LLM-HackingOpen database of LLM attacks, jailbreaks, and defenses.https://www.llm-hacking.com/SymJack: one approved file copy becomes RCE in six AI coding agentshttps://www.llm-hacking.com/hacks/symjack-symlink-approval-rce-coding-agents.mdhttps://www.llm-hacking.com/hacks/symjack-symlink-approval-rce-coding-agents.mdAdversa AI disclosed on May 26, 2026 a symlink-hijack pattern that turns a single benign-looking shell copy into a config overwrite and host RCE across Claude Code, Cursor, Gemini, Antigravity, Copilot, Grok Build and Codex CLIs.Sat, 30 May 2026 00:00:00 GMTAGENTSSlopsquatting in 2026: 127 package names that all five frontier LLMs hallucinatehttps://www.llm-hacking.com/hacks/slopsquatting-frontier-models-2026.mdhttps://www.llm-hacking.com/hacks/slopsquatting-frontier-models-2026.mdA May 16, 2026 arXiv replication of the USENIX Security '25 slopsquatting study finds hallucination rates are down across frontier models — but identifies 127 phantom packages that every tested model invents identically, a model-agnostic supply-chain attack surface.Fri, 29 May 2026 00:00:00 GMTSUPPLY CHAINBlindfold: action-level jailbreaks bypass semantic defenses on embodied LLMshttps://www.llm-hacking.com/hacks/blindfold-embodied-llm-action-jailbreak.mdhttps://www.llm-hacking.com/hacks/blindfold-embodied-llm-action-jailbreak.mdA SenSys '26 paper (May 11–14, 2026) introduces Blindfold, an automated framework that jailbreaks embodied LLMs by decomposing harmful goals into individually benign actions — up to 53% higher attack success than semantic-level baselines on a real 6DoF robotic arm.Fri, 29 May 2026 00:00:00 GMTAGENTSMCPwn (CVE-2026-33032): nginx-ui MCP endpoint hands over the web serverhttps://www.llm-hacking.com/hacks/mcpwn-nginx-ui-cve-2026-33032.mdhttps://www.llm-hacking.com/hacks/mcpwn-nginx-ui-cve-2026-33032.mdAn unauthenticated MCP endpoint in nginx-ui ≤ 2.3.3 lets any network attacker rewrite nginx configs and restart the service. CVSS 9.8, publicly disclosed on April 15, 2026, exploited in the wild within hours of the patch.Fri, 29 May 2026 00:00:00 GMTINFRASTRUCTUREMeasuring LLM exploit capability: ExploitBench, ExploitGym and the SCONE-bench refreshhttps://www.llm-hacking.com/hacks/exploit-evals-capability-ladder.mdhttps://www.llm-hacking.com/hacks/exploit-evals-capability-ladder.mdOn May 22, 2026 Anthropic published Mythos Preview results on three new exploitation benchmarks. The numbers — and the way the benchmarks decompose the exploit chain — change how defenders should think about frontier offensive capability.Fri, 29 May 2026 00:00:00 GMTRESEARCHProprietary Problems: Cisco's 15-model paired-regime study shows single-turn safety scores miss most multi-turn riskhttps://www.llm-hacking.com/hacks/cisco-proprietary-problems-multi-turn-frontier-eval.mdhttps://www.llm-hacking.com/hacks/cisco-proprietary-problems-multi-turn-frontier-eval.mdA May 27, 2026 Cisco study of 15 flagship closed models from OpenAI, Anthropic, Google, Amazon and xAI records multi-turn attack success rates of 7.89% to 88.30% — and cross-regime gaps up to 55 percentage points over single-turn baselines.Fri, 29 May 2026 00:00:00 GMTRESEARCHOne million exposed AI services: what the Intruder scan actually foundhttps://www.llm-hacking.com/hacks/one-million-exposed-ai-services-intruder-scan.mdhttps://www.llm-hacking.com/hacks/one-million-exposed-ai-services-intruder-scan.mdOn May 5, 2026, Intruder published the results of an internet-wide scan that mapped 1 million exposed AI services across 2 million hosts. The recurring failure is not exotic — it is permissive defaults.Fri, 29 May 2026 00:00:00 GMTDEFENSEThe agent-human security gap: what production ships, what papers studyhttps://www.llm-hacking.com/hacks/agent-human-interaction-security-gap.mdhttps://www.llm-hacking.com/hacks/agent-human-interaction-security-gap.mdA May 23, 2026 UCLA paper audits 59 academic studies, 21 production agent systems and 26 security plugins — and finds that the defenses researchers favor have zero production deployment.Fri, 29 May 2026 00:00:00 GMTRESEARCHThe Autonomy Tax: how defense training breaks LLM agentshttps://www.llm-hacking.com/hacks/autonomy-tax-defense-training-breaks-agents.mdhttps://www.llm-hacking.com/hacks/autonomy-tax-defense-training-breaks-agents.mdA March 19, 2026 USC paper measures the cost of prompt-injection-defense training on agent competence — defended models time out on 99% of tasks, vs 13% for undefended baselines.Fri, 