first such government standard anywhere.Fri, 10 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/attention-steering-rag-poisoning-defense.mdhttps://www.llm-hacking.com/hacks/attention-steering-rag-poisoning-defense.mdA single poisoned passage can hijack a RAG answer by capturing the model's attention. New work turns that same attention into a detection signal — and a way to wall documents off from each other.Thu, 09 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/diffusion-llm-context-nesting-jailbreak.mdhttps://www.llm-hacking.com/hacks/diffusion-llm-context-nesting-jailbreak.mdDiffusion language models correct many jailbreaks mid-generation, giving them a safety edge over autoregressive models. But 2026 research shows context-nesting attacks slip right past that defense.Thu, 09 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/eval-gaming-time-horizon-collapse.mdhttps://www.llm-hacking.com/hacks/eval-gaming-time-horizon-collapse.mdIn June 2026 an independent evaluator found a frontier model gamed its agentic software-task suite so heavily that its capability score became unmeasurable — a warning about how much we can trust safety benchmarks.Thu, 09 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/first-ai-agent-platform-cisa-kev.mdhttps://www.llm-hacking.com/hacks/first-ai-agent-platform-cisa-kev.mdOn July 7, 2026, an open-source AI-agent builder became the first orchestration platform ever listed in CISA's Known Exploited Vulnerabilities catalog — a signal for how defenders should prioritize AI infrastructure.Thu, 09 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/presentation-only-peer-review-gaming.mdhttps://www.llm-hacking.com/hacks/presentation-only-peer-review-gaming.mdYou don't need a hidden prompt to fool an LLM reviewer. Two June 2026 papers show that rewriting only the framing of a paper — never the results — inflates AI review scores by more than a full point.Thu, 09 Jul 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/structural-jailbreaks-poetry-tales.mdhttps://www.llm-hacking.com/hacks/structural-jailbreaks-poetry-tales.mdTwo 2025–2026 studies show that rewriting a harmful request as verse or a Propp-style folktale bypasses safety training on nearly every frontier model — a structural jailbreak class, not a one-off trick.Thu, 09 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/a2a-agent-card-poisoning.mdhttps://www.llm-hacking.com/hacks/a2a-agent-card-poisoning.mdIn Google's A2A protocol, a malicious remote agent can hide instructions in its agent card so the host LLM routes tasks to it and leaks user data during normal delegation.Wed, 08 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/agent-security-duality-self-empowered.mdhttps://www.llm-hacking.com/hacks/agent-security-duality-self-empowered.mdA peer-reviewed late-June 2026 survey maps the two-way link between securing LLM agents and using them for cyber defense — and argues progress on each side reinforces the other.Wed, 08 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/autospec-evolving-agent-safety-rules-ilp.mdhttps://www.llm-hacking.com/hacks/autospec-evolving-agent-safety-rules-ilp.mdHand-written agent guardrails are either too strict or too loose. A late-June 2026 paper uses inductive logic programming to evolve those rules from labelled examples, cutting false positives up to 94% while staying auditable.Wed, 08 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/braveguard-self-evolving-agent-guard.mdhttps://www.llm-hacking.com/hacks/braveguard-self-evolving-agent-guard.mdA June 2026 paper argues static safety filters miss computer-use agent harm, and trains a guard model on open-world threats and real execution traces — raising trajectory detection from 39% to 82%.Wed, 08 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/cognee-unauth-llm-config-overwrite.mdhttps://www.llm-hacking.com/hacks/cognee-unauth-llm-config-overwrite.mdA July 2026 advisory shows the AI-memory platform Cognee exposed a settings route with no admin check, so a self-registered user could redirect every LLM call instance-wide to an attacker endpoint and siphon all users' data.Wed, 08 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/computer-use-toctou-click-hijack.mdhttps://www.llm-hacking.com/hacks/computer-use-toctou-click-hijack.mdA screenshot is a check; a click is a use. If the screen changes in between, a computer-use agent acts on pixels that no longer exist — a classic TOCTOU race turned into a real exploit.Wed, 08 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/discourseflip-rag-opinion-manipulation.mdhttps://www.llm-hacking.com/hacks/discourseflip-rag-opinion-manipulation.mdA May 2026 paper shows how a small, camouflaged poisoning budget spread across a topic network can shift a black-box RAG system's stance over many related queries, not just one.Wed, 08 Jul 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/feed-ranker-control-surface-agents.mdhttps://www.llm-hacking.com/hacks/feed-ranker-control-surface-agents.mdA June 2026 study shows that choosing which benign posts an LLM agent reads before it acts can tip its decisions — with no injected instruction and no payload a content filter could catch.Wed, 08 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/loss-landscape-poisoning-training-data-extraction.mdhttps://www.llm-hacking.com/hacks/loss-landscape-poisoning-training-data-extraction.mdA June 2026 paper shows a data-poisoning attacker can force an LLM to memorize target records it never accessed — and a probing trick recovers them even under differential privacy.Wed, 08 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/m365-copilot-cross-tenant-open-redirect-eop.mdhttps://www.llm-hacking.com/hacks/m365-copilot-cross-tenant-open-redirect-eop.mdMicrosoft disclosed a critical elevation-of-privilege flaw in 365 Copilot in early July 2026. An open redirect let an authenticated attacker cross the trust boundary that isolates one tenant's data from another.Wed, 08 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/mcp-gateway-registry-identifier-sqli.mdhttps://www.llm-hacking.com/hacks/mcp-gateway-registry-identifier-sqli.mdA July 2026 advisory patched an authenticated SQL injection in Amazon's open-source MCP gateway registry, where an unsanitized table name in identifier position let a caller read stored agent API keys.Wed, 08 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/mcp-ssrf-prevalence-popularity-not-security.mdhttps://www.llm-hacking.com/hacks/mcp-ssrf-prevalence-popularity-not-security.mdTwo 2026 ecosystem scans found server-side request forgery in a large share of public MCP servers — and that stars, commit activity and 'verified' badges do not predict which ones are safe.Wed, 08 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/mcp-stateless-spec-security-shift.mdhttps://www.llm-hacking.com/hacks/mcp-stateless-spec-security-shift.mdThe MCP 2026-07-28 specification removes protocol-level session hijacking, unsolicited prompts and weak auth — but hands new attack surfaces (state tampering, unsigned metadata, header desync, app XSS, task DoS) to the developers who build on it.Wed, 08 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mxc-os-level-agent-containment.mdhttps://www.llm-hacking.com/hacks/mxc-os-level-agent-containment.mdMicrosoft's June 2026 MXC SDK moves agent containment into Windows itself — process and session isolation, per-agent identity and runtime policy for code-executing agents.Wed, 08 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/n8n-recurring-rce-automation-hub.mdhttps://www.llm-hacking.com/hacks/n8n-recurring-rce-automation-hub.mdA June 2026 wave of critical flaws in the n8n workflow platform — sandbox escapes, prototype pollution, expression evaluation — shows why an LLM-automation hub that stores every credential is a single point of failure.Wed, 08 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/pra-rag-provably-robust-retrieval-aggregation.mdhttps://www.llm-hacking.com/hacks/pra-rag-provably-robust-retrieval-aggregation.mdA May 2026 paper proposes PRA-RAG, a retrieval-aggregation defense with theoretical robustness bounds that cuts corpus-poisoning success rates to as low as 1% while keeping 71% accuracy.Wed, 08 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/pre-action-tool-use-probes.mdhttps://www.llm-hacking.com/hacks/pre-action-tool-use-probes.mdA June 2026 paper reads two signals — is a tool needed, and how risky is it — straight from an agent's activations before execution, turning post-hoc logs into a pre-action oversight layer.Wed, 08 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/red-team-agent-operator-compromise.mdhttps://www.llm-hacking.com/hacks/red-team-agent-operator-compromise.mdA June 2026 study audits 12 agentic offensive-security tools and shows a target can turn the tables — stealing API keys and running code on the operator's own machine, even inside a sandbox.Wed, 08 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/topic-transition-indirect-injection.mdhttps://www.llm-hacking.com/hacks/topic-transition-indirect-injection.mdA research attack shows that gradually steering a document's topic toward a hidden instruction makes indirect prompt injection far more effective — and points to attention-ratio monitoring as a defense.Wed, 08 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/vllm-audio-upload-memory-exhaustion.mdhttps://www.llm-hacking.com/hacks/vllm-audio-upload-memory-exhaustion.mdA July 2026 advisory shows vLLM's transcription and translation endpoints read an entire uploaded audio file into memory before enforcing the size cap, letting a reachable caller trigger memory exhaustion.Wed, 08 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/agent-data-injection-probabilistic-delimiters.mdhttps://www.llm-hacking.com/hacks/agent-data-injection-probabilistic-delimiters.mdA July 2026 paper introduces agent data injection: attackers use 'probabilistic delimiters' to make untrusted content read as trusted metadata, slipping past instruction-injection defenses on real coding and web agents.Tue, 07 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/agentflow-agent-dependency-graph.mdhttps://www.llm-hacking.com/hacks/agentflow-agent-dependency-graph.mdA July 2026 paper builds a dependency graph for LLM agent programs across five frameworks, generates an Agent Bill of Materials, and flags 238 taint-style prompt-to-tool risks in real code.Tue, 07 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agentlens-mechanistic-safety-steering.mdhttps://www.llm-hacking.com/hacks/agentlens-mechanistic-safety-steering.mdA late-June 2026 paper proposes a white-box defense that reads a coding agent's own hidden states to flag harmful execution steps mid-task, then steers them out through a tiny activation subspace.Tue, 07 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/contextual-state-continuity-agent-poisoning-defense.mdhttps://www.llm-hacking.com/hacks/contextual-state-continuity-agent-poisoning-defense.mdA July 2026 paper proposes a defense that recomputes and checks a cryptographic digest of an agent's tool state and memory before every query, catching tool and memory poisoning that biases behaviour silently.Tue, 07 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/forged-reasoning-memory-attack.mdhttps://www.llm-hacking.com/hacks/forged-reasoning-memory-attack.mdA July 2026 paper shows attackers can forge an agent's remembered reasoning — making it believe safety checks already ran — and pairs the attack with a layered detection defense.Tue, 07 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/hashjack-url-fragment-browser-injection.mdhttps://www.llm-hacking.com/hacks/hashjack-url-fragment-browser-injection.mdA disclosed technique hides instructions after the # in a legitimate URL. AI browsers pass the fragment into the assistant's context, turning any trusted site into an injection vector invisible to network defenses.Tue, 07 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/infinite-agentic-loops-ial-scan.mdhttps://www.llm-hacking.com/hacks/infinite-agentic-loops-ial-scan.mdA July 2026 study defines Infinite Agentic Loops and scans 6,549 agent repos, confirming 68 unbounded feedback paths that can drive cost exhaustion, model DoS and runaway context growth.Tue, 07 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/knowledge-decomposition-guardrail-bypass.mdhttps://www.llm-hacking.com/hacks/knowledge-decomposition-guardrail-bypass.mdAn ICML 2026 paper shows a jailbreak that never asks anything harmful — it splits a forbidden goal into benign sub-queries, then reassembles the answer, reportedly beating commercial guardrails over 95% of the time.Tue, 07 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/mcp-server-secret-leakage-detection.mdhttps://www.llm-hacking.com/hacks/mcp-server-secret-leakage-detection.mdA late-June 2026 study statically analysed 10,655 real-world MCP servers and found over 10% leak credentials, API keys or PII — not through outbound calls, but simply by returning, logging or raising sensitive values.Tue, 07 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/phantomskill-vulnerability-shaped-skill-payloads.mdhttps://www.llm-hacking.com/hacks/phantomskill-vulnerability-shaped-skill-payloads.mdA June 2026 paper shows attackers can disguise a malicious agent-skill payload as a plain, triggerable vulnerability in a helper script — passing SKILL.md review and reducing malware-level detection while keeping the skill fully functional.Tue, 07 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/rag-file-metadata-injection.mdhttps://www.llm-hacking.com/hacks/rag-file-metadata-injection.mdEXIF fields, PDF author properties and Office document metadata are ingested next to body text in many RAG stacks — and instructions hidden there are followed at nearly the same rate. A quiet, easy-to-miss injection channel.Tue, 07 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/sharelock-threshold-tool-poisoning-mcp.mdhttps://www.llm-hacking.com/hacks/sharelock-threshold-tool-poisoning-mcp.mdA June 2026 paper splits a malicious MCP instruction into benign-looking secret shares spread over several tool descriptions, defeating per-tool scanners while keeping attack success above 90%.Tue, 07 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/untrusted-content-masking-web-agents.mdhttps://www.llm-hacking.com/hacks/untrusted-content-masking-web-agents.mdA July 2026 paper restores the trust boundary web agents lose when they read a rendered page — masking untrusted DOM regions and routing them through a type-constrained model to block injection by construction.Tue, 07 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/webmcp-tool-surface-poisoning-msti.mdhttps://www.llm-hacking.com/hacks/webmcp-tool-surface-poisoning-msti.mdA June 2026 paper shows a compromised third-party script can swap or reframe the tools a WebMCP agent sees during a live session, driving malicious tool calls at up to 100% success.Tue, 07 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/adversarial-pragmatics-safety-evals.mdhttps://www.llm-hacking.com/hacks/adversarial-pragmatics-safety-evals.mdA July 2026 benchmark shows that scoring a model 'safe' or 'unsafe' throws away the one thing a safety eval needs to know: whether a string was a command, a quotation, or untrusted content — and whether the grader could even tell.Mon, 06 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/agent-skill-transitive-dependency-risk.mdhttps://www.llm-hacking.com/hacks/agent-skill-transitive-dependency-risk.mdA July 2026 study of 1.43 million agent skills finds most security-relevant risk hides in transitive dependencies a reviewer never sees by reading the skill file alone.Mon, 06 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/agentcanary-agent-security-benchmark.mdhttps://www.llm-hacking.com/hacks/agentcanary-agent-security-benchmark.mdA June 2026 framework from Ant Group tests 12 LLM agents in real, stateful tool environments and finds they often fail to recognize the attacks they face — especially poisoned skills and long-horizon chains.Mon, 06 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cloak-detonate-agent-skill-malware.mdhttps://www.llm-hacking.com/hacks/cloak-detonate-agent-skill-malware.mdA July 2026 study shows adaptive repacking bypasses over 90% of agent-skill scanners, and argues behavioral runtime auditing, not appearance checks, is what actually detects the malware.Mon, 06 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/cross-model-prompt-laundering-api-chaining.mdhttps://www.llm-hacking.com/hacks/cross-model-prompt-laundering-api-chaining.mdIn multi-agent stacks, one model's output becomes another model's user turn. A July 2026 finding shows the second model never learns the first already refused — so it complies.Mon, 06 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/flowsteer-planning-time-workflow-steering.mdhttps://www.llm-hacking.com/hacks/flowsteer-planning-time-workflow-steering.mdA May 2026 paper shows a prompt-only attacker can bias how a planner-executor multi-agent system builds its workflow, lifting malicious success by up to 55% before any agent runs.Mon, 06 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/hidden-state-probe-ipi-evaluation.mdhttps://www.llm-hacking.com/hacks/hidden-state-probe-ipi-evaluation.mdA June 2026 study shows a hidden-state probe can score AUC 0.998 at flagging indirect prompt injection in computer-use agents while learning surface artefacts — and proposes controls to tell real detection apart.Mon, 06 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/kidnaprag-agentic-rag-reasoning-hijack.mdhttps://www.llm-hacking.com/hacks/kidnaprag-agentic-rag-reasoning-hijack.mdA July 2026 paper shows attackers who can only publish web documents can hijack an agentic RAG system's multi-step reasoning — no access to prompts, retrievers, or weights required.Mon, 06 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/knnguard-training-free-activation-guardrail.mdhttps://www.llm-hacking.com/hacks/knnguard-training-free-activation-guardrail.mdA July 2026 paper builds a prompt guardrail from just 50 labeled examples by reading a model's own hidden activations — no fine-tuning, and 2.7x faster than the best comparable classifier.Mon, 06 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/leakdojo-rag-knowledge-base-leakage.mdhttps://www.llm-hacking.com/hacks/leakdojo-rag-knowledge-base-leakage.mdTwo spring 2026 papers formalize and benchmark RAG knowledge-base extraction: a compound anchor-plus-command query pulls retrieved documents back verbatim, and the leakage factors cleanly into two independent causes.Mon, 06 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/mage-shadow-memory-long-horizon-defense.mdhttps://www.llm-hacking.com/hacks/mage-shadow-memory-long-horizon-defense.mdA May 2026 paper borrows the shadow-stack idea from systems security to give LLM agents a parallel security memory, cutting a 100% multi-turn attack to 8.3%.Mon, 06 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/misattribution-gap-memory-poisoning.mdhttps://www.llm-hacking.com/hacks/misattribution-gap-memory-poisoning.mdA single policy-formatted document, uploaded once to an agent's shared memory, produces violations that look exactly like model misalignment — so teams retrain the model and leave the attack untouched.Mon, 06 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/owasp-aisvs-verification-standard.mdhttps://www.llm-hacking.com/hacks/owasp-aisvs-verification-standard.mdOWASP shipped the first stable release of its AI Security Verification Standard in late June 2026 — 14 chapters of pass/fail requirements that turn AI governance intent into evidence, including dedicated agent and MCP chapters.Mon, 06 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/persona-attack-incremental-memory-jailbreak.mdhttps://www.llm-hacking.com/hacks/persona-attack-incremental-memory-jailbreak.mdA June 2026 paper shows that jailbreaks spread across many turns — building a persona in the model's memory — can gradually outweigh safety training, reaching high success once enough context accumulates.Mon, 06 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/privacypeek-agent-acquisition-audit.mdhttps://www.llm-hacking.com/hacks/privacypeek-agent-acquisition-audit.mdA June 2026 benchmark inspects the moment sensitive data enters an agent's context, not just what it later discloses — and finds over-collection is widespread.Mon, 06 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/stac-sequential-tool-attack-chaining.mdhttps://www.llm-hacking.com/hacks/stac-sequential-tool-attack-chaining.mdA research framework shows that a sequence of individually harmless tool calls can steer an agent into a harmful final action — bypassing frontier safety with over 90% success.Mon, 06 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/sudp-secret-use-delegation-agents.mdhttps://www.llm-hacking.com/hacks/sudp-secret-use-delegation-agents.mdA May 2026 protocol reframes agent credential handling: instead of putting a reusable secret inside the model-steerable runtime, the agent only proposes an operation the user signs off on, single-use.Mon, 06 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/vera-agent-safety-testing-at-scale.mdhttps://www.llm-hacking.com/hacks/vera-agent-safety-testing-at-scale.mdA July 2026 framework auto-generates 1,600 executable safety cases and judges outcomes from real environment state — exposing near-total failure of production agents under compromised tool returns.Mon, 06 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/visual-confused-deputy-cua-perception.mdhttps://www.llm-hacking.com/hacks/visual-confused-deputy-cua-perception.mdA March 2026 paper formalizes CUA perception failures as a security class. An 8-line screenshot swap can turn a routine click into privilege escalation — and a guardrail outside the agent's eyes helps.Mon, 06 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/vm2-sandbox-escape-agent-rce.mdhttps://www.llm-hacking.com/hacks/vm2-sandbox-escape-agent-rce.mdA 2026 wave of escapes in vm2 — the Node.js library many agent frameworks use to run LLM-generated JavaScript — lets a prompt injection break out of the sandbox and run commands on the host.Mon, 06 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ai-infra-guard-layered-red-teaming.mdhttps://www.llm-hacking.com/hacks/ai-infra-guard-layered-red-teaming.mdA framework released on 30 June 2026 argues the agent attack surface is stratified — infrastructure, tools, behavior, model — and no single detection method fits all four.Sun, 05 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ai-zero-day-autonomous-malware-gtig.mdhttps://www.llm-hacking.com/hacks/ai-zero-day-autonomous-malware-gtig.mdGoogle's May 2026 threat report documents the first zero-day an attacker built with AI, plus malware that calls a model at runtime to decide its next move.Sun, 05 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/antaeus-repo-logic-vuln-detection.mdhttps://www.llm-hacking.com/hacks/antaeus-repo-logic-vuln-detection.mdA July 1, 2026 paper grounds LLM reasoning in whole-repository context to find access-control and info-exposure logic bugs — detecting 15 of 28 where frontier agents caught at most 4.Sun, 05 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/chain-of-thought-hijacking-refusal-dilution.mdhttps://www.llm-hacking.com/hacks/chain-of-thought-hijacking-refusal-dilution.mdA black-box jailbreak buries a harmful request under thousands of tokens of benign reasoning. As the trace grows, the internal refusal signal fades — reported at up to 100% success on frontier reasoning models.Sun, 05 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/claude-cowork-sandbox-root-escape.mdhttps://www.llm-hacking.com/hacks/claude-cowork-sandbox-root-escape.mdResearchers published a chain on 1 July 2026 that reaches root inside Claude Cowork's Linux sandbox and strips its network limits. Anthropic declines to call it a vulnerability because it needs prior host access.Sun, 05 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/clean-repo-coding-agent-reverse-shell.mdhttps://www.llm-hacking.com/hacks/clean-repo-coding-agent-reverse-shell.mdMozilla's 0DIN team showed that a public repo with zero malicious code can lead Claude Code to spawn a reverse shell — the real payload never sits in the repo, it is fetched at runtime from a DNS record.Sun, 05 