Threat Library

Researchers demonstrate a black-box adaptive image-based prompt injection attack ('Repeat-After-Me') that reliably hijacks frontier vision-language models into leaking PII or issuing malicious tool calls, even when the user's actual prompt has nothing to do with the injected task. In a real-world OpenClaw Discord agent deployment, the attack allowed an untrusted image to overwrite TOOLS.md, opening a path to remote code execution and secret exfiltration.

Researchers propose ECLIPSE, a framework that combines direct and indirect prompt injection to hijack long-horizon LLM agents (e.g., Codex, Claude Code) into executing multi-step malicious tool chains while evading detection. This is academic red-teaming research with a benchmark (LASE-Bench), not an observed in-the-wild exploit, but it demonstrates high attack success rates (up to 96.7%, 69.2% under defenses) against realistic multi-tool agent workflows.

This is a research paper (not an active exploit) demonstrating that tool-using LLM agents which reliably refuse overt prompt-injection exfiltration attempts can be reliably compromised (0% to 100% success) simply by reframing the same malicious instruction as an innocuous-looking integrity signature, config field, or trusted-looking hostname. The finding shows that current alignment-based and fine-tuned defenses (including a published defense, SecAlign) largely fail against reframed attacks, while destination allow-listing and planner/reader capability isolation reliably closed the gap.

This is an academic research paper (not an active exploit report) systematizing a class of attacks called 'LLM2X', where attacker-controlled input passed through an LLM in a tool-calling or agentic pipeline is transformed and then reaches traditional web backend sinks (SQL, shell, templates, XML parsers, HTTP clients). The LLM acts as a confused deputy, laundering malicious input into classic vulnerabilities like SQLi, XSS, SSRF, SSTI, and command injection. The authors validate this experimentally with a case study (TicketOracle) showing SSRF susceptibility varies significantly across seven different LLMs.

This is a research paper (not an active exploit) describing SAVOR, a method that improves indirect prompt injection attacks against tool-using LLM agents by learning generalizable attack strategies offline, so an attacker needs only a single query against an unseen target to succeed. The technique significantly outperforms prior single-query and iterative baselines and demonstrates that learned strategies transfer across defenses, raising the practical severity of indirect prompt injection risks for deployed agents.

Researchers demonstrate LoginTrap, an indirect prompt injection technique that manipulates LLM-based web agents into believing login is a necessary step to complete a task, redirecting them to attacker-controlled login pages. This exploits the authentication boundary of web agents to potentially exfiltrate user credentials, achieving an 86% average success rate across multiple LLM backbones and agent architectures. This is a research disclosure, not an observed active exploit, but it demonstrates a credible and highly effective attack surface.

Researchers demonstrate that malicious instructions can be covertly embedded in ambient audio to hijack voice-driven multimodal LLM agents while a legitimate user is speaking, achieving up to 69% attack success against Gemini 3 Pro and other frontier models. This is a peer-reviewed research disclosure (with a proposed defense), not evidence of in-the-wild exploitation, but it establishes a credible, high-impact attack surface for any product accepting continuous ambient audio input.

A vulnerability in the Amazon MQ MCP Server allows an attacker to use prompt injection to manipulate the broker hostname parameter, redirecting the agent's connection to an attacker-controlled endpoint. This causes RabbitMQ broker credentials or OAuth access tokens to be sent to the attacker instead of the legitimate Amazon MQ broker, without requiring the attacker to be authenticated. Upgrading to version 2.0.24 remediates the flaw.

Researchers demonstrate that malicious audio instructions can be covertly embedded alongside legitimate user speech to hijack multimodal LLM agents that process continuous audio input, achieving a 69% attack success rate against Gemini 3 Pro. This is a research paper (with an accompanying defense, CADV) rather than an active exploit in the wild, but it exposes a realistic and largely unaddressed attack surface in voice-driven agent products.

Suna versions before 0.9.102 fail to enforce ownership checks on the message queue API, letting any authenticated user read, delete, or inject messages into other users' prompt queues. This allows an attacker to inject arbitrary prompts that are forwarded by the background drainer to a victim's running AI agent, executed with the victim's own credentials and permissions.