29 May 2026 00:00:00 GMTRESEARCHMCP needs a trust handshake: attested tool-server admissionhttps://www.llm-hacking.com/hacks/mcp-attested-tool-server-admission.mdhttps://www.llm-hacking.com/hacks/mcp-attested-tool-server-admission.mdA May 22, 2026 arXiv paper proposes mcp-attested — a backward-compatible MCP extension that gates tool dispatch on signed clearance, deny-by-default allowlists, and tamper-evident audit logs.Fri, 29 May 2026 00:00:00 GMTDEFENSEWARD: a co-evolved guard model that holds up against adaptive prompt injection on web agentshttps://www.llm-hacking.com/hacks/ward-web-agent-guard-prompt-injection.mdhttps://www.llm-hacking.com/hacks/ward-web-agent-guard-prompt-injection.mdA May 14, 2026 NUS paper proposes WARD — a guard model trained against a memory-driven adversarial attacker — and reports near-perfect out-of-distribution recall on web-agent prompt injection.Fri, 29 May 2026 00:00:00 GMTDEFENSEMemMorph: hijacking tool selection in LLM agents through fluent memory poisoninghttps://www.llm-hacking.com/hacks/memmorph-tool-hijacking-via-memory-poisoning.mdhttps://www.llm-hacking.com/hacks/memmorph-tool-hijacking-via-memory-poisoning.mdA May 24, 2026 arXiv paper from NTU Singapore shows three plausible-looking memory entries can steer an agent toward an attacker-chosen tool with 85.9% success — and survive three off-the-shelf defenses.Fri, 29 May 2026 00:00:00 GMTAGENTSSilentRetrieval: fluent RAG corpus poisoning that slips past perplexity filtershttps://www.llm-hacking.com/hacks/silentretrieval-rag-corpus-poisoning.mdhttps://www.llm-hacking.com/hacks/silentretrieval-rag-corpus-poisoning.mdA May 27, 2026 arXiv preprint introduces a two-stage attack that hides goal-hijacking triggers inside fluent documents, reaching 57% LLM-attack success on Natural Questions and MS MARCO with one poisoned record per query.Fri, 29 May 2026 00:00:00 GMTADVERSARIALCISA + Five Eyes publish the first joint guidance on agentic-AI adoptionhttps://www.llm-hacking.com/hacks/cisa-five-eyes-careful-adoption-agentic-ai.mdhttps://www.llm-hacking.com/hacks/cisa-five-eyes-careful-adoption-agentic-ai.mdOn May 1, 2026, CISA, NSA and the Five Eyes cyber agencies released 'Careful Adoption of Agentic AI Services' — a 5-risk taxonomy and a deployment playbook that critical-infrastructure operators are now expected to fold into their existing cybersecurity frameworks.Thu, 28 May 2026 00:00:00 GMTGOVERNANCEMicrosoft Copilot Cowork: poisoned skills exfiltrate M365 files with no approvalhttps://www.llm-hacking.com/hacks/copilot-cowork-skill-exfiltration.mdhttps://www.llm-hacking.com/hacks/copilot-cowork-skill-exfiltration.mdPromptArmor's May 26, 2026 disclosure shows that a five-line prompt injection inside a Copilot Cowork skill file can leak SharePoint and OneDrive documents through auto-approved Teams messages — no patch closes the design.Thu, 28 May 2026 00:00:00 GMTAGENTSCrossMPI: image-only prompt injection steers what VLMs read and seehttps://www.llm-hacking.com/hacks/crossmpi-image-only-prompt-injection.mdhttps://www.llm-hacking.com/hacks/crossmpi-image-only-prompt-injection.mdA May 15, 2026 Xidian University arXiv paper introduces CrossMPI: imperceptible image perturbations that change how vision-language models interpret both the image and the user's text prompt, with 66% average success across five LVLMs.Thu, 28 May 2026 00:00:00 GMTMULTIMODALIterInject: when an LLM optimiser writes its own indirect prompt injectionshttps://www.llm-hacking.com/hacks/iterinject-feedback-guided-indirect-injection.mdhttps://www.llm-hacking.com/hacks/iterinject-feedback-guided-indirect-injection.mdA May 23, 2026 paper closes the loop between payload, diagnoser and LLM optimiser — lifting indirect-injection ASR from near-zero to 33–90% on InjecAgent and compromising 5 of 9 Claude Code targets.Thu, 28 May 2026 00:00:00 GMTINDIRECT INJECTIONNSA AISC publishes MCP security design guidance for production AIhttps://www.llm-hacking.com/hacks/nsa-aisc-mcp-security-design-considerations.mdhttps://www.llm-hacking.com/hacks/nsa-aisc-mcp-security-design-considerations.mdOn May 20, 2026, NSA's Artificial Intelligence Security Center released a 15-page Cybersecurity Information Sheet on Model Context Protocol — eight classes of weakness, five real-world incidents, nine defensive recommendations.Thu, 28 May 2026 00:00:00 GMTGOVERNANCEPoisoning the Watchtower: when SOC copilots read attacker-controlled