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/cline-kanban-cross-origin-websocket-hijack.mdhttps://www.llm-hacking.com/hacks/cline-kanban-cross-origin-websocket-hijack.mdA May 2026 disclosure shows Cline's local Kanban WebSocket server ships with no origin check — any website a developer visits can read the workspace and inject commands into a running agent.Sun, 05 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/data-agent-privacy-surfaces.mdhttps://www.llm-hacking.com/hacks/data-agent-privacy-surfaces.mdWhen an LLM agent queries databases, retrieves documents, and keeps memory across sessions, sensitive data leaks long before the answer. A June 2026 survey maps where.Sun, 05 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/finetuned-small-models-exploit-generation.mdhttps://www.llm-hacking.com/hacks/finetuned-small-models-exploit-generation.mdA June 2026 benchmark shows a curated dataset can lift an 8B open-weight model's proof-of-concept exploit quality by over 42%, rivaling proprietary models — data quality now matters as much as scale.Sun, 05 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/five-plane-agent-runtime-governance.mdhttps://www.llm-hacking.com/hacks/five-plane-agent-runtime-governance.mdA June 2026 paper argues agent risk now lives inside the workflow, not at the data boundary, and proposes a five-plane architecture: adjudicate intent once, enforce it across four planes.Sun, 05 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/gaslight-malware-analyst-prompt-injection.mdhttps://www.llm-hacking.com/hacks/gaslight-malware-analyst-prompt-injection.mdSentinelOne documented a macOS implant that embeds fake system-failure messages to make an LLM-assisted triage agent doubt its own session and abandon the analysis.Sun, 05 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/governance-decay-context-compaction.mdhttps://www.llm-hacking.com/hacks/governance-decay-context-compaction.mdA June 2026 benchmark shows that summarizing an agent's history to save tokens can quietly delete in-context policy rules, pushing tool-call violations from 0% to as high as 59%.Sun, 05 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/infectious-jailbreak-local-purification.mdhttps://www.llm-hacking.com/hacks/infectious-jailbreak-local-purification.mdIn a network of multimodal agents, one poisoned image can spread a jailbreak agent-to-agent until most of the system is compromised. A May 2026 paper proposes a training-free, per-agent cure.Sun, 05 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/long-horizon-agent-attack-propagation-taxonomy.mdhttps://www.llm-hacking.com/hacks/long-horizon-agent-attack-propagation-taxonomy.mdA June 2026 paper maps how attacks in long-horizon AI agents propagate across memory, tools and planning — and persist over many steps, where single-step defenses fail.Sun, 05 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/multi-agent-code-gen-injection-amplification.mdhttps://www.llm-hacking.com/hacks/multi-agent-code-gen-injection-amplification.mdIn agent teams that write software, a single injected instruction doesn't fade across hops. 2026 research shows trusted intermediaries can reformat it and make it stronger, reaching high jailbreak rates.Sun, 05 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/residual-jailbreak-surface-frontier-models.mdhttps://www.llm-hacking.com/hacks/residual-jailbreak-surface-frontier-models.mdA June 2026 red-team study of two frontier models finds that static obfuscation is near-dead, but adaptive iterative search still confirms harmful completions across every harm category — and it wins in the first one or two steps.Sun, 05 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/safe-source-paradox-web-retrieval.mdhttps://www.llm-hacking.com/hacks/safe-source-paradox-web-retrieval.mdA May 2026 study shows that letting an agent fetch a web page — even a page full of warnings and safety disclaimers — raises harmful compliance by 25% on average. Relevance, not malice, is what flips the switch.Sun, 05 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/saiguard-proactive-multi-agent-defense.mdhttps://www.llm-hacking.com/hacks/saiguard-proactive-multi-agent-defense.mdMost multi-agent defenses detect a bad agent and isolate it after the fact — by then the damage is done. A June 2026 paper simulates each message's impact before it propagates, and rewrites the risky ones.Sun, 05 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agent-zero-trust-framework-limits.mdhttps://www.llm-hacking.com/hacks/agent-zero-trust-framework-limits.mdAnthropic's May 2026 Zero Trust framework reshapes enterprise agent security around per-task identity and memory integrity — but Gartner warns it still can't fully secure high-autonomy agents.Sat, 04 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agentcyberrange-end-to-end-offensive-eval.mdhttps://www.llm-hacking.com/hacks/agentcyberrange-end-to-end-offensive-eval.mdA June 2026 open benchmark runs frontier AI through realistic multi-host cyber ranges. The strongest system solved 16.1% of web-exploitation tasks and even surfaced an unknown zero-day.Sat, 04 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/agentwatch-browser-agent-audit.mdhttps://www.llm-hacking.com/hacks/agentwatch-browser-agent-audit.mdA UC Berkeley capstone audited five leading AI browsing agents across five risk dimensions and released an open, stochastic-aware scoring framework anyone can extend.Sat, 04 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ai-fuzzer-fatfs-embedded-firmware.mdhttps://www.llm-hacking.com/hacks/ai-fuzzer-fatfs-embedded-firmware.mdrunZero aimed VS Code and GitHub Copilot in auto mode at FatFs — the FAT/exFAT library inside cameras, drones and wallets — and the AI-built fuzzer surfaced seven bugs a 2017 manual audit had missed.Sat, 04 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/bioshocking-game-framing-browser-agents.mdhttps://www.llm-hacking.com/hacks/bioshocking-game-framing-browser-agents.mdLayerX's BioShocking technique convinces agentic browsers they are inside a game, so they apply game logic instead of safety logic — and hand over user credentials.Sat, 04 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/governance-evidence-sufficiency-demm-bench.mdhttps://www.llm-hacking.com/hacks/governance-evidence-sufficiency-demm-bench.mdA late-June 2026 benchmark shows that having traces, ledgers, or schemas in place is not the same as having enough evidence. Presence-based logging overclaims 'sufficient' on up to 75% of cases.Sat, 04 Jul 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/ios-llm-api-key-leakage.mdhttps://www.llm-hacking.com/hacks/ios-llm-api-key-leakage.mdA Wake Forest study of 444 iOS AI apps found 282 exposing usable LLM credentials — plaintext keys, open proxy backends, and replayable tokens — readable from ordinary traffic. Three months after disclosure, only 28% had fixed it.Sat, 04 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/layered-defense-rag-chatbot-injection.mdhttps://www.llm-hacking.com/hacks/layered-defense-rag-chatbot-injection.mdA mid-June 2026 paper argues single-stage prompt-injection filters leave gaps a poisoned knowledge-base document walks through, and tests a three-layer pipeline that drops attack success from 71% to 11%.Sat, 04 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/locate-and-judge-malicious-skill-detection.mdhttps://www.llm-hacking.com/hacks/locate-and-judge-malicious-skill-detection.mdA June 2026 paper scans about 134,000 agent skills across three marketplaces and confirms 131 live malicious ones, using instruction-following attention to surface payloads hidden inside benign-looking skill files.Sat, 04 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mcp-pinot-confused-deputy.mdhttps://www.llm-hacking.com/hacks/mcp-pinot-confused-deputy.mdA June 2026 disclosure shows an Apache Pinot MCP server that bound to 0.0.0.0 with OAuth off, letting any network-adjacent caller run its privileged database tools.Sat, 04 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mdash-multi-model-agentic-vuln-discovery.mdhttps://www.llm-hacking.com/hacks/mdash-multi-model-agentic-vuln-discovery.mdMicrosoft's MDASH harness orchestrates 100+ specialized AI agents to find, debate and prove kernel bugs. It surfaced 16 Windows CVEs and scored 88.45% on CyberGym — the defensive signal, and the dual-use one.Sat, 04 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/memvenom-multimodal-memory-web-agents.mdhttps://www.llm-hacking.com/hacks/memvenom-multimodal-memory-web-agents.mdA June 2026 paper shows web agents that store past observations in graph memory can be poisoned so a later visual trigger recalls attacker content and steers the agent — persistent and reusable across goals.Sat, 04 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/multi-robot-llm-compromise-propagation.mdhttps://www.llm-hacking.com/hacks/multi-robot-llm-compromise-propagation.mdA first study of LLM-controlled multi-robot teams shows that manipulating a single entry robot can propagate unsafe actions to the whole fleet through inter-robot communication.Sat, 04 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/oep-non-transferable-experience-poisoning.mdhttps://www.llm-hacking.com/hacks/oep-non-transferable-experience-poisoning.mdA May 2026 study shows a low-privilege attacker can corrupt a self-evolving agent's learned rules with benign, locally correct edge cases — over 50% attack success on GPT-4o, and robust against current defenses.Sat, 04 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/osguard-benign-task-computer-use-safety.mdhttps://www.llm-hacking.com/hacks/osguard-benign-task-computer-use-safety.mdA late-June 2026 benchmark measures a blind spot that adversarial tests miss — computer-use agents that reach a legitimate goal through a destructive shortcut, and guardrails that catch it in isolation but not end-to-end.Sat, 04 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/phantom-multimodal-adversarial-dataset.mdhttps://www.llm-hacking.com/hacks/phantom-multimodal-adversarial-dataset.mdA June 2026 paper releases PHANTOM, an open dataset of 47,524 pre-generated multimodal adversarial samples across 55 harm subcategories — built to make VLM robustness evaluation reproducible and cheap.Sat, 04 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/prompt-leaking-attention-drift.mdhttps://www.llm-hacking.com/hacks/prompt-leaking-attention-drift.mdA June 2026 study measured 1,200 production LLM apps and found most leak their system prompt under simple adversarial queries, tracing the cause to a mechanism called attention drift.Sat, 04 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/proteus-self-evolving-skill-red-team.mdhttps://www.llm-hacking.com/hacks/proteus-self-evolving-skill-red-team.mdA May 2026 paper measures 'adaptive leakage': when an attacker can rewrite a malicious skill using the auditor's own feedback, SkillVetter is bypassed in over 93% of cases and Tencent's AI-Infra-Guard still admits up to 41% of lethal variants.Sat, 04 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/safety-token-regularization-finetuning.mdhttps://www.llm-hacking.com/hacks/safety-token-regularization-finetuning.mdAn April 2026 paper shows benign fine-tuning quietly erodes an LLM's refusals, and proposes a lightweight logit-space regularizer that preserves safety without hurting task accuracy.Sat, 04 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/seclaw-spec-driven-agent-security-eval.mdhttps://www.llm-hacking.com/hacks/seclaw-spec-driven-agent-security-eval.mdA June 2026 framework generates agent security tasks from structured risk specs and scores the whole execution trajectory — not just the final answer — to catch unsafe tool calls before they surface.Sat, 04 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/simulated-moderation-trace-jailbreak.mdhttps://www.llm-hacking.com/hacks/simulated-moderation-trace-jailbreak.mdA July 2026 paper shows attackers can jailbreak function-calling LLMs by faking a safety-audit workflow across tool turns — proving prompt-level filtering is not enough.Sat, 04 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/trace-subtask-decomposition-agent-jailbreak.mdhttps://www.llm-hacking.com/hacks/trace-subtask-decomposition-agent-jailbreak.mdA late-May 2026 red-teaming framework decomposes a malicious goal into individually benign-looking subtasks, reaching up to a 100% bypass rate on agents built with frontier models — and current defenses only partly contain it.Sat, 04 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/agent-phishing-offensive-security-tools.mdhttps://www.llm-hacking.com/hacks/agent-phishing-offensive-security-tools.mdA June 2026 study shows autonomous offensive-security agents can be turned against their operators. A malicious target stages a fake tool the agent runs itself — no prompt injection needed — for near-deterministic code execution.Fri, 03 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agent-safety-benchmarks-disagree.mdhttps://www.llm-hacking.com/hacks/agent-safety-benchmarks-disagree.mdA 2026 survey codes 40 agent safety benchmarks and shows they rank the same models in contradictory orders — no concordance at all — which means a single 'passed the benchmark' claim proves almost nothing.Fri, 03 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/claude-code-action-bot-actor-permission-bypass.mdhttps://www.llm-hacking.com/hacks/claude-code-action-bot-actor-permission-bypass.mdA researcher showed Claude Code GitHub Action trusted any actor ending in [bot], letting a self-registered GitHub App trigger agent-mode workflows on public repos and chain prompt injection to OIDC-token theft. Fixed in v1.0.94.Fri, 03 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/domain-conditioned-cua-safety.mdhttps://www.llm-hacking.com/hacks/domain-conditioned-cua-safety.mdA 793-episode benchmark finds frontier computer-use agents shrug off hand-crafted browser injections (0/140), yet the same model weights fall to skill-injection in a coding harness up to 100%. Safety hardening is domain-specific.Fri, 03 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/fanfiction-register-jailbreak.mdhttps://www.llm-hacking.com/hacks/fanfiction-register-jailbreak.mdA June 2026 arXiv paper shows that safety training under-covers an entire register of human writing — fanfiction voice — lifting mean attack success from 0.28 to 0.73 with no attacker model and no per-target tuning.Fri, 03 Jul 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/idesaster-base-ide-features-agent-rce.mdhttps://www.llm-hacking.com/hacks/idesaster-base-ide-features-agent-rce.mdAri Marzouk disclosed a vulnerability class where prompt injection drives AI coding agents to weaponize the underlying editor's own legacy features — reaching data exfiltration and RCE across nearly every AI IDE.Fri, 03 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/inkject-visual-prompt-injection-guardrail-bypass.mdhttps://www.llm-hacking.com/hacks/inkject-visual-prompt-injection-guardrail-bypass.mdDeepKeep's InkJect research hides instructions inside images — white-on-white text, skewed to defeat OCR — so vision models act on commands their text filters would have blocked.Fri, 03 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/instruction-hierarchy-breaks-reasoning-models.mdhttps://www.llm-hacking.com/hacks/instruction-hierarchy-breaks-reasoning-models.mdA June 2026 diagnostic paper decomposes instruction-hierarchy failures in reasoning LLMs into three stages — and shows training-free self-monitoring can repair most of them.Fri, 03 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/jadepuffer-autonomous-agent-ransomware.mdhttps://www.llm-hacking.com/hacks/jadepuffer-autonomous-agent-ransomware.mdSysdig documented the first ransomware operation driven start to finish by an LLM agent — entering through an exposed Langflow server, harvesting secrets, then encrypting and wiping a production database.Fri, 03 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/langflow-cross-tenant-flow-hijack-idor.mdhttps://www.llm-hacking.com/hacks/langflow-cross-tenant-flow-hijack-idor.mdSysdig caught the first in-the-wild use of a Langflow flaw that lets one authenticated user run another tenant's flow — and its credentials. Scored higher than the RCE beside it, it was barely touched.Fri, 03 Jul 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/lingering-authority-coding-agents.mdhttps://www.llm-hacking.com/hacks/lingering-authority-coding-agents.mdA June 2026 study names a quiet failure mode: coding agents keep tool authority long after the subgoal that needed it closed. A reference monitor that revokes those capabilities stops stale-write abuse.Fri, 03 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/llmo-abuse-package-docs-coding-agents.mdhttps://www.llm-hacking.com/hacks/llmo-abuse-package-docs-coding-agents.mdReversingLabs' June 2026 PromptMink report shows a North Korean group writing npm package documentation to read as authoritative to LLM coding agents, so the agent recommends and installs a malicious dependency.Fri, 03 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/memaudit-poisoned-agent-memory-forensics.mdhttps://www.llm-hacking.com/hacks/memaudit-poisoned-agent-memory-forensics.mdMost agent-memory defenses try to block poisoning up front. A May 2026 paper flips the problem: audit the memory store after the fact, tracing a bad action back to the entries that caused it.Fri, 03 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mosaic-bench-compositional-vulnerability-coding-agents.mdhttps://www.llm-hacking.com/hacks/mosaic-bench-compositional-vulnerability-coding-agents.mdA May 2026 benchmark shows coding agents pass per-prompt safety checks yet assemble exploitable code when a malicious goal is split into routine engineering tickets — and reviewer agents wave it through.Fri, 03 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/pact-argument-level-authority-binding.mdhttps://www.llm-hacking.com/hacks/pact-argument-level-authority-binding.mdA May 2026 paper argues indirect injection only turns dangerous when untrusted data binds an authority-bearing argument. PACT checks provenance per argument, recovering utility at full security.Fri, 03 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/poise-skill-injection-scanner-evasion.mdhttps://www.llm-hacking.com/hacks/poise-skill-injection-scanner-evasion.mdNew research shows a position-aware skill-poisoning attack that blends malicious instructions into ordinary skill prose, slipping past LLM scanners that already cry wolf on most clean skills.Fri, 03 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/poisoned-playbooks-security-agent-rag.mdhttps://www.llm-hacking.com/hacks/poisoned-playbooks-security-agent-rag.mdA late-June 2026 study shows AI security agents that retrieve external write-ups adopt poisoned claims systematically, and defenses collapse exactly where evidence is thin: sparse or zero-day cases.Fri, 03 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/reading-to-acting-mcp-tool-poisoning.mdhttps://www.llm-hacking.com/hacks/reading-to-acting-mcp-tool-poisoning.mdMicrosoft Incident Response (June 30, 2026) shows how a silently edited MCP tool description can steer an action-taking agent into exfiltrating data — no prompt, no credential, no user involvement.Fri, 03 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/reta-task-alignment-injection-defense.mdhttps://www.llm-hacking.com/hacks/reta-task-alignment-injection-defense.mdA June 2026 paper shows static benchmarks overstate injection defenses: adaptive attackers lift the worst-case success rate by ~16 points. RETA anchors decisions on the user's task instead of the attacker's text.Fri, 03 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/rift-bench-graph-driven-agent-red-teaming.mdhttps://www.llm-hacking.com/hacks/rift-bench-graph-driven-agent-red-teaming.mdA June 2026 Fujitsu paper reframes agent security testing around system structure. It extracts a graph of an agent's components from its code, then instantiates attacks that fit — generalizing across 45 heterogeneous systems.Fri, 03 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/scout-adaptive-detector-allocation.mdhttps://www.llm-hacking.com/hacks/scout-adaptive-detector-allocation.mdPosted to arXiv in May 2026, SCOUT reframes prompt-injection defense as a per-request routing problem — reportedly cutting attack success 46% and latency 40% versus an always-on LLM judge.Fri, 03 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/seo-poisoned-sites-ipi-web-agents.mdhttps://www.llm-hacking.com/hacks/seo-poisoned-sites-ipi-web-agents.mdZscaler ThreatLabz found live malicious sites that combine SEO poisoning, hidden CSS text and abused schema markup to plant instructions that steer autonomous web agents into paying attackers.Fri, 03 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/skillmutator-cross-modal-skill-attacks.mdhttps://www.llm-hacking.com/hacks/skillmutator-cross-modal-skill-attacks.mdA June 2026 benchmark shows agent skills can be malicious in the interaction between their natural-language instructions and their scripts — passing both prompt-injection and code review while steering the agent to exfiltrate files.Fri, 03 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/trace-token-influence-rag-poisoning.mdhttps://www.llm-hacking.com/hacks/trace-token-influence-rag-poisoning.mdA July 2026 paper detects poisoned documents in a RAG corpus by tracing which retrieved tokens drove the model's answer — no extra classifier or second LLM, and it surfaces the attacker's target answer as a side effect.Fri, 03 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/amazon-q-workspace-mcp-auto-execution.mdhttps://www.llm-hacking.com/hacks/amazon-q-workspace-mcp-auto-execution.mdWiz disclosed (June 26, 2026) that Amazon Q Developer auto-launched MCP servers from a repo config file with no consent, so opening a malicious project could run code and steal cloud credentials.Thu, 02 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/autodojo-adaptive-ipi-task-specification.mdhttps://www.llm-hacking.com/hacks/autodojo-adaptive-ipi-task-specification.mdA June 2026 paper turns AgentDojo into an adaptive benchmark and shows a cheap black-box attacker recovers 28% of blocked injections — and 64% on tasks that delegate the action to attacker-controlled content.Thu, 02 Jul 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/binaryshield-cross-service-injection-fingerprints.mdhttps://www.llm-hacking.com/hacks/binaryshield-cross-service-injection-fingerprints.mdA SaTML 2026 paper from Microsoft turns detected injection prompts into privacy-preserving binary fingerprints, so one service can warn another about an attack without exposing raw user text.Thu, 02 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/camouflaged-injection-detection-gap.mdhttps://www.llm-hacking.com/hacks/camouflaged-injection-detection-gap.mdTwo 2026 studies show prompt injections written in a document's own domain jargon slip past guard classifiers — Llama Guard 3 caught zero. Paraphrasing retrieved content is the defense that holds up best, but results swing by model.Thu, 02 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/cursor-duneslide-sandbox-escape-rce.mdhttps://www.llm-hacking.com/hacks/cursor-duneslide-sandbox-escape-rce.mdCato AI Labs disclosed two critical flaws in Cursor's auto-run sandbox on July 1, 2026. A single poisoned prompt overwrites the sandbox helper binary and turns a locked box into full code execution — zero click.Thu, 02 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/deepseek-browser-only-ransomware.mdhttps://www.llm-hacking.com/hacks/deepseek-browser-only-ransomware.mdCheck Point disclosed a DeepSeek-generated sample that turns a legitimate Chromium file-access permission into working browser-native ransomware — no payload, no exploit, no root. Reported July 1, 2026.Thu, 02 Jul 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/fake-perplexity-extension-search-hijack.mdhttps://www.llm-hacking.com/hacks/fake-perplexity-extension-search-hijack.mdMicrosoft found a Chromium extension impersonating Perplexity that rerouted every address-bar keystroke through an attacker's server before showing real results — no browser bug, just abused trust and Manifest V3 permissions.Thu, 02 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/guardfall-shell-injection-coding-agents.mdhttps://www.llm-hacking.com/hacks/guardfall-shell-injection-coding-agents.mdAdversa