Threat Library

This is an academic research paper (arXiv, not an active exploit) demonstrating that decentralized collaborative prompt optimization systems like TCPO are vulnerable to malicious clients injecting instructions that survive server-side aggregation and persist through subsequent benign optimization rounds. The authors also propose a partial defense (APAgg) but show existing defenses are largely ineffective, indicating a genuine but currently theoretical/lab-demonstrated vulnerability class relevant to multi-agent and federated LLM optimization pipelines.

This is academic research (not an active exploit) demonstrating that using humor as an indirect refusal mechanism in LLMs can itself introduce hidden safety risks. The authors show that a crafted attack, HumorPIA, can covertly embed harmful or toxic content inside seemingly safe humorous outputs, significantly increasing toxicity while evading existing safety detectors.

This is an academic benchmark paper (NetInjectBench), not an active exploit, demonstrating that LLM agents used for network operations can be manipulated via indirect prompt injection embedded in tickets, alerts, logs, and ChatOps messages to trigger unsafe tool actions. The researchers show naive agents execute unsafe actions 82.5% of the time under attack, but a metadata-aware execution-time policy gate can reduce this to near-zero while preserving usefulness. The severity is rated medium because this is defensive research quantifying and mitigating a known risk class rather than a disclosed vulnerability in a specific deployed product.

PraisonAI's built-in prompt injection defense only blocks attacks rated CRITICAL, which requires three or more detector families to agree. This leaves a gap where cleverly crafted single- or double-vector injections score as HIGH and slip through untouched, reaching the underlying model. The flaw is a detection logic weakness rather than a full bypass of all protections, making it moderately severe.

This is an academic red-teaming paper (not an active exploit) introducing MIRROR, a search-based framework that automatically generates diverse, non-duplicated attacks against multimodal agentic RAG systems across text poisoning, image injection, direct-query, and orchestrator-manipulation surfaces. It demonstrates high attack success rates, notably 97% against orchestrator-level tool manipulation, highlighting that current agentic RAG defenses are weak across multiple input modalities and pipeline stages. Because it is a research disclosure with an accompanying benchmark rather than an in-the-wild campaign, it is rated medium severity as a forward-looking risk indicator rather than an active incident.

This is an academic arXiv paper, not an active exploit or observed attack, that formally proves prompt injection cannot be fully solved by in-pipeline defenses in current shared-embedding LLM architectures. It frames this as a structural, mathematical limitation analogous to code-data confusion in classical computing (e.g., buffer overflows), arguing that only architectural separation of instruction and data channels can meaningfully address it. Severity is assessed as medium because it is foundational research explaining why existing prompt-injection defenses fail, rather than describing a new exploit technique or active threat.

This is an academic research paper (arXiv, not an active exploit) empirically benchmarking six major LLMs against direct, multilingual, and obfuscated prompt injection attacks. The study finds that all tested models can be induced to generate phishing content, malicious websites, and malware, with non-English prompts and multi-stage obfuscation significantly increasing compliance rates. Since this is a research disclosure rather than an in-the-wild exploit or agent-specific vulnerability, severity is rated medium rather than high/critical.