logshttps://www.llm-hacking.com/hacks/poisoning-watchtower-soc-log-injection.mdhttps://www.llm-hacking.com/hacks/poisoning-watchtower-soc-log-injection.mdA May 23, 2026 paper formalises log-substrate prompt injection — adversarial content in log fields steering LLM-based SOC assistants. Best defense leaves 11.8% average injection success.Thu, 28 May 2026 00:00:00 GMTRESEARCHpgAdmin 4 ships an LLM panel and a classic LFI+SSRF arrives with it (CVE-2026-7817)https://www.llm-hacking.com/hacks/pgadmin-4-llm-api-cve-2026-7817.mdhttps://www.llm-hacking.com/hacks/pgadmin-4-llm-api-cve-2026-7817.mdpgAdmin 4 9.15 patches an authenticated LFI and SSRF in its new LLM API configuration endpoints. The bug class is decades old; the surface is brand new.Thu, 28 May 2026 00:00:00 GMTSUPPLY CHAINTemporal memory contamination: longitudinal safety drift in memory-equipped LLM agentshttps://www.llm-hacking.com/hacks/temporal-memory-contamination.mdhttps://www.llm-hacking.com/hacks/temporal-memory-contamination.mdThree arXiv papers from April and May 2026 converge on a failure mode complementary to memory poisoning — memory-equipped agents drift unsafe as benign context accumulates, with compressed summaries acting as a laundering channel.Thu, 28 May 2026 00:00:00 GMTAGENTSThe pressure: open-source security teams under the AI-assisted vulnerability floodhttps://www.llm-hacking.com/hacks/the-pressure-open-source-ai-vuln-flood.mdhttps://www.llm-hacking.com/hacks/the-pressure-open-source-ai-vuln-flood.mdOn May 26, 2026, curl's Daniel Stenberg published 'The pressure' — more than one credible security report per day, twelve confirmed CVEs in half a release cycle, and a pattern other maintainers are now reporting in parallel.Thu, 28 May 2026 00:00:00 GMTGOVERNANCEThe agent harness is your real privilege boundary — and most teams draw it in the wrong placehttps://www.llm-hacking.com/hacks/agent-harness-privilege-boundary.mdhttps://www.llm-hacking.com/hacks/agent-harness-privilege-boundary.mdA May 26, 2026 Pillar Security write-up argues the harness — Claude Code, Cursor, Codex — holds the secrets, tools and hooks an agent never sees. Recent harness bugs and CVE-2026-22708 make the case concrete.Thu, 28 May 2026 00:00:00 GMTAGENTSSockpuppeting: a one-line prefill that jailbreaks 11 production LLMshttps://www.llm-hacking.com/hacks/sockpuppeting-assistant-prefill-jailbreak.mdhttps://www.llm-hacking.com/hacks/sockpuppeting-assistant-prefill-jailbreak.mdA line of code injected as the last assistant message coaxes 7 of 10 major models into harmful completions. The fix is not at the model — it is API-side message-order validation.Thu, 28 May 2026 00:00:00 GMTJAILBREAKGrafanaGhost: indirect prompt injection chained with a URL-parse bug to exfiltrate dashboard datahttps://www.llm-hacking.com/hacks/grafanaghost-indirect-prompt-injection-exfiltration.mdhttps://www.llm-hacking.com/hacks/grafanaghost-indirect-prompt-injection-exfiltration.mdNoma Security's April 7, 2026 disclosure shows how three modest defects — a stored injection point, a startsWith('/') URL check, and a one-word guardrail bypass — combine into a silent exfiltration path through Grafana's AI assistant.Thu, 28 May 2026 00:00:00 GMTINDIRECT INJECTIONNetworks of agents break in new ways: Microsoft's red-team, plus RAMPART and Clarityhttps://www.llm-hacking.com/hacks/agent-networks-emergent-attacks-rampart.mdhttps://www.llm-hacking.com/hacks/agent-networks-emergent-attacks-rampart.mdMicrosoft Research red-teamed an internal platform of 100+ always-on agents. Four attack patterns — propagation, amplification, trust capture, proxy chains — show up only at the network level. RAMPART and Clarity, open-sourced May 20, 2026, are the response.Wed, 27 May 2026 00:00:00 GMTAGENTSAntigravity find_by_name: when a native tool call jumps over Secure Modehttps://www.llm-hacking.com/hacks/antigravity-find-by-name-tool-injection.mdhttps://www.llm-hacking.com/hacks/antigravity-find-by-name-tool-injection.mdOn April 20, 2026, Pillar Security disclosed that a single unsanitised parameter in Google Antigravity's find_by_name tool turned file search into arbitrary code execution — and bypassed the IDE's strictest sandbox.Wed, 27 May 2026 00:00:00 GMTAGENTSApple's May 2026 bulletin formally credits Claude on two macOS CVEshttps://www.llm-hacking.com/hacks/apple-may-2026-claude-credited-cves.mdhttps://www.llm-hacking.com/hacks/apple-may-2026-claude-credited-cves.mdOn May 11, 2026, Apple's macOS Tahoe 26.5 advisory named Claude alongside