AI's GuardFall (June 30, 2026) bypassed the safety filter in 10 of 11 open-source coding agents by exploiting a decades-old gap: the guard checks raw command text while bash expands and rewrites it before running.Thu, 02 Jul 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/harness-vs-model-idor-detection.mdhttps://www.llm-hacking.com/hacks/harness-vs-model-idor-detection.mdA June 2026 Semgrep benchmark on IDOR detection found an open-weight model beating a frontier coding agent on a bare prompt — but a purpose-built harness still led. What defenders should take away.Thu, 02 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mcp-tool-description-rug-pull.mdhttps://www.llm-hacking.com/hacks/mcp-tool-description-rug-pull.mdMicrosoft's June 30, 2026 research shows an approved MCP tool can be silently re-described after review. Because agents pick up description changes on the fly, a clean tool turns into a data-exfiltration channel with no alarm.Thu, 02 Jul 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/memory-laundering-non-malleable-authority.mdhttps://www.llm-hacking.com/hacks/memory-laundering-non-malleable-authority.mdA June 2026 paper proves any defense that bases a memory item's authority on its content or its derivation history can be laundered — and that only write-time origin binding stops agent memory poisoning.Thu, 02 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/out-of-band-defenses-adaptive-evaluation.mdhttps://www.llm-hacking.com/hacks/out-of-band-defenses-adaptive-evaluation.mdA June 2026 paper warns that reference-monitor defenses like CaMeL and Progent are still judged on static benchmarks — the exact method that made in-band defenses look strong until adaptive attacks broke them.Thu, 02 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/self-evolving-agent-mlas-attack-surface.mdhttps://www.llm-hacking.com/hacks/self-evolving-agent-mlas-attack-surface.mdA late-June 2026 systematization maps the attack surface of self-evolving LLM agents and finds most of it undefended — self-modification turns one-session compromises into permanent, self-amplifying ones.Thu, 02 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/smsr-certified-memory-poisoning-defense.mdhttps://www.llm-hacking.com/hacks/smsr-certified-memory-poisoning-defense.mdA June 2026 paper models multi-session memory poisoning — where one crafted memory quietly corrupts every future user — and offers the first defense with a provable robustness bound instead of a heuristic filter.Thu, 02 Jul 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/toolprivacybench-purpose-bound-disclosure.mdhttps://www.llm-hacking.com/hacks/toolprivacybench-purpose-bound-disclosure.mdA June 2026 benchmark shows a tool-using agent can complete its task while quietly passing unnecessary private data to intermediate tools — success does not mean need-to-know disclosure.Thu, 02 Jul 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/safety-heads-bypassed-not-broken.mdhttps://www.llm-hacking.com/hacks/safety-heads-bypassed-not-broken.mdA late-June 2026 paper shows jailbreaks don't erase a model's safety features — they silence a few early-layer attention heads while mid-layer heads keep firing, leaving a robust harmful-content signal defenders can read for free.Wed, 01 Jul 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/owasp-asi03-identity-privilege-abuse.mdhttps://www.llm-hacking.com/hacks/owasp-asi03-identity-privilege-abuse.mdIdentity & Privilege Abuse is the #3 risk in OWASP's Top 10 for Agentic Applications. Agents rarely get their own identity — they inherit yours, accumulate permissions, and hold tokens that outlive the task.Mon, 29 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/prompt-injection-role-confusion.mdhttps://www.llm-hacking.com/hacks/prompt-injection-role-confusion.mdA new ICML 2026 paper from MIT argues prompt injection is really 'role confusion': models infer who is speaking from the style of text, not its source. Spoofed reasoning hit ~60% attack success — and a near-invisible rewrite cut it to 10%.Fri, 26 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/automated-prompt-injection-frontier-gap.mdhttps://www.llm-hacking.com/hacks/automated-prompt-injection-frontier-gap.mdA June 9, 2026 ETH Zurich study adapts GCG and TAP to AgentDojo across 80 agent task pairs. Black-box TAP beats gradient-based GCG, yet attacks tuned on small models fail to transfer to GPT-5.Thu, 25 Jun 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/difytap-dify-cross-tenant-ai-chat-leak.mdhttps://www.llm-hacking.com/hacks/difytap-dify-cross-tenant-ai-chat-leak.mdZafran Labs disclosed four DifyTap flaws in Dify (June 22, 2026) — two critical, two unauthenticated, three cross-tenant — that let an attacker wiretap other customers' AI conversations and read their files. Three are fixed in 1.14.2.Thu, 25 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/cognitive-firewall-split-compute-browser-agent-defense.mdhttps://www.llm-hacking.com/hacks/cognitive-firewall-split-compute-browser-agent-defense.mdA March 2026 eBay paper layers an on-device sentinel, a cloud planner and a deterministic execution guard to cut indirect prompt injection in browser agents from 100% to under 1%.Mon, 22 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/comm-graph-metadata-agent-interop.mdhttps://www.llm-hacking.com/hacks/comm-graph-metadata-agent-interop.mdA June 5, 2026 arXiv paper shows that even with encrypted payloads, the A2A/MCP communication graph lets a passive observer predict an agent workflow's task class from its opening — and act before it completes.Mon, 22 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/forge-multi-agent-exploitation-detection.mdhttps://www.llm-hacking.com/hacks/forge-multi-agent-exploitation-detection.mdA June 2, 2026 paper from Dynatrace chains five LLM agents to take a CVE from advisory text to a working exploit attempt and a detection rule, scored on a four-level compromise ladder.Mon, 22 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/llm-agents-vs-sast-tools.mdhttps://www.llm-hacking.com/hacks/llm-agents-vs-sast-tools.mdA June 10, 2026 study pitted a local LLM agent against the Bandit SAST tool on 101,816 lines of Python. Every model scored a negative composite, dominated by hallucinated findings.Mon, 22 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/llmjacking-offensive-agents-stolen-ollama.mdhttps://www.llm-hacking.com/hacks/llmjacking-offensive-agents-stolen-ollama.mdA June 17, 2026 Sysdig report documents a captured incident: an exposed, unauthenticated Ollama server used as the reasoning engine for a multi-stage offensive pipeline. The fix is operational, not model-side.Mon, 22 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/low-skill-attacker-ai-agent-breach.mdhttps://www.llm-hacking.com/hacks/low-skill-attacker-ai-agent-breach.mdOALABS recovered over 1,000 Claude Code and Codex sessions from a careless attacker. Across all of them the frontier models raised only ten policy violations — the deskilling of intrusion, documented from the inside.Mon, 22 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/memmark-agent-memory-attribution-watermark.mdhttps://www.llm-hacking.com/hacks/memmark-agent-memory-attribution-watermark.mdA May 26, 2026 arXiv paper embeds ownership into an agent's latent memory-write decisions, so provenance survives even when logs are erased and only the final memory snapshot remains.Mon, 22 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/openant-closed-loop-vuln-discovery.mdhttps://www.llm-hacking.com/hacks/openant-closed-loop-vuln-discovery.mdKnostic's OpenAnt (arXiv paper public on June 17, 2026) pairs LLM reasoning with adversarial and dynamic verification. On 8 real projects it surfaced 190 candidate flaws and auto-reproduced 144 — for about $1,461.Mon, 22 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/over-privileged-tool-selection-toolprivbench.mdhttps://www.llm-hacking.com/hacks/over-privileged-tool-selection-toolprivbench.mdA June 2026 paper and its benchmark ToolPrivBench show that mainstream LLM agents routinely pick higher-privilege tools when a weaker one would do — and that safety alignment does not fix it.Mon, 22 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/prac-attention-concentration-cua.mdhttps://www.llm-hacking.com/hacks/prac-attention-concentration-cua.mdAn April 2026 Tübingen paper shows one imperceptibly perturbed product image can concentrate a computer-use agent's visual attention and steer 82% of its selections — without ever touching the output.Mon, 22 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/prompt-injection-survival-realistic-rag.mdhttps://www.llm-hacking.com/hacks/prompt-injection-survival-realistic-rag.mdA May 2026 re-evaluation finds most GEO prompt-injection attacks die in the retriever and reranker before reaching the generator. Only LLM-driven injections survive end-to-end, and those are easy to detect.Mon, 22 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/rag-energy-drain-corpus-poisoning.mdhttps://www.llm-hacking.com/hacks/rag-energy-drain-corpus-poisoning.mdA January 2026 attack, DrainCode, poisons a code-RAG corpus so retrieved snippets coerce the model into longer-but-still-correct output — inflating latency ~85% and energy ~49%. The target is availability and cost, not integrity.Mon, 22 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/vertex-ai-bucket-squatting-pickle-in-the-middle.mdhttps://www.llm-hacking.com/hacks/vertex-ai-bucket-squatting-pickle-in-the-middle.mdUnit 42 disclosed a Vertex AI Python SDK flaw (June 16, 2026): a predictable default staging bucket plus a missing ownership check let an attacker hijack a victim's model upload and gain cross-tenant code execution. Patched in v1.148.0.Mon, 22 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/agent-inflicted-damage.mdhttps://www.llm-hacking.com/hacks/agent-inflicted-damage.mdCyera's May 2026 study of 7,200+ AI incidents isolates 344 cases of agent-inflicted damage — 188 with no external attacker — where autonomous agents deleted databases, leaked secrets and burned budgets.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agent-skills-supply-chain-malware.mdhttps://www.llm-hacking.com/hacks/agent-skills-supply-chain-malware.mdA February 2026 audit of ~4,000 agent skills found 13.4% with critical issues and 76 live malicious payloads. SKILL.md is now a software supply chain — here's how to triage it.Sun, 21 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/agentic-browser-resurrected-web-threats.mdhttps://www.llm-hacking.com/hacks/agentic-browser-resurrected-web-threats.mdA May 2026 paper builds the first web-focused threat model for agentic browsers and shows that 10 long-mitigated web attacks come back — often amplified — because the agent is a confused deputy that cannot tell a task step from a web trap.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ai-control-roadmap-deepmind.mdhttps://www.llm-hacking.com/hacks/ai-control-roadmap-deepmind.mdGoogle DeepMind's AI Control Roadmap (June 2026) treats internal AI agents as potential insider threats, layering trusted-supervisor monitoring on top of model alignment.Sun, 21 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/autojack-browsing-agent-localhost-rce.mdhttps://www.llm-hacking.com/hacks/autojack-browsing-agent-localhost-rce.mdMicrosoft's June 18, 2026 AutoJack research shows a web-browsing AI agent inheriting localhost identity to reach a local MCP WebSocket and spawn arbitrary processes on the host.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/azure-mcp-server-missing-auth-cve-2026-32211.mdhttps://www.llm-hacking.com/hacks/azure-mcp-server-missing-auth-cve-2026-32211.mdMicrosoft disclosed CVE-2026-32211 on 2 April 2026 — a missing-authentication flaw in Azure MCP Server that lets an unauthenticated attacker disclose information over the network. Microsoft scored it 9.1; NVD, 7.5.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/backdoor-unlearning-generalizes.mdhttps://www.llm-hacking.com/hacks/backdoor-unlearning-generalizes.mdA June 2026 paper shows that teaching an LLM to ignore one backdoor trigger can also weaken other, never-targeted backdoors — when their internal activation shifts are close, measured by a new metric called CASD.Sun, 21 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/cognitive-overload-visual-degradation-jailbreak.mdhttps://www.llm-hacking.com/hacks/cognitive-overload-visual-degradation-jailbreak.mdA May 2026 paper (Findings of ACL 2026) shows that lowering the resolution of text rendered as an image pushes frontier MLLMs into an 'Attack Comfort Zone' where safety alignment collapses while OCR stays accurate.Sun, 21 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/criminal-ai-as-a-service-2026.mdhttps://www.llm-hacking.com/hacks/criminal-ai-as-a-service-2026.mdA June 11, 2026 Rapid7 report finds the criminal AI market has shifted from 'evil chatbots' to a productivity layer: jailbreak wrappers, stolen accounts and deepfake-for-KYC services that scale ordinary crime.Sun, 21 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/ctf-framing-jailbreak-exploit-fingerprint.mdhttps://www.llm-hacking.com/hacks/ctf-framing-jailbreak-exploit-fingerprint.mdSysdig (June 15, 2026) caught operators jailbreaking their own coding assistants by framing exploit requests as CTF or CVE-hunting — and the framing bleeds into User-Agents, passwords and IAM logs, leaving a cheap defender fingerprint.Sun, 21 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/defensive-misdirection-automated-jailbreaks.mdhttps://www.llm-hacking.com/hacks/defensive-misdirection-automated-jailbreaks.mdA June 2026 paper models the attacker's automated judge and shows that predictable refusals feed the search loop — proposing controlled misdirection instead of plain blocking.Sun, 21 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/gemini-mcp-tool-command-injection-cve-2026-0755.mdhttps://www.llm-hacking.com/hacks/gemini-mcp-tool-command-injection-cve-2026-0755.mdA June 18, 2026 advisory details how the popular gemini-mcp-tool let untrusted prompt input reach the shell and the Gemini CLI @file parser — CVSS 9.8 RCE and arbitrary file exfiltration, fixed in 1.1.6.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/geminijack-gemini-enterprise-rag-exfiltration.mdhttps://www.llm-hacking.com/hacks/geminijack-gemini-enterprise-rag-exfiltration.mdDisclosed December 2025, GeminiJack let a single shared Doc, calendar invite or email silently exfiltrate Gmail, Calendar and Docs data through Gemini Enterprise's RAG — the enterprise-RAG exfiltration class OWASP now ranks first.Sun, 21 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/image-prompt-reconstruction-distributed-mllm.mdhttps://www.llm-hacking.com/hacks/image-prompt-reconstruction-distributed-mllm.mdA June 2026 paper shows a passive participant in a distributed multimodal-LLM pipeline can rebuild the user's input image from the intermediate embeddings it relays. Black-box, no model weights needed.Sun, 21 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/llm-salting-refusal-direction-jailbreak-defense.mdhttps://www.llm-hacking.com/hacks/llm-salting-refusal-direction-jailbreak-defense.mdSophosAI's 'LLM salting' (CAMLIS 2025) applies a small rotation to a model's refusal direction so that a jailbreak precomputed against the base model no longer transfers to your deployment — the rainbow-table defense, applied to LLMs.Sun, 21 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mastra-npm-scope-takeover-easy-day-js.mdhttps://www.llm-hacking.com/hacks/mastra-npm-scope-takeover-easy-day-js.mdOn June 17, 2026, a forgotten contributor account republished the entire @mastra npm scope — ~142 packages — with one malicious dependency that drops a crypto stealer and RAT. A stale credential, not a zero-day.Sun, 21 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/message-object-injection-serialization-gap.mdhttps://www.llm-hacking.com/hacks/message-object-injection-serialization-gap.mdImperva showed (June 10, 2026) that contacts, vCards and location pins get flattened inline into an AI assistant's prompt with no untrusted-content boundary — a structural injection vector, patched in OpenClaw 2026.4.23.Sun, 21 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/overeager-coding-agents-out-of-scope-actions.mdhttps://www.llm-hacking.com/hacks/overeager-coding-agents-out-of-scope-actions.mdTwo May 2026 benchmarks measure coding agents that overstep on benign requests — deleting files, wiping credentials — and find the agent framework, not the model, drives the risk.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/propme-memorization-propensity.mdhttps://www.llm-hacking.com/hacks/propme-memorization-propensity.mdA June 2026 framework, PropMe, separates what a model CAN leak under attack from what it WILL leak in ordinary use. The gap is wide — and audits that ignore it misstate real-world risk.Sun, 21 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/scheming-in-the-wild-osint-monitoring.mdhttps://www.llm-hacking.com/hacks/scheming-in-the-wild-osint-monitoring.mdA March 2026 CLTR report mined 183,000 public AI transcripts and found 698 real-world 'scheming-related' incidents, up 4.9x in five months — and a new way to watch for agent loss of control.Sun, 21 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/sleeper-memory-poisoning.mdhttps://www.llm-hacking.com/hacks/sleeper-memory-poisoning.mdA May 2026 paper shows attackers can plant fabricated 'memories' through a document or webpage that lie dormant, then steer an assistant's actions across many later sessions.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/tool-selection-hijacking.mdhttps://www.llm-hacking.com/hacks/tool-selection-hijacking.mdAn NDSS 2026 attack and an April 2026 IBM paper target the same blind spot: the step where an agent chooses which tool to call. Poison the catalog and the agent picks yours, with 70–100% success.Sun, 21 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/chatgphish-summary-markdown-phishing.mdhttps://www.llm-hacking.com/hacks/chatgphish-summary-markdown-phishing.mdPermiso disclosed ChatGPhish on 29 May 2026: a web page you ask ChatGPT to summarize can render attacker links, fake alerts, QR codes and tracking pixels inside the trusted assistant UI.Sat, 20 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/code-augur-spec-first-vuln-detection.mdhttps://www.llm-hacking.com/hacks/code-augur-spec-first-vuln-detection.mdOn June 17, 2026, NUS researchers released Code-Augur, a harness that makes LLM-agent code audits checkable by forcing agents to commit their security assumptions as falsifiable in-source assertions.Sat, 20 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/cross-session-stored-prompt-injection.mdhttps://www.llm-hacking.com/hacks/cross-session-stored-prompt-injection.mdA June 2026 arXiv paper reframes prompt injection as a stored, cross-session problem: once adversarial text lands in an agent's persistent state, it can steer executions long after the attacker is gone.Sat, 20 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cybersecurity-refusal-framework-environmental-context.mdhttps://www.llm-hacking.com/hacks/cybersecurity-refusal-framework-environmental-context.mdA new benchmark shows agent safety refusals key off the URL string, not the real target. Two trivial tricks — fake 'rules of engagement' and localhost proxying — flip refusal into compliance on production sites.Sat, 20 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/dp-adaptation-empirical-privacy-gap.mdhttps://www.llm-hacking.com/hacks/dp-adaptation-empirical-privacy-gap.mdAn ICLR 2026 benchmark shows that a clean differential-privacy budget does not equal real protection: when fine-tuning data resembles the pretraining corpus, membership inference and canary extraction still succeed.Sat, 20 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/llm-agent-salesforce-aura-exploitation.mdhttps://www.llm-hacking.com/hacks/llm-agent-salesforce-aura-exploitation.mdOn June 8, 2026, Reco published an agent that maps, fuzzes and exploits Salesforce Experience Cloud sites with no human in the loop — the same misconfigurations ShinyHunters has been mining since 2025, now driven by a model.Sat, 20 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/mcp-defense-placement-taxonomy.mdhttps://www.llm-hacking.com/hacks/mcp-defense-placement-taxonomy.mdAn April 2026 arXiv paper maps MCP attacks across six architectural layers and finds defenses are uneven and disproportionately tool-centric — leaving host orchestration, transport and supply-chain layers structurally under-defended.Sat, 20 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mempoison-conversational-memory-backdoor.mdhttps://www.llm-hacking.com/hacks/mempoison-conversational-memory-backdoor.mdA May 2026 arXiv paper plants a triggerable backdoor in an LLM agent's long-term memory just by chatting with it — and is engineered to survive the selective extraction and rewriting stages meant to filter poisoned content.Sat, 20 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/multimodal-peer-review-cross-modal-attacks.mdhttps://www.llm-hacking.com/hacks/multimodal-peer-review-cross-modal-attacks.mdA June 2026 arXiv paper (PaperGuard) shows AI peer reviewers are vulnerable not only through text but through figures — black-box prompt injection and white-box image perturbations both flip verdicts.Sat, 20 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/nrt-bench-multi-turn-redteam-safety-critical-agents.mdhttps://www.llm-hacking.com/hacks/nrt-bench-multi-turn-redteam-safety-critical-agents.mdA June 18, 2026 benchmark puts LLM operator agents in a simulated nuclear control room. Adaptive multi-turn attacks pushed the team past a safety limit in 8.7-12.1% of sessions — and the failures barely overlap across models.Sat, 20 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/prompt-injection-localization-forensics.mdhttps://www.llm-hacking.com/hacks/prompt-injection-localization-forensics.mdDetecting a prompt injection only tells you something is wrong. Two 2026 papers, PromptLocate and WebSentinel, pinpoint exactly which span of context is poisoned so it can be excised and the task recovered.Sat, 20 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ragflow-prompt-ssti-cve-2026-45312.mdhttps://www.llm-hacking.com/hacks/ragflow-prompt-ssti-cve-2026-45312.mdA Jinja2 template injection in RAGFlow's prompt generator turns a user-controlled prompt field into server-side RCE. CVSS 9.9, disclosed May 9, 2026.Sat, 20 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/rl-jailbreak-reward-episode-drivers.mdhttps://www.llm-hacking.com/hacks/rl-jailbreak-reward-episode-drivers.mdA June 2026 study deconstructs reinforcement-learning jailbreaking and finds the attacker's environment design — dense rewards and long episodes — matters more than the RL algorithm.Sat, 20 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/seagent-mac-agent-privilege-escalation.mdhttps://www.llm-hacking.com/hacks/seagent-mac-agent-privilege-escalation.mdA January 2026 paper reframes agent attacks as privilege escalation — actions exceeding the least privilege a task needs — and proposes SEAgent, a deterministic MAC/ABAC layer that enforces policy over an information-flow graph.Sat, 20 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/service-side-exfiltration-deep-research-agents.mdhttps://www.llm-hacking.com/hacks/service-side-exfiltration-deep-research-agents.mdA hidden instruction in a single email made ChatGPT's Deep Research agent leak inbox data from OpenAI's own cloud — no rendering, no user action, invisible to network defenses. Here is the class and how to contain it.Sat, 20 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/tracesafe-mid-trajectory-guardrail-gap.mdhttps://www.llm-hacking.com/hacks/tracesafe-mid-trajectory-guardrail-gap.mdAn April 2026 benchmark of 20 guardrails finds that for agents, detection strength comes from parsing tool-call traces, not from safety alignment — and general-purpose LLMs beat dedicated safety models.Sat, 20 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/uniattack-multi-defense-jailbreak.mdhttps://www.llm-hacking.com/hacks/uniattack-multi-defense-jailbreak.mdA June 2026 preprint builds an automated, strategy-mixing red-teaming framework and runs it against models with different stacked defenses — finding that layering guardrails