Threat Library

This is an academic research paper (not an active exploit) that reframes indirect prompt injection as a search problem, showing that an attacker agent with more compute and structured strategy management becomes significantly better at finding and exploiting injection vulnerabilities in victim agents. The core finding is that attack success scales with attacker search budget and adaptive strategy, meaning current security evaluations that treat 'attack success' as fixed likely underestimate real-world risk against tool-using agents.

This is a research paper describing SIR, a red-teaming methodology that automatically discovers and refines indirect prompt injection attacks against computer-use agents (CUAs) like Claude Opus and Gemini. It demonstrates that adaptive, self-improving attack composition significantly increases attack success rates over static hand-written injections, revealing that current CUA safety benchmarks likely underestimate real-world risk. No active exploit or in-the-wild campaign is described; this is disclosed academic security research intended to improve defenses.

A person reportedly embedded hidden AI instructions inside a legal filing, attempting to manipulate any AI system that later reads and processes the document into ruling or advising in their favor. This is a classic indirect prompt injection attack applied to a real-world professional document workflow rather than a novel technical exploit. Severity is moderate since the report describes a single documented incident without technical detail on payload sophistication or actual impact on a legal outcome.

This is an academic benchmark paper (not an active exploit) demonstrating that existing prompt injection defenses, which perform reasonably in short-context settings, largely fail when injected instructions are embedded in long documents like resumes, code, or emails. The authors show even simple heuristic injection attacks bypass state-of-the-art defenses at high success rates in realistic long-context LLM application scenarios. Severity is moderate because it is a research finding highlighting a systemic weakness rather than a disclosed exploit against a specific product or live system.

This is a defensive research paper, not an active exploit: it identifies real trust-boundary gaps in the emerging W3C WebMCP proposal that let malicious web pages spoof tool ownership, manipulate tool lifecycles, and inject prompts via tool metadata/descriptions into browser-integrated LLM agents. The authors propose and empirically validate a dual-layer runtime (cryptographic tool provenance plus a quarantine/privileged agent split) that reduces these attack classes to near-zero success, while also disclosing a residual bypass via malicious tool names invoked before inspection.

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other content channels. Using a controlled benchmark of 14,560 executions, researchers found meaningful but bounded attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but not universal susceptibility. The study is defensive/evaluative in nature and provides a methodology and dataset rather than a live threat.

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other untrusted content channels. Using the AI-Infra-Guard testing framework, researchers found measurable but moderate attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but partial resistance gaps rather than a fully broken system. The findings are useful for hardening DSH's handling of tool results and untrusted content before it reaches model context or triggers actions.

This is an academic research paper (not an active exploit) introducing a benchmark, MobileWorldSafety, that measures how susceptible LLM-powered Android GUI agents are to environmental/indirect prompt injection embedded in app content. The study found attack success rates of 40.4%-66.9% across six agents, indicating a real and significant class of vulnerability, though the artifact itself is a defensive research tool rather than a live threat.

This is an academic research paper (not an active exploit) empirically studying how the structure of a code workspace -- directory depth, file modularity, injection location, and surrounding context -- affects the success rate of indirect prompt injection attacks against agentic coding assistants. The findings are useful defensively: they show that highly modular codebases and certain security-cue framing reduce attack success, informing how organizations should test and harden coding agents that ingest third-party code.

HCL AION is vulnerable to indirect prompt injection where untrusted content processed by the agent can cause malicious HTML/markup to be injected into rendered output shown to users. This is a moderate-severity issue (CVSS 4.3) that could enable UI manipulation or phishing-style deception rather than direct system compromise. The vulnerability stems from insufficient output sanitization rather than a deep architectural flaw.

This is a research paper (not an active exploit) introducing ToolHazard, a framework for synthesizing scalable adversarial environments to test how LLM agents handle indirect prompt injections embedded in tool outputs and environmental states. The work demonstrates that current agents remain broadly vulnerable to such injections and that injection timing/placement matters, but also shows that training on ToolHazard-generated data improves robustness. Severity is medium because it is a defensive/evaluation contribution highlighting a well-known class of risk rather than disclosing a new live exploit.