its researchers on two CVEs — a kernel integer overflow and a WebKit use-after-free. AI-assisted vulnerability research is now in the official changelog.Wed, 27 May 2026 00:00:00 GMTOFFENSIVE AIBadHost (CVE-2026-48710): one Host-header character bypasses auth in Starlette, vLLM and FastMCPhttps://www.llm-hacking.com/hacks/badhost-starlette-fastmcp-cve-2026-48710.mdhttps://www.llm-hacking.com/hacks/badhost-starlette-fastmcp-cve-2026-48710.mdX41 D-Sec disclosed on May 22, 2026 a critical auth bypass in Starlette < 1.0.1. A single / ? or # in the HTTP Host header desynchronises the routed path from the path the middleware sees, breaking path-based authorization in vLLM, LiteLLM, FastMCP and thousands of FastAPI-based AI agents.Wed, 27 May 2026 00:00:00 GMTINFRASTRUCTUREBleeding Llama: a GGUF parsing flaw leaks Ollama process memory to unauthenticated attackershttps://www.llm-hacking.com/hacks/bleeding-llama-ollama-cve-2026-7482.mdhttps://www.llm-hacking.com/hacks/bleeding-llama-ollama-cve-2026-7482.mdCVE-2026-7482, publicly disclosed in May 2026 and codenamed Bleeding Llama by Cyera, lets a remote attacker pull arbitrary chunks of an Ollama server's heap — API keys, system prompts, other users' conversations — with three unauthenticated API calls. The silent patch shipped 2.5 months before the CVE was assigned.Wed, 27 May 2026 00:00:00 GMTDATA LEAKClaudeBleed: when a browser agent trusts the wrong extensionhttps://www.llm-hacking.com/hacks/claudebleed-extension-trust-boundary.mdhttps://www.llm-hacking.com/hacks/claudebleed-extension-trust-boundary.mdLayerX disclosed ClaudeBleed on May 6, 2026: a trust-boundary flaw let any Chrome extension drive Claude in Chrome and exfiltrate Gmail, Drive and GitHub data. The first patch was bypassed within hours.Wed, 27 May 2026 00:00:00 GMTAGENTSEncoded prompt injection: when guardrails fail because the LLM decodes the payloadhttps://www.llm-hacking.com/hacks/encoded-prompt-injection-action-layer.mdhttps://www.llm-hacking.com/hacks/encoded-prompt-injection-action-layer.mdOn May 4, 2026 a tweet written in Morse code drained around $175K from a Grok-controlled crypto wallet. The incident is the most expensive demonstration to date of an old defensive blind spot — string-matching guardrails can't see through encodings that the model itself happily decodes.Wed, 27 May 2026 00:00:00 GMTPROMPT INJECTIONThe first CVE wave: AI-assisted discovery is reshaping disclosure volumeshttps://www.llm-hacking.com/hacks/first-cve-wave-ai-assisted-disclosure.mdhttps://www.llm-hacking.com/hacks/first-cve-wave-ai-assisted-disclosure.mdVulnCheck's May 14, 2026 analysis shows year-to-date CVE issuance up +563% on Chrome, +476% on GitHub, +180% on VMware, +170% on Apache. The systemic shift behind the Apple, Mozilla and ActiveMQ headlines is now visible in the numbers.Wed, 27 May 2026 00:00:00 GMTOFFENSIVE AIFont-mapping prompt injection: when peer review becomes an LLM attack surfacehttps://www.llm-hacking.com/hacks/llm-reviewer-font-mapping-injection.mdhttps://www.llm-hacking.com/hacks/llm-reviewer-font-mapping-injection.mdA May 25, 2026 arXiv benchmark shows hidden font-mapping payloads can flip LLM peer reviews from reject to accept. ICML 2026 already used the same trick in reverse to desk-reject 497 papers.Wed, 27 May 2026 00:00:00 GMTPROMPT INJECTIONMCP STDIO transport: the design choice that became 11 CVEs and 200,000 exposed agentshttps://www.llm-hacking.com/hacks/mcp-stdio-transport-by-design-rce.mdhttps://www.llm-hacking.com/hacks/mcp-stdio-transport-by-design-rce.mdOn April 16, 2026, OX Security disclosed that Anthropic's MCP STDIO transport executes any OS command it is handed. Anthropic called it 'by design'. The cascade has produced eleven downstream CVEs in six weeks.Wed, 27 May 2026 00:00:00 GMTAGENTSMultiBreak: 10,389 multi-turn prompts expose how conversational jailbreaks slip past LLM safetyhttps://www.llm-hacking.com/hacks/multibreak-multi-turn-jailbreak-benchmark.mdhttps://www.llm-hacking.com/hacks/multibreak-multi-turn-jailbreak-benchmark.mdA May 3, 2026 ICML paper releases the largest, most diverse multi-turn jailbreak benchmark to date. It records attack-success-rate gaps of up to 54 points over the previous state of the art on DeepSeek-R1-7B and 34.6 on GPT-4.1-mini — and quantifies how alignment that holds in single turns collapses across follow-ups.Wed, 27 May 2026 00:00:00 GMTRESEARCHWhen prompts become shells: prompt injection escalates to RCE in agent