does not guarantee robustness.Sat, 20 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/vertex-ai-double-agents-service-agent-privilege.mdhttps://www.llm-hacking.com/hacks/vertex-ai-double-agents-service-agent-privilege.mdUnit 42 showed (31 March 2026) that a Vertex AI Agent Engine deployment exposes an over-scoped service-agent credential via the metadata service — turning a misconfigured agent into a path to read every bucket in the project.Sat, 20 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/vllm-ssrf-parser-differential-bypass.mdhttps://www.llm-hacking.com/hacks/vllm-ssrf-parser-differential-bypass.mdTwo vLLM advisories show the same flaw twice: a host allowlist validated with one URL parser and fetched with another. The fix swapped the parser pair and reopened the bypass.Sat, 20 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/web-agent-persuasion-injection-trap.mdhttps://www.llm-hacking.com/hacks/web-agent-persuasion-injection-trap.mdAn Oxford benchmark updated on arXiv in June 2026 shows web agents obey Cialdini-style persuasion hidden in page elements, abandoning their task in 25% of cases on average and up to 43% for the weakest model.Sat, 20 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/agent-libos-capability-runtime-authority.mdhttps://www.llm-hacking.com/hacks/agent-libos-capability-runtime-authority.mdA June 2, 2026 arXiv paper argues most agent frameworks conflate tool visibility with resource authority — and proposes a library-OS runtime where capability checks live at primitive boundaries, not in tool wrappers.Fri, 19 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/authgraph-dual-graph-injection-defense.mdhttps://www.llm-hacking.com/hacks/authgraph-dual-graph-injection-defense.mdA May 26, 2026 UCLA paper compares a clean authorization graph against the agent's actual provenance graph, cutting AgentDojo attack success from 40% to 1%.Fri, 19 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/authority-confusion-agent-runtime-guard.mdhttps://www.llm-hacking.com/hacks/authority-confusion-agent-runtime-guard.mdA May 2026 paper names a failure mode distinct from prompt injection: untrusted data should inform an agent's reasoning but never authorize side effects. AIRGuard enforces that line at action time.Fri, 19 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/chat-template-ssti-inference-servers.mdhttps://www.llm-hacking.com/hacks/chat-template-ssti-inference-servers.mdCERT/CC's VU#915947 (April 20, 2026) documents CVE-2026-5760, a CVSS 9.8 RCE in SGLang: a malicious GGUF model file carries a Jinja2 chat template that runs Python on the server. It is the same class as Llama Drama and a vLLM flaw before it.Fri, 19 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/cordon-semantic-transactions-agent-runtime.mdhttps://www.llm-hacking.com/hacks/cordon-semantic-transactions-agent-runtime.mdA June 16, 2026 arXiv paper proposes 'semantic transactions': a runtime that stages an agent's irreversible tool effects and validates the whole task flow before any commit.Fri, 19 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/cursor-git-hook-bare-repo-rce.mdhttps://www.llm-hacking.com/hacks/cursor-git-hook-bare-repo-rce.mdA malicious repo hides a bare Git repository with an automatic hook. When Cursor's AI agent runs git checkout to 'explain the codebase', the hook fires — arbitrary code execution on the developer's machine, no approval prompt. Patched in Cursor 2.5.Fri, 19 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/error-path-injection-implicit-authority.mdhttps://www.llm-hacking.com/hacks/error-path-injection-implicit-authority.mdA June 2026 paper (VATS) shows that injecting instructions inside tool error messages triples indirect-injection success on frontier agents — up to 100% compliance — because models treat error output as authoritative.Fri, 19 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/first-2026-midyear-cve-forecast.mdhttps://www.llm-hacking.com/hacks/first-2026-midyear-cve-forecast.mdOn June 15, 2026, FIRST revised its 2026 CVE projection to ~66,000 — 46.3% above February — driven mainly by AI-assisted discovery. The actionable subset triaged by EPSS and CISA KEV has not grown at the same rate.Fri, 19 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/langchain-core-prompt-path-traversal.mdhttps://www.llm-hacking.com/hacks/langchain-core-prompt-path-traversal.mdCVE-2026-34070 lets crafted prompt configs walk LangChain's filesystem via load_prompt, exposing .txt/.json/.yaml secrets. Disclosed March 27, 2026, fixed in langchain-core 1.2.22.Fri, 19 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/maltool-malicious-tool-code-agents.mdhttps://www.llm-hacking.com/hacks/maltool-malicious-tool-code-agents.mdResearchers used a coding LLM to synthesize 6,487 working malicious agent tools. VirusTotal missed most of them. The lesson: signature scanning is the wrong control for agent tool supply chains.Fri, 19 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/mcp-go-sdk-cross-site-tool-execution.mdhttps://www.llm-hacking.com/hacks/mcp-go-sdk-cross-site-tool-execution.mdThe official MCP Go SDK accepted cross-site browser POSTs without checking the Origin header. On an unauthenticated local server, any website you visit could invoke your tools. Patched in 1.4.1.Fri, 19 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/on-device-llm-injection-parity.mdhttps://www.llm-hacking.com/hacks/on-device-llm-injection-parity.mdBrave's June 8, 2026 research shows indirect prompt injection works identically against a cloud browsing agent (Mozilla Tabstack) and an on-device autocomplete (Cotypist) — local hosting is not a mitigation.Fri, 19 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/oracle-poisoning-knowledge-graph-agent-reasoning.mdhttps://www.llm-hacking.com/hacks/oracle-poisoning-knowledge-graph-agent-reasoning.mdA paper published on arXiv on May 10, 2026 defines Oracle Poisoning: corrupt the knowledge graph an agent queries at runtime and it reaches wrong conclusions through correct reasoning. Across nine models, trust in poisoned data hit 100% under directed agentic queries.Fri, 19 Jun 2026 00:00:00 GMTDATA POISONINGhttps://www.llm-hacking.com/hacks/rag-knowledge-access-security-surfaces.mdhttps://www.llm-hacking.com/hacks/rag-knowledge-access-security-surfaces.mdA June 2026 survey reframes RAG security around external knowledge access, separating inherent LLM flaws from RAG-introduced risk across four surfaces and three trust boundaries.Fri, 19 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/rapid-poison-jailbreak-defense-poisoning.mdhttps://www.llm-hacking.com/hacks/rapid-poison-jailbreak-defense-poisoning.mdA June 15, 2026 arXiv paper shows the proliferation step inside Rapid Response jailbreak defenses can be poisoned at a 1% rate — forcing up to 100% false positives or 96% false negatives in the guard classifier.Fri, 19 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/semantic-kernel-prompt-injection-rce.mdhttps://www.llm-hacking.com/hacks/semantic-kernel-prompt-injection-rce.mdMicrosoft's AI Red Team showed two Semantic Kernel flaws that turn a single injected prompt into host code execution. The lesson: any tool parameter the model can influence is attacker-controlled input. Patched May 7, 2026.Fri, 19 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/serving-layer-attack-surface-grief.mdhttps://www.llm-hacking.com/hacks/serving-layer-attack-surface-grief.mdA May 2026 fuzzer, GRIEF, treats concurrent request traces as inputs and finds 15 serving-layer bugs (2 CVEs) in vLLM and SGLang: cross-request output contamination, noisy-neighbor DoS, and delayed crashes — no malformed input required.Fri, 19 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/skillattack-agent-skill-red-teaming.mdhttps://www.llm-hacking.com/hacks/skillattack-agent-skill-red-teaming.mdAn April 2026 paper, SkillAttack, reframes exploit discovery as a path-search problem and shows even well-intentioned agent skills are reachable — up to 0.93 attack success on adversarial skills.Fri, 19 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/text-safety-tool-call-gap.mdhttps://www.llm-hacking.com/hacks/text-safety-tool-call-gap.mdA February 2026 benchmark of six frontier models finds that text-level safety does not transfer to tool calls. A model can say no in words while query_records() says yes — and one model does it on four of five refusals.Fri, 19 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/user-mediated-attacks-web-planning-agents.mdhttps://www.llm-hacking.com/hacks/user-mediated-attacks-web-planning-agents.mdA January 2026 study of 12 commercial agents shows attackers don't need to touch the agent. They trick a benign user into forwarding poisoned content — which the instruction hierarchy then promotes to trusted user intent. Default bypass rates topped 92%.Fri, 19 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/adaptive-jailbreaks-break-defenses.mdhttps://www.llm-hacking.com/hacks/adaptive-jailbreaks-break-defenses.mdA June 2026 framework, UniAttack, composes reusable attack features into one-shot jailbreaks that transfer across models and defenses — a reminder that any defense tested only against static attacks gives false assurance.Thu, 18 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/agent-defenses-dont-compose.mdhttps://www.llm-hacking.com/hacks/agent-defenses-dont-compose.mdA June 2026 systematization of 247 papers finds agent defenses are useful building blocks but weakly compositional, and benchmarks still miss long-horizon, stateful risk.Thu, 18 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/agent-security-lifecycle-sok.mdhttps://www.llm-hacking.com/hacks/agent-security-lifecycle-sok.mdA June 9, 2026 arXiv survey of 247 papers maps LLM-agent security onto the agentic loop and finds defenses that work in isolation but barely compose — and benchmarks that miss long-horizon, stateful risk.Thu, 18 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/agent-threat-surface-247-paper-sok.mdhttps://www.llm-hacking.com/hacks/agent-threat-surface-247-paper-sok.mdA June 2026 survey of 247 papers measures where LLM-agent attacks land. User prompts are only one surface among several — mediated channels like web content and tool outputs dominate.Thu, 18 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/behavioral-geometry-jailbreak-susceptibility.mdhttps://www.llm-hacking.com/hacks/behavioral-geometry-jailbreak-susceptibility.mdA May 26, 2026 arXiv paper maps 79 models into a 'behavioral geometry' to predict which are jailbreak-prone — with 98% fewer probes — and to transfer defenses between them.Thu, 18 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/black-hole-attack-vector-database-hubness.mdhttps://www.llm-hacking.com/hacks/black-hole-attack-vector-database-hubness.mdAn April 7, 2026 paper shows a few vectors placed near the embedding centroid get pulled into up to 99.85% of top-10 results — a query-agnostic, model-agnostic poisoning of vector databases.Thu, 18 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/browser-agent-fingerprinting-ui-traces.mdhttps://www.llm-hacking.com/hacks/browser-agent-fingerprinting-ui-traces.mdA May 14, 2026 paper shows the on-page actions of an LLM browser agent fingerprint the underlying model with up to 96% accuracy across 14 frontier models — no spoofable headers needed.Thu, 18 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/deepmind-ai-agent-traps-taxonomy.mdhttps://www.llm-hacking.com/hacks/deepmind-ai-agent-traps-taxonomy.mdGoogle DeepMind's 'AI Agent Traps' paper (SSRN, late March 2026) gives the first systematic taxonomy of adversarial web content that targets an agent's perception, reasoning, memory, action, multi-agent dynamics, and human overseer.Thu, 18 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/doubtprobe-jailbreak-defense.mdhttps://www.llm-hacking.com/hacks/doubtprobe-jailbreak-defense.mdA June 2026 paper proposes an inference-time defense that treats jailbreak detection as a consistency check: rebuild the request under structural constraints, then flag the prompts whose meaning won't survive the round-trip.Thu, 18 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/execution-provenance-evidence-tracing-agents.mdhttps://www.llm-hacking.com/hacks/execution-provenance-evidence-tracing-agents.mdA June 2026 arXiv survey (2606.04990) systematizes evidence tracing and execution provenance for LLM agents — the accountability layer that lets you audit, debug, and verify what an agent actually did.Thu, 18 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/ghost-tool-calls-speculative-agent-privacy.mdhttps://www.llm-hacking.com/hacks/ghost-tool-calls-speculative-agent-privacy.mdA June 2026 arXiv paper (2606.02483) shows that agents which speculatively pre-issue tool calls to hide latency leak inferred user intent to external services — and that the leak is a timing problem no allow-list can undo.Thu, 18 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/litellm-host-header-auth-bypass-cve-2026-49468.mdhttps://www.llm-hacking.com/hacks/litellm-host-header-auth-bypass-cve-2026-49468.mdDisclosed June 17, 2026, CVE-2026-49468 lets a crafted Host header desync LiteLLM's auth route from the route FastAPI runs — an app-layer repeat of BadHost, fixed in LiteLLM 1.84.0.Thu, 18 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/litellm-low-priv-to-admin-rce-chain.mdhttps://www.llm-hacking.com/hacks/litellm-low-priv-to-admin-rce-chain.mdObsidian Security disclosed a three-bug LiteLLM chain (June 2026) that walks a default low-privilege user up to proxy_admin and remote code execution — a CVSS 9.9 takeover of the AI gateway.Thu, 18 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/model-code-backdoor-finetuning-theft.mdhttps://www.llm-hacking.com/hacks/model-code-backdoor-finetuning-theft.mdA 30 April 2026 paper shows that tampered model code — not poisoned weights — can steal API keys and PII from local fine-tuning data, reaching >98% recovery while bypassing DP-SGD and audits.Thu, 18 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/near-ultrasonic-voice-llm-jailbreak.mdhttps://www.llm-hacking.com/hacks/near-ultrasonic-voice-llm-jailbreak.mdA March 14, 2026 paper from Huazhong, Tsinghua and Microsoft hides jailbreak prompts in the 17–22 kHz band. Microphone nonlinearity demodulates them back into commands — silent to humans, up to 0.94 non-refusal on commercial voice LLMs.Thu, 18 Jun 2026 00:00:00 GMTMULTIMODALhttps://www.llm-hacking.com/hacks/safemcp-lookahead-power-regulation.mdhttps://www.llm-hacking.com/hacks/safemcp-lookahead-power-regulation.mdA June 1, 2026 arXiv paper (ACL 2026) proposes SafeMCP, a server-side plugin that uses world-model look-ahead to filter hazardous tool acquisition before an MCP agent over-expands its powers.Thu, 18 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/searchgeo-search-agent-endorsement-corruption.mdhttps://www.llm-hacking.com/hacks/searchgeo-search-agent-endorsement-corruption.mdA June 15, 2026 arXiv paper measures how attacker-controlled web content gets turned into an agent's endorsed recommendation — attack success ranges from 0% to 31.4% depending on the backend model.Thu, 18 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/shadowmerge-graph-memory-relation-channel-poisoning.mdhttps://www.llm-hacking.com/hacks/shadowmerge-graph-memory-relation-channel-poisoning.mdA May 2026 paper poisons graph-based agent memory with relations that share a real anchor and channel but carry a conflicting value — reaching 93.8% attack success on Mem0 while input-side filters miss it.Thu, 18 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/skillvetbench-llm-judge-skill-vetting.mdhttps://www.llm-hacking.com/hacks/skillvetbench-llm-judge-skill-vetting.mdA June 14, 2026 arXiv paper shows code-layer skill scanners miss 89–100% of instruction-layer threats, while an LLM-as-Judge flags all 78 malicious test skills with zero false positives.Thu, 18 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/tokenizer-membership-inference.mdhttps://www.llm-hacking.com/hacks/tokenizer-membership-inference.mdA USENIX Security 2026 paper shows a model's tokenizer alone can leak which datasets were used in pre-training — a cheaper, model-free membership inference attack.Thu, 18 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/trifecta-default-runtime-detection.mdhttps://www.llm-hacking.com/hacks/trifecta-default-runtime-detection.mdThe lethal trifecta once flagged risky agents. By mid-2026 it describes every useful one, so architecture-level avoidance no longer works. Defense shifts to five runtime behavioral signals.Thu, 18 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/zombie-agents-self-evolving-persistence.mdhttps://www.llm-hacking.com/hacks/zombie-agents-self-evolving-persistence.mdA one-time indirect injection observed during a benign session can be written to an agent's long-term memory and later replayed as instruction — turning a transient prompt into persistent control. Attack paper dated February 2026, defense (CAMS) May 2026.Thu, 18 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/coding-agent-credential-identity-gap.mdhttps://www.llm-hacking.com/hacks/coding-agent-credential-identity-gap.mdSix 2026 exploits against Codex, Claude Code, Copilot and Vertex AI all bypassed model-level defenses and reached the same target — the agent's runtime credentials. The root cause is an identity governance gap, not a prompt problem.Wed, 17 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cold-start-safety-gap-llm-agents.mdhttps://www.llm-hacking.com/hacks/cold-start-safety-gap-llm-agents.mdA June 2026 paper finds tool-calling agents are most vulnerable at the start of a session and grow 9–52% safer after a few routine tasks. The fix is a deployment warm-up, not a new guardrail.Wed, 17 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/dummy-backdoor-removal-defense.mdhttps://www.llm-hacking.com/hacks/dummy-backdoor-removal-defense.mdA June 2026 paper removes hidden backdoors you can't see by planting one you can: different backdoors share internal activation patterns, so deleting a controllable 'dummy' weakens the unknown one too.Wed, 17 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/eu-ai-act-high-risk-agentic-classification.mdhttps://www.llm-hacking.com/hacks/eu-ai-act-high-risk-agentic-classification.mdThe European Commission's 19 May 2026 draft guidelines on Article 6 say agentic AI systems must be assessed as a whole — a single narrow component can pull the entire configuration into the high-risk regime.Wed, 17 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/fragfuse-fragmented-query-access-bypass.mdhttps://www.llm-hacking.com/hacks/fragfuse-fragmented-query-access-bypass.mdA June 14, 2026 arXiv paper shows a banned request can be split into benign fragments, parked in an agent's long-term memory, then fused at retrieval time — bypassing access controls 86.3% of the time.Wed, 17 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/guardrail-reasoning-dos.mdhttps://www.llm-hacking.com/hacks/guardrail-reasoning-dos.mdA June 2026 paper shows a single poisoned document can trap reasoning-based AI guardrails in extended thinking loops, slowing shared agent workflows by up to 148x. The target is availability, not integrity.Wed, 17 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/involuntary-in-context-learning-pattern-completion.mdhttps://www.llm-hacking.com/hacks/involuntary-in-context-learning-pattern-completion.mdAn April 2026 arXiv paper turns a model's own in-context learning against it: about ten abstract-operator examples make GPT-5.4 complete a harmful pattern its content filters never flag.Wed, 17 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/jailbreak-tax-capability-retention.mdhttps://www.llm-hacking.com/hacks/jailbreak-tax-capability-retention.mdAn April 2026 study shows the capability loss a jailbreak used to cause shrinks as models get stronger: Haiku 4.5 drops 33.1% when jailbroken, Opus 4.6 only 7.7%. Safety cases that assume a jailbroken model is a degraded one no longer hold.Wed, 17 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/langgraph-checkpointer-sqli-to-rce.mdhttps://www.llm-hacking.com/hacks/langgraph-checkpointer-sqli-to-rce.mdCheck Point Research chained a SQL injection in LangGraph's checkpointer with an unsafe msgpack deserialization to reach remote code execution. Disclosed June 11, 2026; all three CVEs are patched.Wed, 17 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/litellm-teampcp-supply-chain-attack.mdhttps://www.llm-hacking.com/hacks/litellm-teampcp-supply-chain-attack.mdIn March 2026, attackers stole LiteLLM's PyPI publishing token by compromising Trivy inside its CI pipeline, then shipped two backdoored releases. The chain shows why the LLM gateway is a high-value supply-chain target.Wed, 17 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/llm-inference-side-channels.mdhttps://www.llm-hacking.com/hacks/llm-inference-side-channels.mdSpeculative decoding and streaming responses create traffic patterns that leak prompt topics, languages, even PII — through encrypted connections. A look at three papers and the defenses.Wed, 17 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/logjack-cloud-log-injection-debugging-agents.mdhttps://www.llm-hacking.com/hacks/logjack-cloud-log-injection-debugging-agents.mdAn April 2026 benchmark shows LLM debugging agents that read cloud logs and run fixes obey instructions hidden in log lines — verbatim command execution up to 86.2%, RCE on 6 of 8 models, and provider guardrails that miss almost everything.Wed, 17 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/looptrap-termination-poisoning.mdhttps://www.llm-hacking.com/hacks/looptrap-termination-poisoning.mdA May 2026 arXiv paper shows that injected prompts can distort an agent's own 'am I done?' judgment, forcing unbounded computation. The LoopTrap framework reports up to 25x step amplification.Wed, 17 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/m3att-medical-rag-knowledge-poisoning.mdhttps://www.llm-hacking.com/hacks/m3att-medical-rag-knowledge-poisoning.mdA May 2026 paper poisons medical image-text RAG without knowing user queries in advance. Imperceptible image perturbations hijack retrieval; ambiguity-guided text evades the model's self-correction — and pre-filter defenses barely dent it.Wed, 17 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/mcp-tool-call-attack-detection.mdhttps://www.llm-hacking.com/hacks/mcp-tool-call-attack-detection.mdA May 2026 arXiv study of MCP tool-call monitoring finds content embeddings drive detection (AUROC > 0.89), graph structure adds little, and naive random splits inflate scores by up to 26 points.Wed, 17 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mirage-mobile-gui-agent-ugc-injection.mdhttps://www.llm-hacking.com/hacks/mirage-mobile-gui-agent-ugc-injection.mdA May 2026 study shows VLM-driven mobile GUI agents can't tell trusted interface from user-generated content. Realistic text injected into comments and bios hijacks all five tested agents (23–30% success).Wed, 17 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/open-weight-safeguards-gradient-free-attacks.mdhttps://www.llm-hacking.com/hacks/open-weight-safeguards-gradient-free-attacks.mdA May 2026 CMU study shows tamper-resistant safeguards like TAR and SEAM — built to survive malicious fine-tuning — are bypassed by two cheap gradient-free attacks: abliteration and prefilling.Wed, 17 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/quality-diversity-red-teaming-llm-safety.mdhttps://www.llm-hacking.com/hacks/quality-diversity-red-teaming-llm-safety.mdTwo June 2026 papers apply quality-diversity evolutionary search to LLM red teaming, surfacing many distinct vulnerability classes per model instead of a single best attack — and showing safety can regress between model generations.Wed, 17 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/reprompt-copilot-p2p-url-injection.mdhttps://www.llm-hacking.com/hacks/reprompt-copilot-p2p-url-injection.mdA patched Copilot Personal flaw chained a prefilled-URL prompt, a guardrail that only checked the first request, and server-driven follow-ups into stealthy one-click data exfiltration. The bypass lessons generalise.Wed, 17 Jun 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/rubas-rubric-rl-agent-safety.mdhttps://www.llm-hacking.com/hacks/rubas-rubric-rl-agent-safety.mdA June 2026 paper replaces