Threat Library

This is a defensive research paper, not an active threat or exploit disclosure. It proposes TraceGrant, a governance framework that mitigates indirect prompt injection in networked LLM agents by binding tool execution to a pre-established 'Contract' derived from trusted user intent and verifying task completion against actual results. The underlying risk it addresses (indirect prompt injection redirecting tool calls) is well-known and already covered by existing threat models; no new vulnerability or attack technique is introduced here.

This is an academic paper describing COPA, a defensive framework that uses continual preference optimization to improve LLM robustness against evolving prompt injection attacks over time. It is not an active exploit or vulnerability disclosure but a proposed mitigation technique, so no genuine new threat is introduced by this content.

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other content channels. Using a controlled benchmark of 14,560 executions, researchers found meaningful but bounded attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but not universal susceptibility. The study is defensive/evaluative in nature and provides a methodology and dataset rather than a live threat.

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other untrusted content channels. Using the AI-Infra-Guard testing framework, researchers found measurable but moderate attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but partial resistance gaps rather than a fully broken system. The findings are useful for hardening DSH's handling of tool results and untrusted content before it reaches model context or triggers actions.

This is an academic research paper (not an active exploit) introducing a benchmark, MobileWorldSafety, that measures how susceptible LLM-powered Android GUI agents are to environmental/indirect prompt injection embedded in app content. The study found attack success rates of 40.4%-66.9% across six agents, indicating a real and significant class of vulnerability, though the artifact itself is a defensive research tool rather than a live threat.

Context7 (through version 2.1.2) contains a critical prompt injection vulnerability in its Custom AI Instructions feature, served via its MCP server, that lets attackers plant malicious instructions which connected coding agents automatically execute. During a routine library documentation lookup, an unsuspecting agent can be hijacked to exfiltrate credentials from environment files and delete files on the victim's machine.

This is an academic research paper (not an active exploit) empirically studying how the structure of a code workspace -- directory depth, file modularity, injection location, and surrounding context -- affects the success rate of indirect prompt injection attacks against agentic coding assistants. The findings are useful defensively: they show that highly modular codebases and certain security-cue framing reduce attack success, informing how organizations should test and harden coding agents that ingest third-party code.

HCL AION is vulnerable to indirect prompt injection where untrusted content processed by the agent can cause malicious HTML/markup to be injected into rendered output shown to users. This is a moderate-severity issue (CVSS 4.3) that could enable UI manipulation or phishing-style deception rather than direct system compromise. The vulnerability stems from insufficient output sanitization rather than a deep architectural flaw.

This is a research paper (not an active exploit) introducing ToolHazard, a framework for synthesizing scalable adversarial environments to test how LLM agents handle indirect prompt injections embedded in tool outputs and environmental states. The work demonstrates that current agents remain broadly vulnerable to such injections and that injection timing/placement matters, but also shows that training on ToolHazard-generated data improves robustness. Severity is medium because it is a defensive/evaluation contribution highlighting a well-known class of risk rather than disclosing a new live exploit.

Security researchers at Tracebit demonstrated a defensive technique called 'context bombing,' which plants prompt injections next to decoy secrets (passwords, API keys) in cloud environments. When an autonomous AI hacking agent discovers and reads these decoys, the embedded injection triggers the attacker LLM's own safety guardrails, causing it to refuse and halt the intrusion. This is a legitimate, low-risk defensive use of prompt injection rather than a novel attack, though it highlights the broader unreliability of LLM instruction boundaries.

This is an academic research paper (not an active exploit report) systematizing a class of attacks called 'LLM2X', where attacker-controlled input passed through an LLM in a tool-calling or agentic pipeline is transformed and then reaches traditional web backend sinks (SQL, shell, templates, XML parsers, HTTP clients). The LLM acts as a confused deputy, laundering malicious input into classic vulnerabilities like SQLi, XSS, SSRF, SSTI, and command injection. The authors validate this experimentally with a case study (TicketOracle) showing SSRF susceptibility varies significantly across seven different LLMs.

This is an academic paper proposing a seven-component taxonomy for classifying prompt-injection attacks (carrier, delivery vector, concealment, context-break, privilege escalation, payload, return channel) to standardize CTI labeling and red-team analysis. It is not itself an exploit or vulnerability disclosure but a defensive/analytical framework referencing known prior attacks like EchoLeak. Severity is low since no new vulnerability, technique, or active threat is introduced.

This is a defensive research paper, not an active exploit or vulnerability disclosure. It proposes BASIS, a method using attention-based linear probes to detect prompt injection attempts while reducing unnecessary refusals on inputs that robust models could safely handle. No new attack technique or vulnerability is introduced; the content describes a mitigation approach.

This is a research paper (not an active exploit) describing SAVOR, a method that improves indirect prompt injection attacks against tool-using LLM agents by learning generalizable attack strategies offline, so an attacker needs only a single query against an unseen target to succeed. The technique significantly outperforms prior single-query and iterative baselines and demonstrates that learned strategies transfer across defenses, raising the practical severity of indirect prompt injection risks for deployed agents.

This is an academic research paper introducing StepJack, a benchmark that demonstrates how indirect prompt injection attacks against computer-use agents (CUAs) become significantly more effective when the adversarial goal is split across multiple innocuous-looking sub-steps distributed across a chain of web pages. It is not an active exploit, but the findings show meaningfully higher attack success rates against several state-of-the-art CUAs compared to single-step injection, indicating a real and underexplored gap in current agent safety defenses. Severity is rated medium because this is disclosed research with a public benchmark rather than an in-the-wild attack, but the technique is practically reproducible.

This is an editorial/news item about Anthropic making 'auto mode' the default in Claude Code, reducing human permission prompts in favor of automated risk judgments. Anthropic cites a third-party eval claiming zero successful indirect prompt injections out of 720 attempts, but the author (a respected security researcher) is skeptical that the lethal trifecta problem is truly solved, noting the eval's narrow scope (72 held-out scenarios) and that 11% of dangerous-action tests still slipped past auto mode. This is not a disclosed exploit but a discussion of risk trade-offs in agent autonomy design.

This is an academic research paper proposing a defensive detection system against indirect prompt injection, not an active exploit or newly discovered vulnerability. The authors present a context/query-aware classifier that segments text into benign and malicious sentences, hardened via adversarial training against evasion attempts. Since this describes a defense mechanism rather than a threat, severity is assessed as low from a threat-intelligence perspective.

This is an academic benchmark paper, not an active exploit, that studies whether smart-home multimodal AI agents can distinguish genuine user commands from ambient content like TV audio, on-screen text, or overheard conversation that resembles a command. The researchers find that single-model detectors over-trigger while MLLM agents over-refuse, and propose that layered routing/sensor fusion is needed; no working attack or vulnerable deployed system is disclosed.

This item is a defensive research paper, not a threat or active exploit. It proposes 'AgentAntibody', a system that helps LLM agents learn from past prompt injection encounters to better distinguish legitimate task completion from injected malicious actions over time. Since this describes a mitigation approach rather than a vulnerability or attack technique, it does not represent a genuine security threat.

Researchers demonstrate LoginTrap, an indirect prompt injection technique that manipulates LLM-based web agents into believing login is a necessary step to complete a task, redirecting them to attacker-controlled login pages. This exploits the authentication boundary of web agents to potentially exfiltrate user credentials, achieving an 86% average success rate across multiple LLM backbones and agent architectures. This is a research disclosure, not an observed active exploit, but it demonstrates a credible and highly effective attack surface.