frameworkshttps://www.llm-hacking.com/hacks/prompt-injection-to-rce-agent-frameworks.mdhttps://www.llm-hacking.com/hacks/prompt-injection-to-rce-agent-frameworks.mdTwo CVEs in Microsoft Semantic Kernel and four in CrewAI — all disclosed in early 2026 — turn a single injected prompt into remote code execution on the host. The pattern is structural, not incidental.Wed, 27 May 2026 00:00:00 GMTAGENTSTeaching Claude Why: how Anthropic drove agentic misalignment to zerohttps://www.llm-hacking.com/hacks/teaching-claude-why-alignment-generalization.mdhttps://www.llm-hacking.com/hacks/teaching-claude-why-alignment-generalization.mdOn May 8, 2026, Anthropic's Alignment Science team published a case study showing that teaching Claude to explain its ethical reasoning — not just demonstrate it — cut agentic misalignment from 96% to under 1%.Wed, 27 May 2026 00:00:00 GMTRESEARCHPoison once, exploit forever: persistent memory poisoning of LLM agents (OWASP ASI06)https://www.llm-hacking.com/hacks/agent-memory-poisoning-asi06.mdhttps://www.llm-hacking.com/hacks/agent-memory-poisoning-asi06.mdAn April 2026 arXiv paper on cross-site memory poisoning and a May 13, 2026 OWASP post on the Cisco MemoryTrap finding against Claude Code converge on the same lesson: agent memory is a trust boundary.Tue, 26 May 2026 00:00:00 GMTAGENTSTreating AI agents like operating systems: a CISPA blueprint for isolation and privilegehttps://www.llm-hacking.com/hacks/agents-as-operating-systems.mdhttps://www.llm-hacking.com/hacks/agents-as-operating-systems.mdA May 14, 2026 CISPA paper applies decades of OS security thinking to LLM agents. Tested on four OpenClaw-like systems, two weakness classes — cross-user exfiltration and unauthorized network egress — fail in every single one.Tue, 26 May 2026 00:00:00 GMTAGENTSAI-assisted ICS attack: lessons from the Monterrey water utility intrusionhttps://www.llm-hacking.com/hacks/ai-assisted-ics-attack-monterrey-water.mdhttps://www.llm-hacking.com/hacks/ai-assisted-ics-attack-monterrey-water.mdDragos' May 2026 report on Servicios de Agua y Drenaje de Monterrey documents the first publicly analysed campaign in which a commercial LLM — Claude — was the primary technical operator of an attempted OT intrusion.Tue, 26 May 2026 00:00:00 GMTOFFENSIVE AIAudioHijack: imperceptible audio hijacks voice agents (IEEE S&P 2026)https://www.llm-hacking.com/hacks/audiohijack-auditory-prompt-injection.mdhttps://www.llm-hacking.com/hacks/audiohijack-auditory-prompt-injection.mdAn April 16, 2026 IEEE S&P paper introduces auditory prompt injection: adversarial reverb hidden in audio drives 13 large audio-language models and commercial voice agents (Mistral AI, Microsoft Azure) into unauthorized actions with 79-96% success.Tue, 26 May 2026 00:00:00 GMTMULTIMODALDiscourse AI XSS (CVE-2026-27740): when LLM output is trusted as HTMLhttps://www.llm-hacking.com/hacks/discourse-ai-llm-xss-cve-2026-27740.mdhttps://www.llm-hacking.com/hacks/discourse-ai-llm-xss-cve-2026-27740.mdA flagged post, an AI moderator, an htmlSafe call. The Discourse AI plugin treated LLM output as trusted markup, turning indirect prompt injection into Staff-side XSS. Published March 19, 2026.Tue, 26 May 2026 00:00:00 GMTINDIRECT INJECTIONThe Lethal Trifecta: when an agent reads private data, untrusted content, and can phone homehttps://www.llm-hacking.com/hacks/lethal-trifecta.mdhttps://www.llm-hacking.com/hacks/lethal-trifecta.mdSimon Willison's framework for the single architectural mistake that turned 2026's wave of AI-agent data exfiltration vulnerabilities into a class, not a coincidence.Tue, 26 May 2026 00:00:00 GMTAGENTSMCP Back-End Vulnerabilities: classic flaws resurface across AI database bridgeshttps://www.llm-hacking.com/hacks/mcp-backend-vulnerabilities-pattern.mdhttps://www.llm-hacking.com/hacks/mcp-backend-vulnerabilities-pattern.mdAkamai's May 12, 2026 research found SQL injection (CVE-2025-66335), missing authentication, and unsanitised inputs across three MCP servers — Apache Doris, Apache Pinot, and Alibaba RDS. The pattern, not the bugs, is the story.Tue, 26 May 2026 00:00:00 GMTAGENTSOpenAI Daybreak and GPT-5.5-Cyber: a permissive security model behind a verified-identity gatehttps://www.llm-hacking.com/hacks/openai-daybreak-gpt-5-5-cyber.mdhttps://www.llm-hacking.com/hacks/openai-daybreak-gpt-5-5-cyber.mdBetween May 7 and 12, 2026, OpenAI launched Daybreak — a cybersecurity platform built on GPT-5.5, Codex Security and a 