coarse refuse/comply rewards with four scored rubrics — tool-use, argument, response and helpfulness — to train tool-calling agents that stay safe without losing utility.Wed, 17 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/semantic-compliance-hijacking-skills.mdhttps://www.llm-hacking.com/hacks/semantic-compliance-hijacking-skills.mdA May 14, 2026 arXiv paper shows a skill file with no code and no explicit harmful intent can steer a coding agent into writing its own malware at runtime — with a 0.00% detection rate against current scanners.Wed, 17 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/skillguard-agent-skill-permissions.mdhttps://www.llm-hacking.com/hacks/skillguard-agent-skill-permissions.mdA June 2026 paper closes the gap between what a skill injects into an agent's context and what it makes the agent do, using manifests, deny-by-default access control and runtime monitoring.Wed, 17 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agent-security-transitions-not-components.mdhttps://www.llm-hacking.com/hacks/agent-security-transitions-not-components.mdA June 2026 synthesis of 247 papers reframes LLM-agent security around state transitions: harm happens when untrusted text silently becomes a plan, a decision, an action, or durable memory.Tue, 16 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/agentjacking-sentry-mcp-coding-agents.mdhttps://www.llm-hacking.com/hacks/agentjacking-sentry-mcp-coding-agents.mdTenet Security's June 2026 research shows an attacker can plant a fake Sentry error that AI coding agents read over MCP and execute, exfiltrating credentials with an 85% success rate across 2,388 exposed orgs.Tue, 16 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/ai-bioweapon-dna-synthesis-screening.mdhttps://www.llm-hacking.com/hacks/ai-bioweapon-dna-synthesis-screening.mdOn June 5, 2026, the heads of OpenAI, Anthropic, Google DeepMind and Microsoft AI co-signed a letter urging Congress to require nucleic-acid synthesis screening — framing it as a defensive control against AI-eroded bioweapon barriers.Tue, 16 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/anthropic-disclosure-ledger-cvd-at-scale.mdhttps://www.llm-hacking.com/hacks/anthropic-disclosure-ledger-cvd-at-scale.mdAnthropic's coordinated-disclosure ledger, analysed by VulnCheck on June 9, 2026, shows AI surfacing 23,019 candidate bugs while just 1,596 reached maintainers — a preview of coordinated disclosure under machine-speed discovery.Tue, 16 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/cross-app-context-poisoning-chatgpt-apps.mdhttps://www.llm-hacking.com/hacks/cross-app-context-poisoning-chatgpt-apps.mdA June 2026 arXiv study shows a malicious ChatGPT app can write into the chat context shared by every connected app through first-party APIs, turning the model into a confused deputy against benign apps.Tue, 16 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/cross-domain-multi-agent-security.mdhttps://www.llm-hacking.com/hacks/cross-domain-multi-agent-security.mdA Perspective published June 13, 2026 in npj Artificial Intelligence maps seven security challenges that appear when LLM agents from different organizations collaborate without any shared trust model.Tue, 16 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/graph-memory-selection-integrity.mdhttps://www.llm-hacking.com/hacks/graph-memory-selection-integrity.mdAn arXiv paper dated June 10, 2026 shows provenance checks on LLM graph memory can be bypassed without forging a single source: untrusted structure reroutes which authenticated facts get selected, and information-flow control never sees it.Tue, 16 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/graphsteal-knowledge-graph-reconstruction.mdhttps://www.llm-hacking.com/hacks/graphsteal-knowledge-graph-reconstruction.mdA paper posted May 27, 2026 shows that black-box queries can turn a Graph RAG system into a structural oracle, rebuilding over 90% of its hidden knowledge graph — entities, relations and all.Tue, 16 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/hamlock-hardware-model-split-backdoor.mdhttps://www.llm-hacking.com/hacks/hamlock-hardware-model-split-backdoor.mdA USENIX Security 2026 paper, covered June 15, 2026, splits a neural-network backdoor across software and silicon — the model alone never misclassifies, so software-only scanners like Neural Cleanse and MNTD find nothing.Tue, 16 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/langflow-files-path-traversal-cve-2026-5027.mdhttps://www.llm-hacking.com/hacks/langflow-files-path-traversal-cve-2026-5027.mdA path traversal in Langflow's /api/v2/files endpoint lets an unauthenticated request write files anywhere on disk. VulnCheck confirmed in-the-wild exploitation on June 9, 2026; ~7,000 instances are exposed.Tue, 16 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/nist-godel-guardrails-impossibility.mdhttps://www.llm-hacking.com/hacks/nist-godel-guardrails-impossibility.mdA NIST scientist used Gödel's incompleteness logic to prove that any finite set of AI guardrails can be evaded by some prompt — the case for a continuous monitor-and-update security model.Tue, 16 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/ocelot-inference-leakage-budgets.mdhttps://www.llm-hacking.com/hacks/ocelot-inference-leakage-budgets.mdAn arXiv paper dated June 10, 2026 reframes LLM-agent privacy as posterior-risk control: not filtering each output, but budgeting how much an adversary's belief about a secret may improve across a whole trajectory.Tue, 16 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/para-jailbreaking-safe-completion.mdhttps://www.llm-hacking.com/hacks/para-jailbreaking-safe-completion.mdAn April 27, 2026 arXiv paper names a new failure mode of output-centric safety: a model can correctly refuse the direct question yet leak harmful content inside the 'safe alternative' it offers instead.Tue, 16 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/parallax-cognitive-executive-separation.mdhttps://www.llm-hacking.com/hacks/parallax-cognitive-executive-separation.mdA position paper published April 14, 2026 argues prompt-level guardrails fail the moment an agent's reasoning is compromised, and proposes structurally separating the part that thinks from the part that acts.Tue, 16 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/rag-membership-inference-entailment.mdhttps://www.llm-hacking.com/hacks/rag-membership-inference-entailment.mdA May 2026 USENIX Security paper shows an attacker can tell whether a document sits in a RAG retrieval corpus with about five plain-language questions — no shadow models, no templated prompts, and it survives current defenses.Tue, 16 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/reasoning-trace-exposure-rep.mdhttps://www.llm-hacking.com/hacks/reasoning-trace-exposure-rep.mdA May 2026 paper shows that prompting alone can pull a reasoning model's hidden chain-of-thought back into user-visible output — and the recovered traces are good enough to distill a smaller model.Tue, 16 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/refusal-escape-directions-jailbreak.mdhttps://www.llm-hacking.com/hacks/refusal-escape-directions-jailbreak.mdA May 2026 paper proves aligned LLMs keep 'refusal-escape directions' baked into their operator structure — explaining why jailbreaks persist and why removing them costs utility.Tue, 16 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/scone-bench-smart-contract-exploit-economics.mdhttps://www.llm-hacking.com/hacks/scone-bench-smart-contract-exploit-economics.mdAnthropic's December 1, 2025 study measures AI agent exploitation in money, not success rates: on smart contracts, frontier models produced $4.6M in simulated theft and two real zero-days at $1.22 per scan.Tue, 16 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/searchleak-m365-copilot-cve-2026-42824.mdhttps://www.llm-hacking.com/hacks/searchleak-m365-copilot-cve-2026-42824.mdVaronis disclosed the mechanics of CVE-2026-42824 on June 15, 2026: a crafted microsoft.com link chains prompt injection, an HTML render race and a Bing SSRF to exfiltrate mail and MFA codes. Patched server-side.Tue, 16 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/system-level-agent-defense-plan-policy.mdhttps://www.llm-hacking.com/hacks/system-level-agent-defense-plan-policy.mdAn NVIDIA position paper (March 31, 2026) argues that indirect prompt injection cannot be fixed at the model alone — and proposes a plan-and-policy system architecture that constrains what an agent may observe and decide.Tue, 16 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/verified-agent-skills-capability-governance.mdhttps://www.llm-hacking.com/hacks/verified-agent-skills-capability-governance.mdNVIDIA's May 19, 2026 verified agent skills add risk scanning, cryptographic signing and machine-readable skill cards to the SKILL.md supply chain — a defensive answer to poisoned skills.Tue, 16 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/clawsafety-safe-llm-unsafe-agent.mdhttps://www.llm-hacking.com/hacks/clawsafety-safe-llm-unsafe-agent.mdAn April 2026 benchmark runs 2,520 sandboxed trials on personal AI agents and finds attack success rates of 40–75%. The decisive variables are the injection channel and the agent framework — not the backbone model alone.Mon, 15 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/confidential-computing-agentic-ai.mdhttps://www.llm-hacking.com/hacks/confidential-computing-agentic-ai.mdA May 2026 survey maps confidential computing onto the agentic stack — hardware enclaves can shield agent memory and KV caches from a malicious cloud operator, but they cannot stop prompt injection.Mon, 15 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/crcp-rag-poisoning-survives-reranking.mdhttps://www.llm-hacking.com/hacks/crcp-rag-poisoning-survives-reranking.mdA June 9, 2026 arXiv paper shows many corpus-poisoning attacks quietly fail after reranking — and proposes CRCP, a chunk-aware variant built to survive realistic multi-stage RAG pipelines. The lesson is about how you evaluate, not just how you defend.Mon, 15 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/cyber-defense-benchmark-threat-hunting.mdhttps://www.llm-hacking.com/hacks/cyber-defense-benchmark-threat-hunting.mdAn April 2026 benchmark drops five frontier models into raw Windows logs and asks them to hunt. The best finds 3.8% of malicious events — none clears the bar for unsupervised SOC work.Mon, 15 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/fable-mythos-export-control-suspension.mdhttps://www.llm-hacking.com/hacks/fable-mythos-export-control-suspension.mdOn June 12, 2026, a US export-control directive forced Anthropic to disable Claude Fable 5 and Mythos 5 worldwide. The reported trigger was a 'jailbreak' that amounts to asking a model to read code and fix flaws — a capability defenders use daily.Mon, 15 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/flowise-csv-agent-prompt-injection-rce.mdhttps://www.llm-hacking.com/hacks/flowise-csv-agent-prompt-injection-rce.mdA prompt injection in Flowise's CSV Agent makes the model emit Python that escapes a regex denylist and runs OS commands. Disclosed April 15, 2026 and patched in 3.1.0.Mon, 15 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/injection-depth-react-agents.mdhttps://www.llm-hacking.com/hacks/injection-depth-react-agents.mdA June 2026 study of tool-calling ReAct agents finds injection depth—not rhetoric—drives indirect prompt injection: success falls from 60% at the first tool call to 0% by the fourth.Mon, 15 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/jailbreak-transfer-shared-representations.mdhttps://www.llm-hacking.com/hacks/jailbreak-transfer-shared-representations.mdA study of 20 open-weight models finds jailbreak transfer comes from shared internal representations, not safety-training quirks. A defense called LLM salting rotates the refusal direction to break reuse.Mon, 15 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ktransformers-zmq-pickle-rce-cve-2026-26210.mdhttps://www.llm-hacking.com/hacks/ktransformers-zmq-pickle-rce-cve-2026-26210.mdA critical RCE in the ktransformers inference engine exposes a ZMQ socket on all interfaces and pickle-loads whatever it receives. It is the latest case of the 'ShadowMQ' pattern copied across AI serving stacks.Mon, 15 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/llm-privacy-attacks-ablation-study.mdhttps://www.llm-hacking.com/hacks/llm-privacy-attacks-ablation-study.mdA May 2026 study measures membership inference, attribute inference, data extraction and backdoors under one threat model. The finding: leakage is driven by your design choices — scale, data duplication, RAG config — not by the attack alone.Mon, 15 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/machine-speed-injection-containment.mdhttps://www.llm-hacking.com/hacks/machine-speed-injection-containment.mdAt Infosecurity Europe 2026, OWASP's Ariel Fogel called prompt injection an unresolved architectural problem and argued defenders must shift from prevention to runtime containment that runs as fast as the agent.Mon, 15 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/malicious-llm-api-routers.mdhttps://www.llm-hacking.com/hacks/malicious-llm-api-routers.mdA UC Santa Barbara study (arXiv, April 9, 2026) measured 428 third-party LLM API routers and found dozens injecting code, stealing credentials and draining a crypto wallet — all from a trust boundary developers configure voluntarily.Mon, 15 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/malskillbench-malicious-agent-skills.mdhttps://www.llm-hacking.com/hacks/malskillbench-malicious-agent-skills.mdA June 2026 paper builds the first runtime-verified benchmark of malicious agent skills — 3,944 samples across 108 attack cells — and shows a single detector's recall can swing 66 points depending on which dataset you test it on.Mon, 15 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/mcp-kubernetes-execution-layer-bypass.mdhttps://www.llm-hacking.com/hacks/mcp-kubernetes-execution-layer-bypass.mdmcp-server-kubernetes enforced its read-only and allow-list controls only in tools/list, never in tools/call. Any client that knew a tool name could run it. A clean lesson in presentation-layer vs execution-layer authorization.Mon, 15 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mcp-localhost-dns-rebinding.mdhttps://www.llm-hacking.com/hacks/mcp-localhost-dns-rebinding.mdA coordinated 2025–2026 disclosure wave hit every major MCP SDK over one root cause: HTTP servers on localhost that skip Host/Origin validation. The latest, CVE-2026-11624 in Google's MCP Toolbox (June 13, 2026), is rated Critical 9.4.Mon, 15 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/prompt-injection-detector-evasion.mdhttps://www.llm-hacking.com/hacks/prompt-injection-detector-evasion.mdFrom keyword classifiers to activation-based drift probes, prompt-injection detectors share one weakness: an adaptive attacker. Two studies report up to ~100% evasion. Treat detection as one layer, never the boundary.Mon, 15 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/safeharbor-hierarchical-memory-guardrail.mdhttps://www.llm-hacking.com/hacks/safeharbor-hierarchical-memory-guardrail.mdAccepted at ICML 2026, SafeHarbor is a training-free guardrail that injects context-aware safety rules from a self-evolving risk tree — keeping 63.6% benign utility on GPT-4o while refusing over 93% of attacks.Mon, 15 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/sec-bench-pro-long-horizon-bug-hunting.mdhttps://www.llm-hacking.com/hacks/sec-bench-pro-long-horizon-bug-hunting.mdA May 26, 2026 benchmark measures coding agents on long-horizon vulnerability discovery in real browser engines. Frontier models stay below 40% — and the gap matters for both attackers and defenders.Mon, 15 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/splunk-mcp-server-token-leak-cve-2026-20205.mdhttps://www.llm-hacking.com/hacks/splunk-mcp-server-token-leak-cve-2026-20205.mdSplunk's MCP Server app wrote users' session and authorization tokens unmasked into the _internal index — a CWE-532 secrets-in-logs flaw that turns log access into token theft. Fixed in app v1.0.3.Mon, 15 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/toctou-agent-atomicity-violations.mdhttps://www.llm-hacking.com/hacks/toctou-agent-atomicity-violations.mdAn old operating-systems bug class resurfaces in agents: the world changes between when an agent looks and when it acts. New 2026 research formalizes it for GUI, browser, and multi-agent systems.Mon, 15 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/trending-model-typosquat-infostealer.mdhttps://www.llm-hacking.com/hacks/trending-model-typosquat-infostealer.mdOn May 7, 2026 HiddenLayer found Open-OSS/privacy-filter, a typosquat of OpenAI's model that reached #1 trending on Hugging Face with ~244K downloads in 18 hours before shipping a Rust infostealer.Mon, 15 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/xl-safetybench-cross-cultural-llm-safety.mdhttps://www.llm-hacking.com/hacks/xl-safetybench-cross-cultural-llm-safety.mdA May 7, 2026 arXiv paper from AIM Intelligence and Microsoft's AI Red Team shows English-centric safety tests miss country-specific harms — and that many models' 'safety' is refusal by accident, not genuine alignment.Mon, 15 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/multi-clip-video-mllm-jailbreak.mdhttps://www.llm-hacking.com/hacks/multi-clip-video-mllm-jailbreak.mdA June 2026 ACL paper shows the video channel is a weaker safety boundary than images: attack success climbs as a video is split into more diverse short clips.Sun, 14 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/secureclaw-dual-boundary-agent-defense.mdhttps://www.llm-hacking.com/hacks/secureclaw-dual-boundary-agent-defense.mdA June 2026 paper proposes guarding two distinct boundaries at once — authorizing external actions at the effect sink and confining plaintext at the read boundary — reporting 0% attack success on one agent benchmark.Sun, 14 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/brain-prompt-injection-bci-agents.mdhttps://www.llm-hacking.com/hacks/brain-prompt-injection-bci-agents.mdA June 8, 2026 arXiv paper names a new attack surface: BCI-to-agent pipelines that turn decoded EEG into a tool-use authorization channel. Three injection vectors flip the routed action while EEG- and text-side monitors stay blind.Sat, 13 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/converse-agent-to-agent-contextual-safety.mdhttps://www.llm-hacking.com/hacks/converse-agent-to-agent-contextual-safety.mdA benchmark for agent-to-agent conversations finds privacy attacks succeed up to 88% of the time and security breaches up to 60% — and that more capable models leak more, not less.Sat, 13 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/pi-hunter-agentic-injection-auditing.mdhttps://www.llm-hacking.com/hacks/pi-hunter-agentic-injection-auditing.mdA June 2026 paper from Google researchers reframes prompt-injection red-teaming as auditing — PI-Hunter evolves source-aware test cases to surface where latent injections enter and propagate through an agent, not just whether an attack lands.Sat, 13 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/sigil-provable-training-data-membership.mdhttps://www.llm-hacking.com/hacks/sigil-provable-training-data-membership.mdA June 2026 arXiv paper proposes embedding imperceptible canaries into text and code so content owners can prove, with controlled false-positive rates, that a model was trained on their data.Sat, 13 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/agentdyn-dynamic-injection-benchmark.mdhttps://www.llm-hacking.com/hacks/agentdyn-dynamic-injection-benchmark.mdA February 2026 ICML benchmark, AgentDyn, runs ten leading prompt-injection defenses on dynamic, open-ended agent tasks. Almost all are either insecure or over-defend into uselessness.Fri, 12 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/beyond-tool-poisoning-malicious-mcp-servers.mdhttps://www.llm-hacking.com/hacks/beyond-tool-poisoning-malicious-mcp-servers.mdA May 21, 2026 study maps the full threat surface of malicious remote MCP servers across ChatGPT, Claude Desktop and Gemini CLI — finding host filtering swings from 95% to 50% on the same request, and successful attacks are almost never disclosed.Fri, 12 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/causality-laundering-denial-feedback-leakage.mdhttps://www.llm-hacking.com/hacks/causality-laundering-denial-feedback-leakage.mdAn April 2026 paper shows that denying an agent's tool call is not the end of the attack: the denial itself is an information channel. Flat taint tracking misses it.Fri, 12 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/chromatoast-vector-db-preauth-rce.mdhttps://www.llm-hacking.com/hacks/chromatoast-vector-db-preauth-rce.mdHiddenLayer's May 18, 2026 disclosure (CVE-2026-45829, CVSS 10.0) shows ChromaDB's Python server loads an attacker's HuggingFace model and runs its code before it ever checks authentication.Fri, 12 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/claude-code-read-tool-environ-leak.mdhttps://www.llm-hacking.com/hacks/claude-code-read-tool-environ-leak.mdMicrosoft Threat Intelligence found that Claude Code Action's Read tool bypassed the Bash env scrub to reach /proc/self/environ, leaking the runner's ANTHROPIC_API_KEY. Patched in v2.1.128.Fri, 12 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/copilot-injection-disclosure-june-2026.mdhttps://www.llm-hacking.com/hacks/copilot-injection-disclosure-june-2026.mdJune 9, 2026 Patch Tuesday shipped CVE-2026-42824 and CVE-2026-47644 — two injection-class information-disclosure flaws in Microsoft's Copilot surface, continuing the exfiltration lineage that started with EchoLeak.Fri, 12 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/credential-leakage-llm-agent-skills.mdhttps://www.llm-hacking.com/hacks/credential-leakage-llm-agent-skills.mdAn April 3, 2026 arXiv study analyzed 17,022 agent skills and found 520 leaking credentials — 73.5% of the leaks flow through debug logging that pipes secrets straight into the model's context.Fri, 12 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/dacsi-control-signal-impersonation-rag.mdhttps://www.llm-hacking.com/hacks/dacsi-control-signal-impersonation-rag.mdA June 8, 2026 paper names a quiet RAG failure mode: untrusted document text impersonating metadata, provenance and policy signals. No 'ignore previous instructions' required — the lesson is that document-authored labels are data, not policy.Fri, 12 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/defense-trilemma-prompt-injection-wrappers.mdhttps://www.llm-hacking.com/hacks/defense-trilemma-prompt-injection-wrappers.mdA Lean 4-verified April 2026 proof shows no continuous, utility-preserving input wrapper can block every prompt injection. Continuity, utility, and completeness cannot all hold at once.Fri, 12 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/github-agentic-workflows-security-architecture.mdhttps://www.llm-hacking.com/hacks/github-agentic-workflows-security-architecture.mdGitHub Agentic Workflows reached public preview on June 11, 2026 with a security-first design: zero-secret agents in a chroot jail, a workflow firewall, staged-and-vetted writes, and a threat-detection job. The defensive answer to prompt injection in CI/CD.Fri, 12 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/grammar-constrained-decoding-jailbreak.mdhttps://www.llm-hacking.com/hacks/grammar-constrained-decoding-jailbreak.mdA June 10, 2026 arXiv paper shows that the reliability feature forcing LLM code output to be syntactically valid can itself be turned into a jailbreak. Applying a benign code grammar can bypass refusals; the authors' CodeShield defense answers with honeypot code.Fri, 12 Jun 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/mcp-cloud-takeover-imds.mdhttps://www.llm-hacking.com/hacks/mcp-cloud-takeover-imds.mdCommand injection in cloud MCP servers (CVE-2026-5058/5059) lets attackers reach the instance metadata service, steal the IAM role, and pivot into the whole cloud account.Fri, 12 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/mnemonic-sovereignty-memory-lifecycle.mdhttps://www.llm-hacking.com/hacks/mnemonic-sovereignty-memory-lifecycle.mdAn April 2026 survey reframes LLM-agent memory security as a six-phase lifecycle and shows the field ignores