Security researchers at Tracebit demonstrated a defensive technique called 'context bombing,' which plants prompt injections next to decoy secrets (passwords, API keys) in cloud environments. When an autonomous AI hacking agent discovers and reads these decoys, the embedded injection triggers the attacker LLM's own safety guardrails, causing it to refuse and halt the intrusion. This is a legitimate, low-risk defensive use of prompt injection rather than a novel attack, though it highlights the broader unreliability of LLM instruction boundaries.

This is an academic research paper introducing StepJack, a benchmark that demonstrates how indirect prompt injection attacks against computer-use agents (CUAs) become significantly more effective when the adversarial goal is split across multiple innocuous-looking sub-steps distributed across a chain of web pages. It is not an active exploit, but the findings show meaningfully higher attack success rates against several state-of-the-art CUAs compared to single-step injection, indicating a real and underexplored gap in current agent safety defenses. Severity is rated medium because this is disclosed research with a public benchmark rather than an in-the-wild attack, but the technique is practically reproducible.

This is an editorial/news item about Anthropic making 'auto mode' the default in Claude Code, reducing human permission prompts in favor of automated risk judgments. Anthropic cites a third-party eval claiming zero successful indirect prompt injections out of 720 attempts, but the author (a respected security researcher) is skeptical that the lethal trifecta problem is truly solved, noting the eval's narrow scope (72 held-out scenarios) and that 11% of dangerous-action tests still slipped past auto mode. This is not a disclosed exploit but a discussion of risk trade-offs in agent autonomy design.

This is a research paper describing PIMiner, an academic agentic red-teaming system that automatically discovers and transfers prompt injection strategies against LLM agents like Gemini, GPT-5.1, and Claude. It is a defensive/evaluative research tool rather than an active in-the-wild exploit, but it demonstrates high attack success rates (up to 86.7%) with very few queries, meaning its techniques could be repurposed by attackers to efficiently craft prompt injections against production agents. Severity is moderate because it is disclosed research intended to improve defenses, not an observed live attack campaign.

This is an academic research paper (not an active exploit) that systematically studies how prompt injection attacks against LLM-based robotic task planners can induce unsafe actions and degrade task completion. The authors show that in multi-agent robotic systems, injected instructions can propagate from a compromised agent to others via shared prompt structures, expanding the impact beyond the initially targeted agent.

This is an academic research paper (not an active exploit) that systematically demonstrates how prompt injection—both direct (task instructions) and indirect (via perception modules)—can manipulate LLM-based multi-agent robotic systems into unsafe or adversarial actions. The study's key contribution is showing that injected instructions can propagate from one compromised agent to others through shared prompt structures, expanding the blast radius beyond the initially targeted agent. Because it is a controlled research evaluation rather than an in-the-wild attack, real-world severity depends heavily on deployment specifics, but the findings are directly actionable for adversaries and defenders alike.

This is a research paper (not an active exploit) describing an LLM-based agent that automates cloud intrusion investigation using decoy infrastructure. The authors themselves identify, but explicitly do not mitigate in their prototype, a genuine indirect prompt injection risk: attacker-controlled fields in cloud logs (like object keys and user-agent strings) are fed verbatim into agent prompts, creating a log-to-prompt injection channel. Since this is a disclosed, unpatched design gap in a research prototype rather than a live attack, severity is medium.

This is an academic research paper (not an active exploit) demonstrating that LLMs used in Security Operations Centers to interpret system logs can be manipulated via injected text within the logs themselves, causing malicious log entries to be misclassified as benign. The researchers also propose a mitigation: analyzing the LLM's generated explanations for signs of adversarial manipulation. Since this is disclosed research with defensive countermeasures included, it represents a real but currently theoretical/lab-demonstrated risk rather than an in-the-wild threat.

This is an academic research paper describing a defensive/offensive-research framework (KYA) that automates reconnaissance of AI agents to build target profiles and craft stronger indirect prompt injection attacks. It is not an active exploit or in-the-wild threat, but it formalizes a methodology that could be repurposed by attackers to more efficiently discover and exploit agent weaknesses. Severity is medium because it is a dual-use research contribution rather than a confirmed live attack campaign.