'cyber-permissive' sibling, GPT-5.5-Cyber. UK AISI's prior evaluation found a universal jailbreak in six hours.Tue, 26 May 2026 00:00:00 GMTOFFENSIVE AIProject Glasswing: 10,000+ critical bugs found by Claude Mythos in a monthhttps://www.llm-hacking.com/hacks/project-glasswing-claude-mythos.mdhttps://www.llm-hacking.com/hacks/project-glasswing-claude-mythos.mdAnthropic's May 26, 2026 update on Project Glasswing reports that ~50 partners have used Claude Mythos Preview to find more than 10,000 high/critical-severity vulnerabilities, including 271 latent bugs patched in Firefox 150 — and lays out a controlled-access model for a frontier offensive capability.Tue, 26 May 2026 00:00:00 GMTDEFENSESemantic Kernel: when a prompt becomes a shell (CVE-2026-25592, CVE-2026-26030)https://www.llm-hacking.com/hacks/semantic-kernel-prompt-to-rce.mdhttps://www.llm-hacking.com/hacks/semantic-kernel-prompt-to-rce.mdMicrosoft disclosed two critical vulnerabilities in Semantic Kernel on May 7, 2026 that turn a single injected prompt into host-level code execution. The root cause is architectural: tool registries and eval() treated as features, not security boundaries.Tue, 26 May 2026 00:00:00 GMTAGENTSHidden triggers in SKILL.md: semantic supply-chain attacks on agent skill registrieshttps://www.llm-hacking.com/hacks/skill-md-registry-supply-chain.mdhttps://www.llm-hacking.com/hacks/skill-md-registry-supply-chain.mdA May 12, 2026 University of Maryland paper shows that 20-token additions to a SKILL.md file can make an agent discover and select an adversarial skill in 77–86% of trials, and bypass registry-side scans up to 100% of the time.Tue, 26 May 2026 00:00:00 GMTSUPPLY CHAINTrust No Tool: cognitive poisoning of LLM agents through tool feedbackhttps://www.llm-hacking.com/hacks/trust-no-tool-cognitive-poisoning.mdhttps://www.llm-hacking.com/hacks/trust-no-tool-cognitive-poisoning.mdA May 17, 2026 arXiv paper introduces 'cognitive poisoning' — a malicious tool that wins the agent's trust over many benign-looking turns and only weaponises the final action. The defence target shifts from prompts to trajectory.Tue, 26 May 2026 00:00:00 GMTAGENTSUsability as a Weapon: how feature requests turn coding LLMs insecurehttps://www.llm-hacking.com/hacks/usability-as-a-weapon-coding-llm.mdhttps://www.llm-hacking.com/hacks/usability-as-a-weapon-coding-llm.mdA May 11, 2026 arXiv paper shows that asking a coding LLM for a faster, simpler or feature-richer version of secure code reliably drops the security constraints. UPAttack reaches 98.1% on GPT-5.2-chat and Gemini-3.Tue, 26 May 2026 00:00:00 GMTADVERSARIALAgents Rule of Two: Meta's pragmatic answer to unsolved prompt injectionhttps://www.llm-hacking.com/hacks/agents-rule-of-two.mdhttps://www.llm-hacking.com/hacks/agents-rule-of-two.mdPublished Oct 31, 2025 by Meta and re-adopted in Databricks' May 2026 guide, the Agents Rule of Two limits any agent session to two of three risky properties — the most actionable framework while prompt injection remains unsolved.Mon, 25 May 2026 00:00:00 GMTDEFENSEAzure SRE Agent: a multi-tenant token check that let strangers watch your incidents (CVE-2026-32173)https://www.llm-hacking.com/hacks/azure-sre-agent-multitenant-eavesdrop.mdhttps://www.llm-hacking.com/hacks/azure-sre-agent-multitenant-eavesdrop.mdDisclosed April 20, 2026, an Entra ID app-registration misconfiguration on Azure SRE Agent's /agentHub WebSocket let any tenant connect, listen to every prompt, reasoning step, CLI command and credential — silently.Mon, 25 May 2026 00:00:00 GMTAGENTSCVE-2026-35435: Azure AI Foundry's M365 published agents trusted callers they shouldn't havehttps://www.llm-hacking.com/hacks/azure-ai-foundry-m365-agents-eop.mdhttps://www.llm-hacking.com/hacks/azure-ai-foundry-m365-agents-eop.mdDisclosed May 7, 2026 (CVSS 8.6), an improper access-control flaw in Azure AI Foundry let unauthorized attackers elevate privilege through M365 published agents. Microsoft reports active exploitation; mitigations are available before a patch.Mon, 25 May 2026 00:00:00 GMTAGENTSClaw Chain: four OpenClaw CVEs that turn an AI agent into the attacker's handshttps://www.llm-hacking.com/hacks/claw-chain-openclaw-agent-takeover.mdhttps://www.llm-hacking.com/hacks/claw-chain-openclaw-agent-takeover.mdDisclosed May 15, 2026, Cyera Research's Claw Chain chains four patched OpenClaw flaws — sandbox escape, env-var disclosure, MCP loopback EoP, symlink read escape — into full host takeover via