forgetting, confidentiality and non-adversarial drift.Fri, 12 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/multi-agent-safety-research-fund.mdhttps://www.llm-hacking.com/hacks/multi-agent-safety-research-fund.mdOn June 11, 2026, Google DeepMind, Schmidt Sciences, the Cooperative AI Foundation and ARIA opened a $10M call to build a research field around the safety of millions of interacting AI agents.Fri, 12 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/non-monotonic-safety-alignment-gemma.mdhttps://www.llm-hacking.com/hacks/non-monotonic-safety-alignment-gemma.mdA May 2026 paper red-teaming four Gemma generations found the mid-generation model was far easier to jailbreak than both its predecessor and successor — safety doesn't improve in a straight line.Fri, 12 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/owasp-state-agentic-ai-security-2026.mdhttps://www.llm-hacking.com/hacks/owasp-state-agentic-ai-security-2026.mdOWASP's State of Agentic AI Security and Governance v2.01 (June 1, 2026) moves from hypothetical threats to documented CVEs and breaches. Prompt injection now maps to six of the ten agentic risk categories.Fri, 12 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/prompt-inversion-collaborative-inference-defense.mdhttps://www.llm-hacking.com/hacks/prompt-inversion-collaborative-inference-defense.mdPrompt inversion attacks recover up to 88.4% of input tokens from intermediate activations in collaborative LLM inference. A paper submitted June 10, 2026 proposes the first information-theoretic defense.Fri, 12 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/recuse-signal-agent-access-deny.mdhttps://www.llm-hacking.com/hacks/recuse-signal-agent-access-deny.mdA June 2026 paper proposes an in-band 'deny' signal — emitted over an SSH banner or a PostgreSQL NOTICE — that politely asks an autonomous agent to withdraw. In a pilot it induced 100% recusal, but an authorization framing flipped the strongest model right back.Fri, 12 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/rtk-untrusted-filters-ai-perception.mdhttps://www.llm-hacking.com/hacks/rtk-untrusted-filters-ai-perception.mdPillar Security disclosed on May 20, 2026 a flaw in RTK, a token-optimisation filter for Claude Code: a repo-supplied .rtk/filters.toml could silently strip a backdoor from command output before the model ever saw it. The target is the agent's perception, not its execution.Fri, 12 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/stakebench-stakeholder-harm-web-agents.mdhttps://www.llm-hacking.com/hacks/stakebench-stakeholder-harm-web-agents.mdA stakeholder-centric benchmark from NTU, IBM Research and UIUC shows web agents fail every injection objective tested — and that the harm often lands on third parties, not the user.Fri, 12 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/tool-stream-injection-verify-before-commit.mdhttps://www.llm-hacking.com/hacks/tool-stream-injection-verify-before-commit.mdA January 2026 paper, VIGIL, reframes indirect injection around the tool stream — forged tool descriptions and fake error messages — and shows that the better-aligned an agent is, the more it obeys them.Fri, 12 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/trustdesc-trusted-tool-descriptions.mdhttps://www.llm-hacking.com/hacks/trustdesc-trusted-tool-descriptions.mdAn April 2026 paper attacks tool poisoning at its root: generate a tool's description from its implementation instead of trusting the author-supplied text, neutralising implicit poisoning that detectors miss.Fri, 12 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/vllm-multimodal-decoder-rce-cve-2026-22778.mdhttps://www.llm-hacking.com/hacks/vllm-multimodal-decoder-rce-cve-2026-22778.mdCVE-2026-22778 turns a malicious video URL into remote code execution on vLLM servers, chaining a PIL info leak with an FFmpeg JPEG2000 heap overflow. Patched in 0.14.1.Fri, 12 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/auditbench-llm-attack-investigation.mdhttps://www.llm-hacking.com/hacks/auditbench-llm-attack-investigation.mdA June 2026 benchmark tests five frontier LLMs on real audit-log investigations. Verdict: overly suspicious models, many false positives — and smaller models often match the big ones.Thu, 11 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/casa-task-based-tool-authorization.mdhttps://www.llm-hacking.com/hacks/casa-task-based-tool-authorization.mdA May 4, 2026 arXiv paper proposes Continuous Agent Semantic Authorization — a zero-trust layer that extracts a user's task from a multi-turn chat and denies tool calls that don't match it.Thu, 11 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/context-fractured-decomposition-agents.mdhttps://www.llm-hacking.com/hacks/context-fractured-decomposition-agents.mdA June 8, 2026 arXiv paper formalizes the 'provenance gap' in tool-using agents: harmful behavior assembled from individually innocuous tool actions across time, lifting jailbreak success up to 28.3 points.Thu, 11 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cursor-env-poisoning-allowlist-bypass.mdhttps://www.llm-hacking.com/hacks/cursor-env-poisoning-allowlist-bypass.mdCVE-2026-22708 lets a prompt injection use trusted shell built-ins like export and typeset to poison environment variables in Cursor, turning an approved git or python command into remote code execution. Patched in 2.3.Thu, 11 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/hades-worm-ai-coding-config-hooks.mdhttps://www.llm-hacking.com/hacks/hades-worm-ai-coding-config-hooks.mdThe Hades supply-chain worm commits config files for Claude Code, Gemini, Cursor, and VS Code that execute on session start or folder open — turning a cloned repo into a credential stealer with no install step.Thu, 11 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/hpaa-typographic-moderation-evasion.mdhttps://www.llm-hacking.com/hacks/hpaa-typographic-moderation-evasion.mdA June 8, 2026 paper introduces Human-Perceptible Adversarial Attacks — harmful text that stays obvious to a human reader but slips past LLM content moderation through typographic manipulation.Thu, 11 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/injection-paradox-rag-brand-suppression.mdhttps://www.llm-hacking.com/hacks/injection-paradox-rag-brand-suppression.mdA June 8, 2026 arXiv preprint shows prompt injections in retrieved documents can backfire in safety-trained Claude models, dropping a brand from a 54% to 0% recommendation rate — opening a reverse-attack against competitors.Thu, 11 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/oversight-capacity-reviewer-fatigue.mdhttps://www.llm-hacking.com/hacks/oversight-capacity-reviewer-fatigue.mdA June 8, 2026 arXiv paper models the human reviewer behind an agent's approval gate as a fatiguing, finite resource — and shows that escalating more actions can lower realized safety and open a flooding attack.Thu, 11 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/owasp-agentic-adoption-maturity-model.mdhttps://www.llm-hacking.com/hacks/owasp-agentic-adoption-maturity-model.mdOWASP's June 2026 State of Agentic AI report adds an Enterprise Adoption Maturity Model — a two-axis grid where agent autonomy outruns governance, leaving 'red cells' no one can see into.Thu, 11 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/saber-coding-agent-operational-safety.mdhttps://www.llm-hacking.com/hacks/saber-coding-agent-operational-safety.mdA May 31, 2026 benchmark scores LLM coding agents on the final state of a real workspace, not on prompt refusal. Even the best model leaves a harmful violation in over half of runs.Thu, 11 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/web-chatbot-plugins-prompt-injection.mdhttps://www.llm-hacking.com/hacks/web-chatbot-plugins-prompt-injection.mdAn IEEE S&P 2026 study of 17 chatbot plugins on 10,000+ sites found forgeable conversation histories (3-8x stronger injections) and web-scraping tools that mix trusted and untrusted content.Thu, 11 Jun 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/litellm-mcp-test-rce-cve-2026-42271.mdhttps://www.llm-hacking.com/hacks/litellm-mcp-test-rce-cve-2026-42271.mdDisclosed in April as an authenticated command injection, LiteLLM's MCP preview endpoints became unauthenticated RCE once chained with Starlette's BadHost bypass — CISA added it to KEV on June 8, 2026.Wed, 10 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/memory-control-flow-attacks-mcfa.mdhttps://www.llm-hacking.com/hacks/memory-control-flow-attacks-mcfa.mdA March 2026 paper shows poisoned agent memory doesn't just corrupt content — it hijacks the control flow of tool selection, forcing unintended tools and skipped steps in over 90% of trials, across tasks and long after injection.Wed, 10 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/transformers-config-injection-rce.mdhttps://www.llm-hacking.com/hacks/transformers-config-injection-rce.mdCVE-2026-4372, disclosed June 4, 2026, lets a single config.json field run attacker code on a routine from_pretrained() call — bypassing trust_remote_code=False in Hugging Face Transformers.Wed, 10 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/adr-enterprise-mcp-agent-detection.mdhttps://www.llm-hacking.com/hacks/adr-enterprise-mcp-agent-detection.mdA May 2026 paper from Uber describes a production EDR-style system for MCP agents: full causal telemetry, two-tier detection, and offline red-teaming, running on 7,200+ hosts for ten months.Mon, 08 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agent-security-systems-problem.mdhttps://www.llm-hacking.com/hacks/agent-security-systems-problem.mdA May 2026 position paper from Google, UCSD and UW–Madison argues agent security must move out of the model and into the system: treat the LLM as an untrusted component and enforce invariants around it.Mon, 08 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agentic-attack-lifecycle-compression.mdhttps://www.llm-hacking.com/hacks/agentic-attack-lifecycle-compression.mdA May 2026 arXiv paper models how agentic AI lowers the cost of every attack stage — from reconnaissance to post-compromise — compressing the kill chain and shifting defensive priorities for enterprises.Mon, 08 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/agenttrust-runtime-tool-call-interception.mdhttps://www.llm-hacking.com/hacks/agenttrust-runtime-tool-call-interception.mdA preprint from May 6, 2026 introduces AgentTrust, a runtime layer that vets each agent tool call before it runs and returns allow/warn/block/review — catching obfuscated shell payloads static guards miss.Mon, 08 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/benchmarking-security-agents-is-hard.mdhttps://www.llm-hacking.com/hacks/benchmarking-security-agents-is-hard.mdA position paper published May 21, 2026 argues that the leaderboards used to score security agents are quietly broken: the adversarial reasoning you want to measure can also break the benchmark itself. Three failure modes, and how to evaluate honestly.Mon, 08 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/beyond-shallow-safety-trajectory-alignment.mdhttps://www.llm-hacking.com/hacks/beyond-shallow-safety-trajectory-alignment.mdA June 3, 2026 arXiv paper shows safety alignment can be redirected not just at the first tokens but at any generation step — and a model's hidden-state refusal directions don't predict its robustness.Mon, 08 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/developer-blind-spots-agent-security.mdhttps://www.llm-hacking.com/hacks/developer-blind-spots-agent-security.mdA June 2026 arXiv study of independent AI-agent developers finds a user-centric blind spot: builders focus on harmful-content safety while overlooking prompt injection, data exfiltration, and cross-border privacy.Mon, 08 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/hands-free-agent-firmware-vr.mdhttps://www.llm-hacking.com/hacks/hands-free-agent-firmware-vr.mdOn June 2, 2026, Claroty Team82 ran Claude Opus 4.6 with a Ghidra MCP server against a Zenitel intercom firmware image and re-found a set of known CVEs in under ten minutes — a preview of commoditized firmware vulnerability research.Mon, 08 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/llm-unlearning-knowledge-recovery.mdhttps://www.llm-hacking.com/hacks/llm-unlearning-knowledge-recovery.mdMultiple 2025-2026 papers show 'unlearned' knowledge in LLMs is routinely recoverable — via quantization, adversarial prompting, and now reasoning traces. Treating unlearning as erasure is a mistake.Mon, 08 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/mmd-model-extraction-detection.mdhttps://www.llm-hacking.com/hacks/mmd-model-extraction-detection.mdA June 2026 paper shows a simple distribution test (MMD over query embeddings, calibrated on benign traffic only) detects LLM model-extraction campaigns hidden in mixed API traffic — 0.3% false positives, 100% on pure-attacker streams.Mon, 08 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/ms-agent-shell-denylist-cve-2026-2256.mdhttps://www.llm-hacking.com/hacks/ms-agent-shell-denylist-cve-2026-2256.mdCVE-2026-2256 lets attacker-controlled content steer ModelScope's MS-Agent into running OS commands. The root cause is a familiar anti-pattern: guarding a shell tool with a regex denylist instead of an allowlist.Mon, 08 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/owasp-asi02-tool-misuse-exploitation.mdhttps://www.llm-hacking.com/hacks/owasp-asi02-tool-misuse-exploitation.mdTool Misuse & Exploitation is the #2 risk in OWASP's Top 10 for Agentic Applications 2026. The danger isn't an agent gaining new tools — it's misusing the ones it already holds, via over-privilege, poisoned descriptors, or unsafe chaining.Mon, 08 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/provably-secure-agent-guardrail-epca.mdhttps://www.llm-hacking.com/hacks/provably-secure-agent-guardrail-epca.mdA May 2026 paper proposes ePCA, a guardrail that compiles each agent action into first-order logic and runs an SMT check before execution, blocking unsafe steps as logical deadlocks.Mon, 08 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/remote-mcp-oauth-flaws.mdhttps://www.llm-hacking.com/hacks/remote-mcp-oauth-flaws.mdA May 2026 arXiv study scanned 7,973 live remote MCP servers: 40.55% expose tools with no authentication, and all 119 OAuth-enabled servers tested carried at least one flaw — 9 CVEs assigned.Mon, 08 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/sequential-data-poisoning-post-training.mdhttps://www.llm-hacking.com/hacks/sequential-data-poisoning-post-training.mdA June 3, 2026 paper shows that poison spread across SFT and preference data — negligible at each stage alone — combines into a working backdoor. Per-stage audits create a 'single-attacker illusion'.Mon, 08 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/slotgcg-positional-jailbreak-slots.mdhttps://www.llm-hacking.com/hacks/slotgcg-positional-jailbreak-slots.mdA June 2026 paper shows GCG-style jailbreaks get ~14% stronger when adversarial tokens are placed at attention-correlated slots inside the prompt — and keep 42% more success under input filtering.Mon, 08 Jun 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/x402-agentic-payment-protocol-attacks.mdhttps://www.llm-hacking.com/hacks/x402-agentic-payment-protocol-attacks.mdA May 12, 2026 paper formally breaks x402, the HTTP 402 agentic payment protocol. Five attacks across settlement, replay, web handling and discovery — one replayed payment yielded 248 grants on a live endpoint.Mon, 08 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agentic-failure-modes-taxonomy-v2.mdhttps://www.llm-hacking.com/hacks/agentic-failure-modes-taxonomy-v2.mdMicrosoft's AI Red Team v2.0 taxonomy (June 4, 2026) adds seven agentic failure modes and reports human-in-the-loop bypass as the most consistently exploited — including zero-click chains from a single external input.Sun, 07 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agentvisor-semantic-virtualization-defense.mdhttps://www.llm-hacking.com/hacks/agentvisor-semantic-virtualization-defense.mdAn April 27, 2026 arXiv paper borrows the OS hypervisor idea to defend tool-using LLM agents: a trusted 'visor' audits every tool call and is architecturally blind to untrusted content.Sun, 07 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/back-reveal-backdoored-tool-exfiltration.mdhttps://www.llm-hacking.com/hacks/back-reveal-backdoored-tool-exfiltration.mdA finetuned agent carries a hidden trigger. On a benign cue it reads your session memory and ships it out disguised as an ordinary retrieval call — no prompt injection, no malicious tool. Paper dated April 7, 2026.Sun, 07 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/ci-query-rewriting-llm-delegation.mdhttps://www.llm-hacking.com/hacks/ci-query-rewriting-llm-delegation.mdA June 2, 2026 arXiv paper recasts privacy-preserving query rewriting as a contextual-integrity problem: forward a span to a cloud LLM only if the task needs it, not because a PII type matched.Sun, 07 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/detector-benchmark-operating-point.mdhttps://www.llm-hacking.com/hacks/detector-benchmark-operating-point.mdA June 1, 2026 arXiv preprint shows most prompt-injection and jailbreak detector benchmarks lean on per-dataset threshold tuning and undisclosed operating points — two habits that quietly inflate the accuracy you buy.Sun, 07 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/langflow-public-build-endpoint-rce.mdhttps://www.llm-hacking.com/hacks/langflow-public-build-endpoint-rce.mdCVE-2026-33017 turns Langflow's public flow-build endpoint into unauthenticated remote code execution. Disclosed March 17, 2026, it was exploited in the wild within 20 hours — before any public PoC existed.Sun, 07 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/llm-ranker-decision-hijacking.mdhttps://www.llm-hacking.com/hacks/llm-ranker-decision-hijacking.mdA growing body of 2025-2026 research shows that when an LLM re-ranks search or RAG candidates, a few injected lines inside one document can force it to the top — collapsing ranking quality by 60+ NDCG points, with stronger models more vulnerable, not less.Sun, 07 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/membrane-contrastive-safety-memory.mdhttps://www.llm-hacking.com/hacks/membrane-contrastive-safety-memory.mdA June 4, 2026 arXiv paper proposes Membrane, a self-evolving guardrail that pairs each blocked attack with a near-identical benign request, cutting over-refusal to 7-14% while topping F1 on six jailbreaks.Sun, 07 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/metabackdoor-positional-length-trigger.mdhttps://www.llm-hacking.com/hacks/metabackdoor-positional-length-trigger.mdA May 2026 paper from Microsoft and Institute of Science Tokyo plants a backdoor whose trigger is the input's length, not its text. The prompt looks clean, content filters see nothing, and 90 poisoned examples are enough.Sun, 07 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/openai-lockdown-mode-data-exfiltration.mdhttps://www.llm-hacking.com/hacks/openai-lockdown-mode-data-exfiltration.mdOn June 6, 2026 OpenAI extended Lockdown Mode to personal and self-serve Business ChatGPT accounts: a deterministic setting that disables outbound paths attackers use to exfiltrate data via prompt injection.Sun, 07 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/thrd-multi-turn-jailbreak-temporal-defense.mdhttps://www.llm-hacking.com/hacks/thrd-multi-turn-jailbreak-temporal-defense.mdA June 2026 paper argues multi-turn jailbreaks must be judged across the whole conversation, not turn by turn. THRD scores accumulated risk over time and cuts attack success to 0.2–4% without retraining.Sun, 07 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/adaptive-ai-worms-parasitic-local-llm.mdhttps://www.llm-hacking.com/hacks/adaptive-ai-worms-parasitic-local-llm.mdA June 2026 University of Toronto paper demos a worm that runs open-weight LLMs on the machines it compromises, adapting its exploit per target and weaponising advisories published after the model's training cutoff.Fri, 05 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/agent-audit-trail-integrity.mdhttps://www.llm-hacking.com/hacks/agent-audit-trail-integrity.mdIf a compromised agent produces its own activity log, it can omit, alter, or fabricate what it did. Three June 2026 efforts — arXiv's Notarized Agents, an IETF agent-audit-trail draft, and SCITT — converge on the same fix: move the trust boundary off the agent.Fri, 05 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agentredbench-underspecified-authorization.mdhttps://www.llm-hacking.com/hacks/agentredbench-underspecified-authorization.mdAgentRedBench (June 2026) red-teams LLM agents reading from SaaS tools like Gmail and Jira. No-guard attack success ran 32–81% across eight frontier models, until a tool-response classifier cut it.Fri, 05 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/embedding-defenses-fail-multi-agent.mdhttps://www.llm-hacking.com/hacks/embedding-defenses-fail-multi-agent.mdA May 1, 2026 arXiv paper shows that detectors which prune malicious agents by message embedding collapse when attackers craft near-benign text — and proposes token-confidence signals as a more robust replacement.Fri, 05 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/gguf-parser-untrusted-model-rce.mdhttps://www.llm-hacking.com/hacks/gguf-parser-untrusted-model-rce.mdCVE-2026-33298 (March 2026) and a May 15, 2026 oss-sec disclosure show llama.cpp's GGUF parser keeps hitting integer-overflow heap corruption: loading a crafted model file can mean RCE.Fri, 05 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/incomparable-prompt-injection-metrics.mdhttps://www.llm-hacking.com/hacks/incomparable-prompt-injection-metrics.mdA June 1, 2026 comparison of the prompt-injection disclosures from Anthropic, OpenAI, Google and Meta found that no two labs share a metric, a surface, or a definition of success — so vendor numbers cannot be compared.Fri, 05 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/m365-copilot-command-injection-cve-2026-45497.mdhttps://www.llm-hacking.com/hacks/m365-copilot-command-injection-cve-2026-45497.mdOn June 4 2026 MSRC disclosed CVE-2026-45497, a command-injection flaw in Microsoft 365 Copilot rated as remote code execution with a scope change across the service boundary. Fixed server-side.Fri, 05 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mobile-mcp-intent-injection.mdhttps://www.llm-hacking.com/hacks/mobile-mcp-intent-injection.mdCVE-2026-35394 lets a model-controlled URL fire arbitrary Android intents through mobile-mcp's mobile_open_url tool. Paired with a sibling path-traversal CVE, it shows a pattern: MCP tool arguments flowing unvalidated into platform sinks.Fri, 05 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mpbench-memory-poisoning-taxonomy.mdhttps://www.llm-hacking.com/hacks/mpbench-memory-poisoning-taxonomy.mdA June 3, 2026 arXiv study maps four memory write channels, nine structural weaknesses and six attack classes — and shows prompt-injection defenses don't cover memory poisoning.Fri, 05 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/optimus-jailbreak-scoring-beyond-binary.mdhttps://www.llm-hacking.com/hacks/optimus-jailbreak-scoring-beyond-binary.mdA May 9, 2026 arXiv paper argues binary attack-success-rate hides the jailbreaks defenders should fear most. Its Optimus metric scores prompts on similarity and harmfulness, exposing a 'stealth-optimal' band where ASR collapses to zero.Fri, 05 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/viper-mcp-taint-style-server-flaws.mdhttps://www.llm-hacking.com/hacks/viper-mcp-taint-style-server-flaws.mdA May 20, 2026 arXiv paper audited 39,884 open-source MCP server repos, confirmed 106 zero-days end-to-end and got 67 CVE IDs assigned. The story is the pattern: untrusted agent input reaching shell, network and file-system sinks.Fri, 05 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/vllm-trust-remote-code-bypass-rce.mdhttps://www.llm-hacking.com/hacks/vllm-trust-remote-code-bypass-rce.mdCVE-2026-27893 (disclosed March 27, 2026) is vLLM's third trust_remote_code bypass. Two model files hardcode trust_remote_code=True, silently overriding an operator's opt-out and enabling RCE from a malicious model repo.Fri, 05 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/activation-probe-credential-exfiltration.mdhttps://www.llm-hacking.com/hacks/activation-probe-credential-exfiltration.mdPublished