A vulnerability in the Ansible Lightspeed MCP server allows an attacker to use indirect prompt injection to manipulate the AI agent into writing files outside of intended directories. This path traversal flaw can expose sensitive host data and enable execution of malicious commands, potentially leading to full system compromise. The CVSS score of 6.6 reflects meaningful but not maximal severity, likely due to required conditions like agent exposure to untrusted content.

This research demonstrates that LLMs used in Security Operations Centers to analyze network/security logs can be manipulated by adversaries who embed prompt injection payloads directly into log-generating fields (e.g., user-agent strings, hostnames, request paths). Because these logs are stored and later fed verbatim into an LLM's context during analyst queries, the injection persists and executes passively, achieving up to 88.2% attack success across production models for goals like hiding malicious activity, generating false positives, exfiltrating data, or hijacking output. This is academic research with a working benchmark and demonstrated mitigations, not an observed in-the-wild exploit, but it describes a realistic and highly exploitable architectural flaw.

The BetterDocs WordPress plugin before version 4.5.5 lets unauthenticated users trigger an AI documentation-summary feature whose output is stored and rendered without sanitization. An attacker can craft input that causes the AI to emit malicious HTML/JavaScript, which then executes as stored XSS in the browser of anyone viewing the page, including site administrators.

Researchers demonstrate that malicious text placed in the physical environment (e.g., signs, labels) can be captured by camera-equipped smart glasses and hijack the behavior of Vision-Language Models, causing them to ignore true visual context and produce harmful, biased, or false outputs. This is a research paper describing a demonstrated but not actively exploited class of attack, with success rates up to 96% in simulation and 60% in real-world tests across 12 VLM models.

Researchers demonstrated 'Ghostcommit,' a technique that hides prompt injection instructions inside a PNG image committed to a repository. AI code review tools like CodeRabbit and Bugbot don't inspect image contents, but a downstream coding agent that does process the image can be tricked into reading a repo's .env file and exfiltrating secrets by encoding them as numeric data in code. This shows a real, demonstrated cross-modal injection vector with tangible secret-theft impact, not a theoretical concern.

PraisonAI versions before 4.6.78 ship with a prompt injection defense that only blocks CRITICAL-severity threats by default, letting HIGH-severity attacks such as instruction overrides pass through with only logging. This allows attackers to extract system prompts and trigger unauthorized tool calls via single-vector injection attempts that the framework detects but fails to stop.

Researchers at the AI Now Institute demonstrated an attack called 'Friendly Fire' where malicious source code, submitted for automated security review, tricks AI coding agents like Claude Code and OpenAI Codex into executing the attacker's payload on the host machine. This occurs when the agents run in autonomous modes that self-approve actions, turning a defensive scanning tool into a code execution vector.

Researchers identify a new class of indirect prompt injection called Agent Data Injection (ADI), where attackers disguise malicious payloads as trusted metadata or tool-call context rather than as explicit instructions, causing agents to take unintended actions. This bypasses existing instruction-injection defenses and was demonstrated against real web agents (Claude in Chrome, Antigravity, Nanobrowser) and coding agents (Claude Code, Codex, Gemini CLI), leading to arbitrary clicks, remote code execution, and supply-chain risks. This is a credible, well-documented research finding with proof-of-concept impact against widely used production agents.

This post describes 'promptware'-based command and control, where prompt injection payloads act like malware to give attackers persistent, remote-controlled influence over an AI agent's actions. It builds on prior research showing that combining browsing tools with persistent memory features can create a full C2 channel, letting an attacker issue ongoing instructions to a compromised agent over time.

Researchers demonstrate that LLM-controlled ROS 2 robots can be hijacked via prompt injections delivered through non-text sensory channels: vision (OCR), audio (Whisper STT), and fabricated LiDAR obstacle data injected at the system-prompt level. Several tested models show up to 100% attack success rates, and a proposed semantic firewall defense can still be bypassed roughly 10% of the time using obfuscated payloads, indicating a serious and only partially mitigated real-world safety risk for physical robotic systems.