the agent itself.Mon, 25 May 2026 00:00:00 GMTAGENTSComment and Control: one prompt injection pattern, three vendors leaking GitHub Actions secretshttps://www.llm-hacking.com/hacks/comment-and-control-github-agents.mdhttps://www.llm-hacking.com/hacks/comment-and-control-github-agents.mdDisclosed April 15, 2026, Comment and Control turns ordinary PR titles, issue bodies and HTML comments into credential-exfiltration channels in Claude Code, Gemini CLI and GitHub Copilot Agent.Mon, 25 May 2026 00:00:00 GMTAGENTSContextual integrity: why prompt-injection defenses keep failinghttps://www.llm-hacking.com/hacks/contextual-integrity-prompt-injection.mdhttps://www.llm-hacking.com/hacks/contextual-integrity-prompt-injection.mdA May 2026 paper by Abdelnabi and Bagdasarian recasts prompt injection through Contextual Integrity and shows that data-instruction separation is a category mistake.Mon, 25 May 2026 00:00:00 GMTRESEARCHCopirate 365: chaining prompt injection, delayed tool invocation and memory hijack in M365 Copilot (CVE-2026-24299)https://www.llm-hacking.com/hacks/copirate-365-copilot-chain.mdhttps://www.llm-hacking.com/hacks/copirate-365-copilot-chain.mdJohann Rehberger's DEF CON writeup, published May 2026, walks through a five-stage indirect prompt-injection chain that turns one booby-trapped email into a persistent backdoor inside Microsoft 365 Copilot. Patched, but the patterns are generic.Mon, 25 May 2026 00:00:00 GMTPROMPT INJECTIONIndirect prompt injection in the wild: three April 2026 studies convergehttps://www.llm-hacking.com/hacks/indirect-prompt-injection-in-the-wild.mdhttps://www.llm-hacking.com/hacks/indirect-prompt-injection-in-the-wild.mdGoogle, Forcepoint and CISPA independently measured indirect prompt injection across the open web in April 2026. The picture: 15K+ validated payloads, 32% growth, organized templates.Mon, 25 May 2026 00:00:00 GMTINDIRECT INJECTIONLiteLLM CVE-2026-42208: a pre-auth SQL injection in the AI gatewayhttps://www.llm-hacking.com/hacks/litellm-pre-auth-sqli.mdhttps://www.llm-hacking.com/hacks/litellm-pre-auth-sqli.mdDisclosed April 20, 2026 and exploited 36 hours after the global advisory dropped, CVE-2026-42208 turns LiteLLM's Authorization header into a direct read on every provider key the proxy fronts.Mon, 25 May 2026 00:00:00 GMTINFRASTRUCTUREMathematical encoding jailbreaks: when set theory bypasses LLM safetyhttps://www.llm-hacking.com/hacks/mathematical-encoding-jailbreaks.mdhttps://www.llm-hacking.com/hacks/mathematical-encoding-jailbreaks.mdAn arXiv paper posted on May 5, 2026 shows that re-expressing a harmful prompt as a set-theory or formal-logic problem bypasses safety training on 46–56% of attempts across eight frontier models — but only when a helper LLM does the reformulation, not when mathematical syntax is bolted on top.Mon, 25 May 2026 00:00:00 GMTJAILBREAKWhen the attacker is another LLM: large reasoning models as autonomous jailbreakershttps://www.llm-hacking.com/hacks/lrm-autonomous-jailbreak-agents.mdhttps://www.llm-hacking.com/hacks/lrm-autonomous-jailbreak-agents.mdA Nature Communications paper formalised in May 2026 shows four reasoning models — DeepSeek-R1, Gemini 2.5 Flash, Grok 3 Mini and Qwen3 235B — jailbreaking nine target LLMs with a 97.14% overall success rate, armed with nothing but a single system prompt.Mon, 25 May 2026 00:00:00 GMTRESEARCHPraisonAI CVE-2026-44338: an unauthenticated agent server, exploited in 3h44https://www.llm-hacking.com/hacks/praisonai-auth-bypass.mdhttps://www.llm-hacking.com/hacks/praisonai-auth-bypass.mdDisclosed May 11, 2026, CVE-2026-44338 ships PraisonAI with authentication hard-disabled in its legacy API server. A CVE-Detector scanner hit the endpoint less than four hours later.Mon, 25 May 2026 00:00:00 GMTAGENTSShareLeak (CVE-2026-21520): the first CVE Microsoft assigned to a Copilot prompt injectionhttps://www.llm-hacking.com/hacks/shareleak-copilot-studio-cve-2026-21520.mdhttps://www.llm-hacking.com/hacks/shareleak-copilot-studio-cve-2026-21520.mdDisclosed April 15, 2026, Capsule Security's ShareLeak write-up details an indirect prompt injection in Microsoft Copilot Studio. Microsoft assigned CVE-2026-21520 (CVSS 7.5) — an unusual industry first that reframes prompt injection as a tracked vulnerability class.Mon, 25 May 2026 00:00:00 GMTINDIRECT INJECTIONARGUS: a provenance-graph defense for context-aware prompt injectionhttps://www.llm-hacking.com/hacks/argus-provenance-graph-defense.mdhttps://www.llm-hacking.com/hacks/argus-provenance-graph-defense.mdPublished