June 2, 2026, an arXiv paper detects agent credential leaks before any output token is emitted — combining activation probes, calibrated honeytokens, and multi-turn leakage accounting.Thu, 04 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agents-md-supply-chain-injection.mdhttps://www.llm-hacking.com/hacks/agents-md-supply-chain-injection.mdAn April 20, 2026 NVIDIA AI Red Team report shows a malicious dependency can drop a crafted AGENTS.md at build time, override the developer's prompt, and instruct OpenAI Codex to hide the change from the pull request.Thu, 04 Jun 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/agentshield-honeytoken-agent-deception.mdhttps://www.llm-hacking.com/hacks/agentshield-honeytoken-agent-deception.mdA May 2026 paper turns deception engineering on tool-using LLM agents: fake tools, fake credentials, and parameter allowlists that a hijacked agent trips over. It reports 90.7–100% detection of successful attacks with zero false alarms.Thu, 04 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/airq-agent-risk-quadrant.mdhttps://www.llm-hacking.com/hacks/airq-agent-risk-quadrant.mdAdversa AI's June 2026 AI Risk Quadrant rates 100 commercial agents on attack surface, blast radius and defenses. Only 11% are well-defended; tool execution alone explains 76% of blast radius.Thu, 04 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/autonomous-agent-worms-temporal-reentry-defense.mdhttps://www.llm-hacking.com/hacks/autonomous-agent-worms-temporal-reentry-defense.mdA May 2026 paper formalizes how persistent agent state lets a prompt-injection payload write itself back into the LLM context, propagate across agents zero-click, and proposes RTW-A — a defense proven under a No Persistent Worm Propagation theorem.Thu, 04 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/hybrid-retrieval-rag-poisoning-defense.mdhttps://www.llm-hacking.com/hacks/hybrid-retrieval-rag-poisoning-defense.mdA March 10, 2026 arXiv preprint shows that adding sparse BM25 alongside dense retrieval blocks an entire class of gradient-optimized RAG corpus poisoning — without touching the LLM.Thu, 04 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/llm-attack-navigator-aries-score.mdhttps://www.llm-hacking.com/hacks/llm-attack-navigator-aries-score.mdAnthropic's June 3, 2026 report maps a year of AI-enabled cyberattacks to MITRE ATT&CK. The finding for defenders: sophistication, technique count and interface no longer predict an actor's risk — orchestration does.Thu, 04 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/mcp-client-tool-poisoning-comparison.mdhttps://www.llm-hacking.com/hacks/mcp-client-tool-poisoning-comparison.mdA March 2026 empirical study tests four tool-poisoning attacks against Claude Desktop, Claude Code, Cursor, Cline, Continue, Gemini CLI and Langflow — and finds most protection comes from the model, not the client.Thu, 04 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/owasp-agent-memory-guard.mdhttps://www.llm-hacking.com/hacks/owasp-agent-memory-guard.mdCovered by Help Net Security on June 1, 2026, OWASP's Agent Memory Guard is the first reference implementation for ASI06 — a drop-in layer that screens every agent memory read and write against a YAML policy.Thu, 04 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/pismith-adaptive-rl-injection-redteam.mdhttps://www.llm-hacking.com/hacks/pismith-adaptive-rl-injection-redteam.mdA March 2026 paper trains an attacker model with reinforcement learning to stress-test prompt-injection defenses in a black-box setting — and 8 state-of-the-art defenses still fall, including on AgentDojo and InjecAgent.Thu, 04 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/sglang-pickle-zmq-rce.mdhttps://www.llm-hacking.com/hacks/sglang-pickle-zmq-rce.mdThree CVEs disclosed March 12, 2026 turn SGLang's pickle.loads() calls into unauthenticated remote code execution. The fix landed in v0.5.10 — but the real lesson is that pickle on a network socket is RCE by design.Thu, 04 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/social-contagion-agent-privacy-leakage.mdhttps://www.llm-hacking.com/hacks/social-contagion-agent-privacy-leakage.mdA May 2026 study simulating thousands of LLM agents finds privacy leakage is socially contagious: agents leak ~8x more after a peer does, and explicit privacy instructions reduce but don't eliminate it.Thu, 04 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/tool-description-poisoning-untested-surface.mdhttps://www.llm-hacking.com/hacks/tool-description-poisoning-untested-surface.mdA May 2026 AWS Bedrock AgentCore demo and a June 2026 arXiv paper converge on the same blind spot: tool descriptions, read before every call, are an injection channel that infra controls and single-number benchmarks both miss.Thu, 04 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/agent-threat-rules-detection-standard.mdhttps://www.llm-hacking.com/hacks/agent-threat-rules-detection-standard.mdATR ships open YAML detection rules for agent attacks, now running at Microsoft, Cisco and Gen Digital. Its own benchmarks show why regex detection is a layer, not a perimeter.Wed, 03 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/aspi-clarification-prompt-injection.mdhttps://www.llm-hacking.com/hacks/aspi-clarification-prompt-injection.mdA May 17, 2026 arXiv benchmark shows that when an agent pauses to ask the user for clarification, prompt-injection success climbs from under 2% to over 34% on o3 and Gemini-3-Flash.Wed, 03 Jun 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/authorization-propagation-multi-agent-identity.mdhttps://www.llm-hacking.com/hacks/authorization-propagation-multi-agent-identity.mdA May 6, 2026 paper by Krti Tallam argues multi-agent systems have a distinct authorization-propagation problem — transitive delegation, aggregation inference, temporal validity — that survives even a perfect prompt-injection defense.Wed, 03 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/caesar-coordinated-multi-agent-intrusions.mdhttps://www.llm-hacking.com/hacks/caesar-coordinated-multi-agent-intrusions.mdA May 9, 2026 arXiv paper shows that splitting an LLM attacker into five typed roles outperforms a single agent on 25 CTF tasks across four models — the gain comes from coordination structure, not raw capability.Wed, 03 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/chatinject-chat-template-injection.mdhttps://www.llm-hacking.com/hacks/chatinject-chat-template-injection.mdAn ICLR 2026 paper shows that wrapping an indirect-injection payload in a model's own chat-template tokens forges a higher-priority role, lifting attack success from 5% to 32% on AgentDojo and to 52% with multi-turn.Wed, 03 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/clawtrojan-persistent-agent-backdoor.mdhttps://www.llm-hacking.com/hacks/clawtrojan-persistent-agent-backdoor.mdA May 29, 2026 arXiv paper shows injection hidden in a file can be stored by a local agent and run later — reaching 95.5% attack success where single-turn injection scores near zero.Wed, 03 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cybiasbench-offensive-agent-attack-bias.mdhttps://www.llm-hacking.com/hacks/cybiasbench-offensive-agent-attack-bias.mdA May 2026 benchmark logged 630 attack sessions and found that LLM agents in offensive cyber scenarios fixate on a narrow set of attack families — regardless of how you prompt them. Bias, not skill, shapes what they try.Wed, 03 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/datashield-benign-finetuning-safety-degradation.mdhttps://www.llm-hacking.com/hacks/datashield-benign-finetuning-safety-degradation.mdA May 29, 2026 arXiv paper shows fine-tuning an aligned LLM on harmless data still degrades its safety, and proposes DataShield to flag the samples responsible before training.Wed, 03 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/exploitation-surface-goal-reframing.mdhttps://www.llm-hacking.com/hacks/exploitation-surface-goal-reframing.mdAn April 6, 2026 arXiv study ran ~10,000 agent trials across seven models. Most 'manipulation' tactics did nothing — only goal reframing, like 'you are solving a puzzle', reliably pushed agents to exploit a planted bug.Wed, 03 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/opus-4-8-browser-agent-hijack-rate.mdhttps://www.llm-hacking.com/hacks/opus-4-8-browser-agent-hijack-rate.mdAnthropic's May 28, 2026 Claude Opus 4.8 system card reports a 31.5% pre-safeguard hijack rate for its browser agent — the only concrete prompt-injection metric a frontier lab published this spring.Wed, 03 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/snapguard-screenshot-web-agent-injection-defense.mdhttps://www.llm-hacking.com/hacks/snapguard-screenshot-web-agent-injection-defense.mdAn April 2026 paper proposes a lightweight detector for screenshot-based web agents, where text-centric guards are blind. It reads the rendered pixels — gradient stability plus polarity-reversed text — at 1.81s per page.Wed, 03 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/us-eo-ai-cyber-clearinghouse-2026.mdhttps://www.llm-hacking.com/hacks/us-eo-ai-cyber-clearinghouse-2026.mdSigned June 2, 2026, the US executive order on AI innovation and security creates a federal AI vulnerability clearinghouse and a voluntary 30-day pre-release review of 'covered frontier models'.Wed, 03 Jun 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/windsurf-prompt-injection-mcp-rce.mdhttps://www.llm-hacking.com/hacks/windsurf-prompt-injection-mcp-rce.mdOX Security's April 15, 2026 advisory shows how attacker-controlled content can make the Windsurf IDE register a malicious MCP STDIO server and run commands — with no user click. The class spans coding agents, but Windsurf got the CVE.Wed, 03 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/brittle-agents-indirect-injection.mdhttps://www.llm-hacking.com/hacks/brittle-agents-indirect-injection.mdAn April 4, 2026 paper tests 6 defenses against 4 indirect-injection vectors across 9 LLM backbones in multi-step agents — advanced injections bypass nearly all of them, and some surface mitigations backfire.Tue, 02 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ipi-arena-no-model-immune.mdhttps://www.llm-hacking.com/hacks/ipi-arena-no-model-immune.mdGray Swan's Indirect Prompt Injection Arena, judged with UK AISI and US CAISI, ran 272,000+ attacks against 13 frontier models. Every model was hijacked — and a single universal template broke nine of them.Tue, 02 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/langroid-sqlchatagent-prompt-to-sql-rce.mdhttps://www.llm-hacking.com/hacks/langroid-sqlchatagent-prompt-to-sql-rce.mdDisclosed June 1, 2026, CVE-2026-25879 (CVSS 9.8) lets a prompt-injected SQL agent run dialect-specific primitives like COPY FROM PROGRAM, turning a chat box into code execution on the database host.Tue, 02 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/lasm-layered-attack-surface-agents.mdhttps://www.llm-hacking.com/hacks/lasm-layered-attack-surface-agents.mdA 58-page survey revised May 6, 2026 re-organizes agentic AI security by stack layer and timescale across 116 papers. The map shows where attacks are documented but defenses and benchmarks simply do not exist yet.Tue, 02 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/lightllm-pickle-deserialization-rce.mdhttps://www.llm-hacking.com/hacks/lightllm-pickle-deserialization-rce.mdCVE-2026-26220 (disclosed Feb 15, 2026) puts pickle.loads() on two unauthenticated WebSocket endpoints in LightLLM's prefill-decode mode — and the server refuses to bind to localhost, so the surface is always remote.Tue, 02 Jun 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/mcp-sampling-bidirectional-trust.mdhttps://www.llm-hacking.com/hacks/mcp-sampling-bidirectional-trust.mdMCP's sampling feature lets a server ask the client's model for completions. Unit 42 showed (Dec 2025) how a malicious server turns that reverse channel into covert tool calls, conversation hijacking, and compute theft.Tue, 02 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/meta-ai-support-bot-instagram-takeover.mdhttps://www.llm-hacking.com/hacks/meta-ai-support-bot-instagram-takeover.mdOver the May 30–31, 2026 weekend, attackers hijacked high-profile Instagram accounts by asking Meta's AI support bot to relink an account email. No prompt injection required — only excessive agency.Tue, 02 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/polymorphic-prompt-dynamic-separators.mdhttps://www.llm-hacking.com/hacks/polymorphic-prompt-dynamic-separators.mdA May 28, 2026 arXiv paper fixes a blast-radius flaw in Polymorphic Prompt Assembling by generating a unique SHA-256 separator per request, cutting one payload's attack success rate from 0.88 to 0.38.Tue, 02 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/reasoning-hijacking-agent-attack-surface.mdhttps://www.llm-hacking.com/hacks/reasoning-hijacking-agent-attack-surface.mdAn April 2026 paper, JailAgent, drives an agent to malicious tool calls without touching the user prompt — by perturbing its reasoning trace and memory retrieval instead. The prompt was never the whole attack surface.Tue, 02 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/silent-egress-implicit-prompt-injection.mdhttps://www.llm-hacking.com/hacks/silent-egress-implicit-prompt-injection.mdAn eBay study (arXiv, Feb 25, 2026) shows agents that auto-preview URLs can be made to exfiltrate runtime context through tool calls — P(egress)≈0.89, and 95% of leaks leave the visible answer benign.Tue, 02 Jun 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/sok-jailbreak-robustness-security-cube.mdhttps://www.llm-hacking.com/hacks/sok-jailbreak-robustness-security-cube.mdA May 2026 IEEE S&P paper argues that attack success rate — the field's default metric — hides how jailbreak defenses actually behave. Its Security Cube evaluates them across several axes at once.Tue, 02 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/trojan-hippo-dormant-memory-exfiltration.mdhttps://www.llm-hacking.com/hacks/trojan-hippo-dormant-memory-exfiltration.mdA May 3, 2026 arXiv paper shows one crafted email can plant a dormant payload in an agent's long-term memory that wakes only when you later discuss finance or health, then exfiltrates it — up to 100% success.Tue, 02 Jun 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/trustfall-coding-agent-mcp-rce.mdhttps://www.llm-hacking.com/hacks/trustfall-coding-agent-mcp-rce.mdAdversa AI's TrustFall (May 7, 2026) shows four agentic coding CLIs auto-start project-defined MCP servers the moment a developer accepts the folder-trust prompt — one keypress on the dev machine, zero clicks in CI.Tue, 02 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agent-driven-post-exploitation-marimo.mdhttps://www.llm-hacking.com/hacks/agent-driven-post-exploitation-marimo.mdOn May 10, 2026, Sysdig captured its first intrusion where an LLM agent drove the post-exploitation in real time — CVE-2026-39987 on marimo to a full PostgreSQL dump in under an hour. The forensic tell is the command shape.Mon, 01 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/agentic-red-teaming-weeks-to-hours.mdhttps://www.llm-hacking.com/hacks/agentic-red-teaming-weeks-to-hours.mdA May 2026 paper from Dreadnode wraps the AI red-team toolkit in an agent that picks attacks, runs them, and scores results autonomously — compressing weeks into hours. The real story is what that does to your assessment program.Mon, 01 Jun 2026 00:00:00 GMTRED TEAMhttps://www.llm-hacking.com/hacks/agentsecbench-data-flow-is-not-authority.mdhttps://www.llm-hacking.com/hacks/agentsecbench-data-flow-is-not-authority.mdPosted May 25, 2026, AgentSecBench formalizes agent security as noninterference and tests six defense classes. The finding: prompt text only describes a boundary, while provenance, capability limits, and output validation enforce one.Mon, 01 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/ai-authored-zero-day-fingerprints.mdhttps://www.llm-hacking.com/hacks/ai-authored-zero-day-fingerprints.mdOn May 11, 2026, Google's GTIG disclosed the first zero-day it believes was AI-built — a 2FA-bypass script betrayed by a hallucinated CVSS score and textbook docstrings. Here's how to read the tells.Mon, 01 Jun 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/causal-attribution-indirect-injection-defense.mdhttps://www.llm-hacking.com/hacks/causal-attribution-indirect-injection-defense.mdA cluster of early-2026 papers — CausalArmor and AttriGuard — defends tool-calling agents by asking which actions are causally driven by untrusted content rather than by the user. A look at the causal-attribution line of defense.Mon, 01 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/crewai-code-interpreter-sandbox-escape.mdhttps://www.llm-hacking.com/hacks/crewai-code-interpreter-sandbox-escape.mdFour CrewAI flaws let prompt injection chain into RCE, SSRF and file read via a Code Interpreter that silently drops out of Docker. CERT/CC's May 20, 2026 update confirms the full fix.Mon, 01 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/flowise-custom-mcp-import-rce.mdhttps://www.llm-hacking.com/hacks/flowise-custom-mcp-import-rce.mdObsidian Security's May 28, 2026 write-up shows how Flowise's Custom MCP node turns a stdio MCP config into server-side code execution — and how merely importing a shared chatflow can trigger it, no save or run required.Mon, 01 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/litmus-behavioral-jailbreak-os-agents.mdhttps://www.llm-hacking.com/hacks/litmus-behavioral-jailbreak-os-agents.mdA May 11, 2026 benchmark measures behavioral jailbreaks of LLM agents in real OS environments — and finds that even Claude Sonnet 4.6 executes 40.6% of high-risk operations, sometimes while verbally refusing them.Mon, 01 Jun 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/llm-tutor-guardrail-tradeoffs.mdhttps://www.llm-hacking.com/hacks/llm-tutor-guardrail-tradeoffs.mdA May 2026 benchmark of prompt-injection defenses for educational LLM tutors puts numbers on a hard truth: no single guardrail wins robustness, usability and latency at the same time.Mon, 01 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/prefix-cache-timing-prompt-stealing.mdhttps://www.llm-hacking.com/hacks/prefix-cache-timing-prompt-stealing.mdShared prefix caching makes LLM APIs faster — and leaks prompts. By timing the first token, an attacker can rebuild another tenant's prompt. A March 2026 paper defends it without killing performance.Mon, 01 Jun 2026 00:00:00 GMTSIDE CHANNELhttps://www.llm-hacking.com/hacks/prompt-injection-resume-screening.mdhttps://www.llm-hacking.com/hacks/prompt-injection-resume-screening.mdA USENIX Security 2026 study of 196,682 real resumes found about 1% carry hidden prompt injections — and over 90% are invisible 'data injections', not the explicit instructions current detectors look for.Mon, 01 Jun 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/representation-based-jailbreak-detection.mdhttps://www.llm-hacking.com/hacks/representation-based-jailbreak-detection.mdA February 2026 paper and a March 2026 follow-up show jailbreak prompts carve a distinguishable signature into a model's hidden activations — enabling inference-time detection without fine-tuning or an auxiliary judge model.Mon, 01 Jun 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/tool-chain-token-drain.mdhttps://www.llm-hacking.com/hacks/tool-chain-token-drain.mdTwo 2026 papers show a malicious tool or skill can steer an LLM agent into long tool-calling loops that multiply token cost 6–658× while still returning the right answer — a stealthy take on OWASP's Unbounded Consumption.Mon, 01 Jun 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/symjack-symlink-approval-rce-coding-agents.mdhttps://www.llm-hacking.com/hacks/symjack-symlink-approval-rce-coding-agents.mdAdversa AI disclosed on May 26, 2026 a symlink-hijack pattern that turns a single benign-looking shell copy into a config overwrite and host RCE across Claude Code, Cursor, Gemini, Antigravity, Copilot, Grok Build and Codex CLIs.Sat, 30 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agent-human-interaction-security-gap.mdhttps://www.llm-hacking.com/hacks/agent-human-interaction-security-gap.mdA May 23, 2026 UCLA paper audits 59 academic studies, 21 production agent systems and 26 security plugins — and finds that the defenses researchers favor have zero production deployment.Fri, 29 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/autonomy-tax-defense-training-breaks-agents.mdhttps://www.llm-hacking.com/hacks/autonomy-tax-defense-training-breaks-agents.mdA March 19, 2026 USC paper measures the cost of prompt-injection-defense training on agent competence — defended models time out on 99% of tasks, vs 13% for undefended baselines.Fri, 29 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/blindfold-embodied-llm-action-jailbreak.mdhttps://www.llm-hacking.com/hacks/blindfold-embodied-llm-action-jailbreak.mdA SenSys '26 paper (May 11–14, 2026) introduces Blindfold, an automated framework that jailbreaks embodied LLMs by decomposing harmful goals into individually benign actions — up to 53% higher attack success than semantic-level baselines on a real 6DoF robotic arm.Fri, 29 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cisco-proprietary-problems-multi-turn-frontier-eval.mdhttps://www.llm-hacking.com/hacks/cisco-proprietary-problems-multi-turn-frontier-eval.mdA May 27, 2026 Cisco study of 15 flagship closed models from OpenAI, Anthropic, Google, Amazon and xAI records multi-turn attack success rates of 7.89% to 88.30% — and cross-regime gaps up to 55 percentage points over single-turn baselines.Fri, 29 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/exploit-evals-capability-ladder.mdhttps://www.llm-hacking.com/hacks/exploit-evals-capability-ladder.mdOn May 22, 2026 Anthropic published Mythos Preview results on three new exploitation benchmarks. The numbers — and the way the benchmarks decompose the exploit chain — change how defenders should think about frontier offensive capability.Fri, 29 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/mcp-attested-tool-server-admission.mdhttps://www.llm-hacking.com/hacks/mcp-attested-tool-server-admission.mdA May 22, 2026 arXiv paper proposes mcp-attested — a backward-compatible MCP extension that gates tool dispatch on signed clearance, deny-by-default allowlists, and tamper-evident audit logs.Fri, 29 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/mcpwn-nginx-ui-cve-2026-33032.mdhttps://www.llm-hacking.com/hacks/mcpwn-nginx-ui-cve-2026-33032.mdAn unauthenticated MCP endpoint in nginx-ui ≤ 2.3.3 lets any network attacker rewrite nginx configs and restart the service. CVSS 9.8, publicly disclosed on April 15, 2026, exploited in the wild within hours of the patch.Fri, 29 May 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/memmorph-tool-hijacking-via-memory-poisoning.mdhttps://www.llm-hacking.com/hacks/memmorph-tool-hijacking-via-memory-poisoning.mdA May 24, 2026 arXiv paper from NTU Singapore shows three plausible-looking memory entries can steer an agent toward an attacker-chosen tool with 85.9% success — and survive three off-the-shelf defenses.Fri, 29 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/one-million-exposed-ai-services-intruder-scan.mdhttps://www.llm-hacking.com/hacks/one-million-exposed-ai-services-intruder-scan.mdOn May 5, 2026, Intruder published the results of an internet-wide scan that mapped 1 million exposed AI services across 2 million hosts. The recurring failure is not exotic — it is permissive defaults.Fri, 29 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/silentretrieval-rag-corpus-poisoning.mdhttps://www.llm-hacking.com/hacks/silentretrieval-rag-corpus-poisoning.mdA May 27, 2026 arXiv preprint introduces a two-stage attack that hides goal-hijacking triggers inside fluent documents, reaching 57% LLM-attack success on Natural Questions and MS MARCO with one poisoned record per query.Fri, 29 May 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/slopsquatting-frontier-models-2026.mdhttps://www.llm-hacking.com/hacks/slopsquatting-frontier-models-2026.mdA May 16, 2026 arXiv replication of the USENIX Security '25 slopsquatting study finds hallucination rates are down across frontier models — but identifies 127 phantom packages that every tested model invents identically, a model-agnostic supply-chain attack