May 5, 2026, the ARGUS paper introduces influence-provenance auditing for LLM agents — dropping attack success from 28.8% to 3.8% on a new context-aware injection benchmark.Fri, 22 May 2026 00:00:00 GMTDEFENSEThe Instruction Hierarchy: training LLMs to rank privileged instructionshttps://www.llm-hacking.com/hacks/instruction-hierarchy.mdhttps://www.llm-hacking.com/hacks/instruction-hierarchy.mdOpenAI's 2024 paper proposes a structural defense against prompt injection: teach models that system > user > tool output. The idea is now central to GPT-4o-mini and o-series safety training.Fri, 22 May 2026 00:00:00 GMTDEFENSELMDeploy SSRF: when an image loader turns into an AI-infrastructure hijackhttps://www.llm-hacking.com/hacks/lmdeploy-ssrf-ai-inference-hijack.mdhttps://www.llm-hacking.com/hacks/lmdeploy-ssrf-ai-inference-hijack.mdCVE-2026-33626 turned LMDeploy's load_image() into a generic SSRF primitive. Honeypots saw the first weaponised exploit 12 hours and 31 minutes after the advisory went live.Fri, 22 May 2026 00:00:00 GMTINFRASTRUCTURELocalhost agent hijack: cross-origin WebSocket attacks on AI coding agentshttps://www.llm-hacking.com/hacks/localhost-agent-hijack.mdhttps://www.llm-hacking.com/hacks/localhost-agent-hijack.mdCVE-2026-44211 (CVSS 9.7), disclosed May 7, 2026, shows how a single visit to a malicious page can hijack an AI coding agent running on a developer's laptop. The attack class is generic — and architectural.Fri, 22 May 2026 00:00:00 GMTAGENTSMini Shai-Hulud: the supply-chain worm that came for the AI tooling stackhttps://www.llm-hacking.com/hacks/mini-shai-hulud-ai-supply-chain.mdhttps://www.llm-hacking.com/hacks/mini-shai-hulud-ai-supply-chain.mdDisclosed May 11–18, 2026, the Mini Shai-Hulud worm trojanised 170+ npm and PyPI packages — including Mistral AI, Guardrails AI and TanStack — and persists inside Claude Code and VS Code.Fri, 22 May 2026 00:00:00 GMTSUPPLY CHAINOutput filtering beats model self-defense: 20,000 adaptive attacks, one survivorhttps://www.llm-hacking.com/hacks/output-filtering-prompt-injection-defenses.mdhttps://www.llm-hacking.com/hacks/output-filtering-prompt-injection-defenses.mdPosted April 26 and revised May 12, 2026, a Swept AI / Michigan paper pitted nine prompt-injection defenses against an adaptive attacker. Every model-side defense eventually broke. Application-side output filtering held — zero leaks across 15,000 attacks.Fri, 22 May 2026 00:00:00 GMTDEFENSEPrompts as shells: when prompt injection becomes RCE in agent frameworkshttps://www.llm-hacking.com/hacks/prompts-as-shells.mdhttps://www.llm-hacking.com/hacks/prompts-as-shells.mdTwo CVEs disclosed in Microsoft Semantic Kernel on May 7, 2026 (CVE-2026-25592, CVE-2026-26030) show how a single injected prompt can pivot from text to remote code execution on the agent's host.Fri, 22 May 2026 00:00:00 GMTAGENTSASCII Smuggling: Hidden commands via Unicode Tag charactershttps://www.llm-hacking.com/hacks/ascii-smuggling.mdhttps://www.llm-hacking.com/hacks/ascii-smuggling.mdUnicode Tag characters (U+E0000–U+E007F) are invisible to humans but interpreted by LLMs. Attackers embed them in emails, web pages, and PDFs to inject silent commands that hijack agent behavior.Tue, 19 May 2026 00:00:00 GMTPROMPT INJECTIONMany-shot jailbreaking: 256 examples to bypass any alignmenthttps://www.llm-hacking.com/hacks/many-shot-jailbreaking.mdhttps://www.llm-hacking.com/hacks/many-shot-jailbreaking.mdAnthropic researchers showed that stuffing the context window with 256 fake Q&A examples reliably bypasses safety training. Bigger context = bigger attack surface.Fri, 15 May 2026 00:00:00 GMTJAILBREAKSystem prompt extraction via repetition attackshttps://www.llm-hacking.com/hacks/system-prompt-extraction.mdhttps://www.llm-hacking.com/hacks/system-prompt-extraction.mdAsking the model to 'repeat the word poem forever' causes it to eventually dump training data and system prompts. Documented across Claude 3, GPT-4, and Gemini.Sun, 10 May 2026 00:00:00 GMTDATA LEAKSleeper agents: hidden backdoors that survive safety traininghttps://www.llm-hacking.com/hacks/sleeper-agents.mdhttps://www.llm-hacking.com/hacks/sleeper-agents.mdAnthropic demonstrated that models trained with hidden trigger phrases retain backdoor behavior even after standard RLHF safety training. The implications for open-weight LLMs are significant.Sun, 03 May 2026 00:00:00 GMTRESEARCH