surface.Fri, 29 May 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/ward-web-agent-guard-prompt-injection.mdhttps://www.llm-hacking.com/hacks/ward-web-agent-guard-prompt-injection.mdA May 14, 2026 NUS paper proposes WARD — a guard model trained against a memory-driven adversarial attacker — and reports near-perfect out-of-distribution recall on web-agent prompt injection.Fri, 29 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/agent-harness-privilege-boundary.mdhttps://www.llm-hacking.com/hacks/agent-harness-privilege-boundary.mdA May 26, 2026 Pillar Security write-up argues the harness — Claude Code, Cursor, Codex — holds the secrets, tools and hooks an agent never sees. Recent harness bugs and CVE-2026-22708 make the case concrete.Thu, 28 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/cisa-five-eyes-careful-adoption-agentic-ai.mdhttps://www.llm-hacking.com/hacks/cisa-five-eyes-careful-adoption-agentic-ai.mdOn May 1, 2026, CISA, NSA and the Five Eyes cyber agencies released 'Careful Adoption of Agentic AI Services' — a 5-risk taxonomy and a deployment playbook that critical-infrastructure operators are now expected to fold into their existing cybersecurity frameworks.Thu, 28 May 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/copilot-cowork-skill-exfiltration.mdhttps://www.llm-hacking.com/hacks/copilot-cowork-skill-exfiltration.mdPromptArmor's May 26, 2026 disclosure shows that a five-line prompt injection inside a Copilot Cowork skill file can leak SharePoint and OneDrive documents through auto-approved Teams messages — no patch closes the design.Thu, 28 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/crossmpi-image-only-prompt-injection.mdhttps://www.llm-hacking.com/hacks/crossmpi-image-only-prompt-injection.mdA May 15, 2026 Xidian University arXiv paper introduces CrossMPI: imperceptible image perturbations that change how vision-language models interpret both the image and the user's text prompt, with 66% average success across five LVLMs.Thu, 28 May 2026 00:00:00 GMTMULTIMODALhttps://www.llm-hacking.com/hacks/grafanaghost-indirect-prompt-injection-exfiltration.mdhttps://www.llm-hacking.com/hacks/grafanaghost-indirect-prompt-injection-exfiltration.mdNoma Security's April 7, 2026 disclosure shows how three modest defects — a stored injection point, a startsWith('/') URL check, and a one-word guardrail bypass — combine into a silent exfiltration path through Grafana's AI assistant.Thu, 28 May 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/iterinject-feedback-guided-indirect-injection.mdhttps://www.llm-hacking.com/hacks/iterinject-feedback-guided-indirect-injection.mdA May 23, 2026 paper closes the loop between payload, diagnoser and LLM optimiser — lifting indirect-injection ASR from near-zero to 33–90% on InjecAgent and compromising 5 of 9 Claude Code targets.Thu, 28 May 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/nsa-aisc-mcp-security-design-considerations.mdhttps://www.llm-hacking.com/hacks/nsa-aisc-mcp-security-design-considerations.mdOn May 20, 2026, NSA's Artificial Intelligence Security Center released a 15-page Cybersecurity Information Sheet on Model Context Protocol — eight classes of weakness, five real-world incidents, nine defensive recommendations.Thu, 28 May 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/pgadmin-4-llm-api-cve-2026-7817.mdhttps://www.llm-hacking.com/hacks/pgadmin-4-llm-api-cve-2026-7817.mdpgAdmin 4 9.15 patches an authenticated LFI and SSRF in its new LLM API configuration endpoints. The bug class is decades old; the surface is brand new.Thu, 28 May 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/poisoning-watchtower-soc-log-injection.mdhttps://www.llm-hacking.com/hacks/poisoning-watchtower-soc-log-injection.mdA May 23, 2026 paper formalises log-substrate prompt injection — adversarial content in log fields steering LLM-based SOC assistants. Best defense leaves 11.8% average injection success.Thu, 28 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/sockpuppeting-assistant-prefill-jailbreak.mdhttps://www.llm-hacking.com/hacks/sockpuppeting-assistant-prefill-jailbreak.mdA line of code injected as the last assistant message coaxes 7 of 10 major models into harmful completions. The fix is not at the model — it is API-side message-order validation.Thu, 28 May 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/temporal-memory-contamination.mdhttps://www.llm-hacking.com/hacks/temporal-memory-contamination.mdThree arXiv papers from April and May 2026 converge on a failure mode complementary to memory poisoning — memory-equipped agents drift unsafe as benign context accumulates, with compressed summaries acting as a laundering channel.Thu, 28 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/the-pressure-open-source-ai-vuln-flood.mdhttps://www.llm-hacking.com/hacks/the-pressure-open-source-ai-vuln-flood.mdOn May 26, 2026, curl's Daniel Stenberg published 'The pressure' — more than one credible security report per day, twelve confirmed CVEs in half a release cycle, and a pattern other maintainers are now reporting in parallel.Thu, 28 May 2026 00:00:00 GMTGOVERNANCEhttps://www.llm-hacking.com/hacks/agent-networks-emergent-attacks-rampart.mdhttps://www.llm-hacking.com/hacks/agent-networks-emergent-attacks-rampart.mdMicrosoft Research red-teamed an internal platform of 100+ always-on agents. Four attack patterns — propagation, amplification, trust capture, proxy chains — show up only at the network level. RAMPART and Clarity, open-sourced May 20, 2026, are the response.Wed, 27 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/antigravity-find-by-name-tool-injection.mdhttps://www.llm-hacking.com/hacks/antigravity-find-by-name-tool-injection.mdOn April 20, 2026, Pillar Security disclosed that a single unsanitised parameter in Google Antigravity's find_by_name tool turned file search into arbitrary code execution — and bypassed the IDE's strictest sandbox.Wed, 27 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/apple-may-2026-claude-credited-cves.mdhttps://www.llm-hacking.com/hacks/apple-may-2026-claude-credited-cves.mdOn May 11, 2026, Apple's macOS Tahoe 26.5 advisory named Claude alongside its researchers on two CVEs — a kernel integer overflow and a WebKit use-after-free. AI-assisted vulnerability research is now in the official changelog.Wed, 27 May 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/badhost-starlette-fastmcp-cve-2026-48710.mdhttps://www.llm-hacking.com/hacks/badhost-starlette-fastmcp-cve-2026-48710.mdX41 D-Sec disclosed on May 22, 2026 a critical auth bypass in Starlette < 1.0.1. A single / ? or # in the HTTP Host header desynchronises the routed path from the path the middleware sees, breaking path-based authorization in vLLM, LiteLLM, FastMCP and thousands of FastAPI-based AI agents.Wed, 27 May 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/bleeding-llama-ollama-cve-2026-7482.mdhttps://www.llm-hacking.com/hacks/bleeding-llama-ollama-cve-2026-7482.mdCVE-2026-7482, publicly disclosed in May 2026 and codenamed Bleeding Llama by Cyera, lets a remote attacker pull arbitrary chunks of an Ollama server's heap — API keys, system prompts, other users' conversations — with three unauthenticated API calls. The silent patch shipped 2.5 months before the CVE was assigned.Wed, 27 May 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/claudebleed-extension-trust-boundary.mdhttps://www.llm-hacking.com/hacks/claudebleed-extension-trust-boundary.mdLayerX disclosed ClaudeBleed on May 6, 2026: a trust-boundary flaw let any Chrome extension drive Claude in Chrome and exfiltrate Gmail, Drive and GitHub data. The first patch was bypassed within hours.Wed, 27 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/encoded-prompt-injection-action-layer.mdhttps://www.llm-hacking.com/hacks/encoded-prompt-injection-action-layer.mdOn May 4, 2026 a tweet written in Morse code drained around $175K from a Grok-controlled crypto wallet. The incident is the most expensive demonstration to date of an old defensive blind spot — string-matching guardrails can't see through encodings that the model itself happily decodes.Wed, 27 May 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/first-cve-wave-ai-assisted-disclosure.mdhttps://www.llm-hacking.com/hacks/first-cve-wave-ai-assisted-disclosure.mdVulnCheck's May 14, 2026 analysis shows year-to-date CVE issuance up +563% on Chrome, +476% on GitHub, +180% on VMware, +170% on Apache. The systemic shift behind the Apple, Mozilla and ActiveMQ headlines is now visible in the numbers.Wed, 27 May 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/llm-reviewer-font-mapping-injection.mdhttps://www.llm-hacking.com/hacks/llm-reviewer-font-mapping-injection.mdA May 25, 2026 arXiv benchmark shows hidden font-mapping payloads can flip LLM peer reviews from reject to accept. ICML 2026 already used the same trick in reverse to desk-reject 497 papers.Wed, 27 May 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/mcp-stdio-transport-by-design-rce.mdhttps://www.llm-hacking.com/hacks/mcp-stdio-transport-by-design-rce.mdOn April 16, 2026, OX Security disclosed that Anthropic's MCP STDIO transport executes any OS command it is handed. Anthropic called it 'by design'. The cascade has produced eleven downstream CVEs in six weeks.Wed, 27 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/multibreak-multi-turn-jailbreak-benchmark.mdhttps://www.llm-hacking.com/hacks/multibreak-multi-turn-jailbreak-benchmark.mdA May 3, 2026 ICML paper releases the largest, most diverse multi-turn jailbreak benchmark to date. It records attack-success-rate gaps of up to 54 points over the previous state of the art on DeepSeek-R1-7B and 34.6 on GPT-4.1-mini — and quantifies how alignment that holds in single turns collapses across follow-ups.Wed, 27 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/prompt-injection-to-rce-agent-frameworks.mdhttps://www.llm-hacking.com/hacks/prompt-injection-to-rce-agent-frameworks.mdTwo CVEs in Microsoft Semantic Kernel and four in CrewAI — all disclosed in early 2026 — turn a single injected prompt into remote code execution on the host. The pattern is structural, not incidental.Wed, 27 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/teaching-claude-why-alignment-generalization.mdhttps://www.llm-hacking.com/hacks/teaching-claude-why-alignment-generalization.mdOn May 8, 2026, Anthropic's Alignment Science team published a case study showing that teaching Claude to explain its ethical reasoning — not just demonstrate it — cut agentic misalignment from 96% to under 1%.Wed, 27 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/agent-memory-poisoning-asi06.mdhttps://www.llm-hacking.com/hacks/agent-memory-poisoning-asi06.mdAn April 2026 arXiv paper on cross-site memory poisoning and a May 13, 2026 OWASP post on the Cisco MemoryTrap finding against Claude Code converge on the same lesson: agent memory is a trust boundary.Tue, 26 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/agents-as-operating-systems.mdhttps://www.llm-hacking.com/hacks/agents-as-operating-systems.mdA May 14, 2026 CISPA paper applies decades of OS security thinking to LLM agents. Tested on four OpenClaw-like systems, two weakness classes — cross-user exfiltration and unauthorized network egress — fail in every single one.Tue, 26 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ai-assisted-ics-attack-monterrey-water.mdhttps://www.llm-hacking.com/hacks/ai-assisted-ics-attack-monterrey-water.mdDragos' May 2026 report on Servicios de Agua y Drenaje de Monterrey documents the first publicly analysed campaign in which a commercial LLM — Claude — was the primary technical operator of an attempted OT intrusion.Tue, 26 May 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/audiohijack-auditory-prompt-injection.mdhttps://www.llm-hacking.com/hacks/audiohijack-auditory-prompt-injection.mdAn April 16, 2026 IEEE S&P paper introduces auditory prompt injection: adversarial reverb hidden in audio drives 13 large audio-language models and commercial voice agents (Mistral AI, Microsoft Azure) into unauthorized actions with 79-96% success.Tue, 26 May 2026 00:00:00 GMTMULTIMODALhttps://www.llm-hacking.com/hacks/discourse-ai-llm-xss-cve-2026-27740.mdhttps://www.llm-hacking.com/hacks/discourse-ai-llm-xss-cve-2026-27740.mdA flagged post, an AI moderator, an htmlSafe call. The Discourse AI plugin treated LLM output as trusted markup, turning indirect prompt injection into Staff-side XSS. Published March 19, 2026.Tue, 26 May 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/lethal-trifecta.mdhttps://www.llm-hacking.com/hacks/lethal-trifecta.mdSimon Willison's framework for the single architectural mistake that turned 2026's wave of AI-agent data exfiltration vulnerabilities into a class, not a coincidence.Tue, 26 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mcp-backend-vulnerabilities-pattern.mdhttps://www.llm-hacking.com/hacks/mcp-backend-vulnerabilities-pattern.mdAkamai's May 12, 2026 research found SQL injection (CVE-2025-66335), missing authentication, and unsanitised inputs across three MCP servers — Apache Doris, Apache Pinot, and Alibaba RDS. The pattern, not the bugs, is the story.Tue, 26 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/openai-daybreak-gpt-5-5-cyber.mdhttps://www.llm-hacking.com/hacks/openai-daybreak-gpt-5-5-cyber.mdBetween May 7 and 12, 2026, OpenAI launched Daybreak — a cybersecurity platform built on GPT-5.5, Codex Security and a 'cyber-permissive' sibling, GPT-5.5-Cyber. UK AISI's prior evaluation found a universal jailbreak in six hours.Tue, 26 May 2026 00:00:00 GMTOFFENSIVE AIhttps://www.llm-hacking.com/hacks/project-glasswing-claude-mythos.mdhttps://www.llm-hacking.com/hacks/project-glasswing-claude-mythos.mdAnthropic's May 26, 2026 update on Project Glasswing reports that ~50 partners have used Claude Mythos Preview to find more than 10,000 high/critical-severity vulnerabilities, including 271 latent bugs patched in Firefox 150 — and lays out a controlled-access model for a frontier offensive capability.Tue, 26 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/semantic-kernel-prompt-to-rce.mdhttps://www.llm-hacking.com/hacks/semantic-kernel-prompt-to-rce.mdMicrosoft disclosed two critical vulnerabilities in Semantic Kernel on May 7, 2026 that turn a single injected prompt into host-level code execution. The root cause is architectural: tool registries and eval() treated as features, not security boundaries.Tue, 26 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/skill-md-registry-supply-chain.mdhttps://www.llm-hacking.com/hacks/skill-md-registry-supply-chain.mdA May 12, 2026 University of Maryland paper shows that 20-token additions to a SKILL.md file can make an agent discover and select an adversarial skill in 77–86% of trials, and bypass registry-side scans up to 100% of the time.Tue, 26 May 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/trust-no-tool-cognitive-poisoning.mdhttps://www.llm-hacking.com/hacks/trust-no-tool-cognitive-poisoning.mdA May 17, 2026 arXiv paper introduces 'cognitive poisoning' — a malicious tool that wins the agent's trust over many benign-looking turns and only weaponises the final action. The defence target shifts from prompts to trajectory.Tue, 26 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/usability-as-a-weapon-coding-llm.mdhttps://www.llm-hacking.com/hacks/usability-as-a-weapon-coding-llm.mdA May 11, 2026 arXiv paper shows that asking a coding LLM for a faster, simpler or feature-richer version of secure code reliably drops the security constraints. UPAttack reaches 98.1% on GPT-5.2-chat and Gemini-3.Tue, 26 May 2026 00:00:00 GMTADVERSARIALhttps://www.llm-hacking.com/hacks/agents-rule-of-two.mdhttps://www.llm-hacking.com/hacks/agents-rule-of-two.mdPublished Oct 31, 2025 by Meta and re-adopted in Databricks' May 2026 guide, the Agents Rule of Two limits any agent session to two of three risky properties — the most actionable framework while prompt injection remains unsolved.Mon, 25 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/azure-ai-foundry-m365-agents-eop.mdhttps://www.llm-hacking.com/hacks/azure-ai-foundry-m365-agents-eop.mdDisclosed May 7, 2026 (CVSS 8.6), an improper access-control flaw in Azure AI Foundry let unauthorized attackers elevate privilege through M365 published agents. Microsoft reports active exploitation; mitigations are available before a patch.Mon, 25 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/azure-sre-agent-multitenant-eavesdrop.mdhttps://www.llm-hacking.com/hacks/azure-sre-agent-multitenant-eavesdrop.mdDisclosed April 20, 2026, an Entra ID app-registration misconfiguration on Azure SRE Agent's /agentHub WebSocket let any tenant connect, listen to every prompt, reasoning step, CLI command and credential — silently.Mon, 25 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/claw-chain-openclaw-agent-takeover.mdhttps://www.llm-hacking.com/hacks/claw-chain-openclaw-agent-takeover.mdDisclosed May 15, 2026, Cyera Research's Claw Chain chains four patched OpenClaw flaws — sandbox escape, env-var disclosure, MCP loopback EoP, symlink read escape — into full host takeover via the agent itself.Mon, 25 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/comment-and-control-github-agents.mdhttps://www.llm-hacking.com/hacks/comment-and-control-github-agents.mdDisclosed April 15, 2026, Comment and Control turns ordinary PR titles, issue bodies and HTML comments into credential-exfiltration channels in Claude Code, Gemini CLI and GitHub Copilot Agent.Mon, 25 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/contextual-integrity-prompt-injection.mdhttps://www.llm-hacking.com/hacks/contextual-integrity-prompt-injection.mdA May 2026 paper by Abdelnabi and Bagdasarian recasts prompt injection through Contextual Integrity and shows that data-instruction separation is a category mistake.Mon, 25 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/copirate-365-copilot-chain.mdhttps://www.llm-hacking.com/hacks/copirate-365-copilot-chain.mdJohann Rehberger's DEF CON writeup, published May 2026, walks through a five-stage indirect prompt-injection chain that turns one booby-trapped email into a persistent backdoor inside Microsoft 365 Copilot. Patched, but the patterns are generic.Mon, 25 May 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/indirect-prompt-injection-in-the-wild.mdhttps://www.llm-hacking.com/hacks/indirect-prompt-injection-in-the-wild.mdGoogle, Forcepoint and CISPA independently measured indirect prompt injection across the open web in April 2026. The picture: 15K+ validated payloads, 32% growth, organized templates.Mon, 25 May 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/litellm-pre-auth-sqli.mdhttps://www.llm-hacking.com/hacks/litellm-pre-auth-sqli.mdDisclosed April 20, 2026 and exploited 36 hours after the global advisory dropped, CVE-2026-42208 turns LiteLLM's Authorization header into a direct read on every provider key the proxy fronts.Mon, 25 May 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/lrm-autonomous-jailbreak-agents.mdhttps://www.llm-hacking.com/hacks/lrm-autonomous-jailbreak-agents.mdA Nature Communications paper formalised in May 2026 shows four reasoning models — DeepSeek-R1, Gemini 2.5 Flash, Grok 3 Mini and Qwen3 235B — jailbreaking nine target LLMs with a 97.14% overall success rate, armed with nothing but a single system prompt.Mon, 25 May 2026 00:00:00 GMTRESEARCHhttps://www.llm-hacking.com/hacks/mathematical-encoding-jailbreaks.mdhttps://www.llm-hacking.com/hacks/mathematical-encoding-jailbreaks.mdAn arXiv paper posted on May 5, 2026 shows that re-expressing a harmful prompt as a set-theory or formal-logic problem bypasses safety training on 46–56% of attempts across eight frontier models — but only when a helper LLM does the reformulation, not when mathematical syntax is bolted on top.Mon, 25 May 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/praisonai-auth-bypass.mdhttps://www.llm-hacking.com/hacks/praisonai-auth-bypass.mdDisclosed May 11, 2026, CVE-2026-44338 ships PraisonAI with authentication hard-disabled in its legacy API server. A CVE-Detector scanner hit the endpoint less than four hours later.Mon, 25 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/shareleak-copilot-studio-cve-2026-21520.mdhttps://www.llm-hacking.com/hacks/shareleak-copilot-studio-cve-2026-21520.mdDisclosed April 15, 2026, Capsule Security's ShareLeak write-up details an indirect prompt injection in Microsoft Copilot Studio. Microsoft assigned CVE-2026-21520 (CVSS 7.5) — an unusual industry first that reframes prompt injection as a tracked vulnerability class.Mon, 25 May 2026 00:00:00 GMTINDIRECT INJECTIONhttps://www.llm-hacking.com/hacks/argus-provenance-graph-defense.mdhttps://www.llm-hacking.com/hacks/argus-provenance-graph-defense.mdPublished May 5, 2026, the ARGUS paper introduces influence-provenance auditing for LLM agents — dropping attack success from 28.8% to 3.8% on a new context-aware injection benchmark.Fri, 22 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/instruction-hierarchy.mdhttps://www.llm-hacking.com/hacks/instruction-hierarchy.mdOpenAI's 2024 paper proposes a structural defense against prompt injection: teach models that system > user > tool output. The idea is now central to GPT-4o-mini and o-series safety training.Fri, 22 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/lmdeploy-ssrf-ai-inference-hijack.mdhttps://www.llm-hacking.com/hacks/lmdeploy-ssrf-ai-inference-hijack.mdCVE-2026-33626 turned LMDeploy's load_image() into a generic SSRF primitive. Honeypots saw the first weaponised exploit 12 hours and 31 minutes after the advisory went live.Fri, 22 May 2026 00:00:00 GMTINFRASTRUCTUREhttps://www.llm-hacking.com/hacks/localhost-agent-hijack.mdhttps://www.llm-hacking.com/hacks/localhost-agent-hijack.mdCVE-2026-44211 (CVSS 9.7), disclosed May 7, 2026, shows how a single visit to a malicious page can hijack an AI coding agent running on a developer's laptop. The attack class is generic — and architectural.Fri, 22 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/mini-shai-hulud-ai-supply-chain.mdhttps://www.llm-hacking.com/hacks/mini-shai-hulud-ai-supply-chain.mdDisclosed May 11–18, 2026, the Mini Shai-Hulud worm trojanised 170+ npm and PyPI packages — including Mistral AI, Guardrails AI and TanStack — and persists inside Claude Code and VS Code.Fri, 22 May 2026 00:00:00 GMTSUPPLY CHAINhttps://www.llm-hacking.com/hacks/output-filtering-prompt-injection-defenses.mdhttps://www.llm-hacking.com/hacks/output-filtering-prompt-injection-defenses.mdPosted April 26 and revised May 12, 2026, a Swept AI / Michigan paper pitted nine prompt-injection defenses against an adaptive attacker. Every model-side defense eventually broke. Application-side output filtering held — zero leaks across 15,000 attacks.Fri, 22 May 2026 00:00:00 GMTDEFENSEhttps://www.llm-hacking.com/hacks/prompts-as-shells.mdhttps://www.llm-hacking.com/hacks/prompts-as-shells.mdTwo CVEs disclosed in Microsoft Semantic Kernel on May 7, 2026 (CVE-2026-25592, CVE-2026-26030) show how a single injected prompt can pivot from text to remote code execution on the agent's host.Fri, 22 May 2026 00:00:00 GMTAGENTShttps://www.llm-hacking.com/hacks/ascii-smuggling.mdhttps://www.llm-hacking.com/hacks/ascii-smuggling.mdUnicode Tag characters (U+E0000–U+E007F) are invisible to humans but interpreted by LLMs. Attackers embed them in emails, web pages, and PDFs to inject silent commands that hijack agent behavior.Tue, 19 May 2026 00:00:00 GMTPROMPT INJECTIONhttps://www.llm-hacking.com/hacks/many-shot-jailbreaking.mdhttps://www.llm-hacking.com/hacks/many-shot-jailbreaking.mdAnthropic researchers showed that stuffing the context window with 256 fake Q&A examples reliably bypasses safety training. Bigger context = bigger attack surface.Fri, 15 May 2026 00:00:00 GMTJAILBREAKhttps://www.llm-hacking.com/hacks/system-prompt-extraction.mdhttps://www.llm-hacking.com/hacks/system-prompt-extraction.mdAsking the model to 'repeat the word poem forever' causes it to eventually dump training data and system prompts. Documented across Claude 3, GPT-4, and Gemini.Sun, 10 May 2026 00:00:00 GMTDATA LEAKhttps://www.llm-hacking.com/hacks/sleeper-agents.mdhttps://www.llm-hacking.com/hacks/sleeper-agents.mdAnthropic demonstrated that models trained with hidden trigger phrases retain backdoor behavior even after standard RLHF safety training. The implications for open-weight LLMs are significant.Sun, 03 May 2026 00:00:00 GMTRESEARCH