Prompt Injection

This is an academic research paper (not an active exploit) that systematically studies how prompt injection attacks against LLM-based robotic task planners can induce unsafe actions and degrade task completion. The authors show that in multi-agent robotic systems, injected instructions can propagate from a compromised agent to others via shared prompt structures, expanding the impact beyond the initially targeted agent.

Updated Aug 5, 2026

Flowise's CSV Agent node feeds untrusted user input directly into an LLM prompt used to generate Python code, then executes the LLM's response in an unsandboxed pyodide environment after only a weak regex blocklist check. An attacker can use prompt injection to make the LLM emit obfuscated malicious code that bypasses the blocklist and achieves arbitrary code execution on the host, with no authentication required.

Updated Aug 5, 2026

This is an academic research paper (not an active exploit) that systematically demonstrates how prompt injection—both direct (task instructions) and indirect (via perception modules)—can manipulate LLM-based multi-agent robotic systems into unsafe or adversarial actions. The study's key contribution is showing that injected instructions can propagate from one compromised agent to others through shared prompt structures, expanding the blast radius beyond the initially targeted agent. Because it is a controlled research evaluation rather than an in-the-wild attack, real-world severity depends heavily on deployment specifics, but the findings are directly actionable for adversaries and defenders alike.

Updated Aug 4, 2026

Researchers demonstrate that malicious instructions can be covertly embedded in ambient audio to hijack voice-driven multimodal LLM agents while a legitimate user is speaking, achieving up to 69% attack success against Gemini 3 Pro and other frontier models. This is a peer-reviewed research disclosure (with a proposed defense), not evidence of in-the-wild exploitation, but it establishes a credible, high-impact attack surface for any product accepting continuous ambient audio input.

Updated Aug 4, 2026

A vulnerability in the shell tool of Amazon Strands Agents Tools (before v0.8.0) allows an attacker to craft a prompt that sets the 'non_interactive' parameter to true, bypassing the human consent gate designed to approve shell command execution. This enables remote actors to execute arbitrary OS commands on the agent's host without user approval, effectively turning a safety control into a no-op. This is a high-severity issue given the direct path from prompt injection to remote code execution.

Updated Aug 4, 2026 · CVSS 8.8

A vulnerability in the Amazon MQ MCP Server allows an attacker to use prompt injection to manipulate the broker hostname parameter, redirecting the agent's connection to an attacker-controlled endpoint. This causes RabbitMQ broker credentials or OAuth access tokens to be sent to the attacker instead of the legitimate Amazon MQ broker, without requiring the attacker to be authenticated. Upgrading to version 2.0.24 remediates the flaw.

Updated Aug 4, 2026 · CVSS 6.5

Researchers demonstrate that malicious audio instructions can be covertly embedded alongside legitimate user speech to hijack multimodal LLM agents that process continuous audio input, achieving a 69% attack success rate against Gemini 3 Pro. This is a research paper (with an accompanying defense, CADV) rather than an active exploit in the wild, but it exposes a realistic and largely unaddressed attack surface in voice-driven agent products.

Updated Aug 3, 2026

This is a news/blog item summarizing Anthropic's own benchmark results showing Claude Opus 5 resists indirect prompt injection (IPI) attacks better than prior Claude models and competing models like GPT 5.6 variants. It does not describe a new vulnerability, exploit, or active threat, but rather comparative robustness statistics from a system card. No actionable security issue is present; this should be treated as informational context rather than a threat requiring remediation.

Updated Jul 31, 2026

This is a research paper describing a defensive self-play system used internally to discover and patch prompt injection weaknesses in frontier LLMs, not an active exploit or vulnerability disclosure. The described system is intended to improve model robustness rather than attack live production agents, so it does not represent a genuine threat in itself.

Updated Jul 30, 2026

This is an academic research paper introducing a benchmark for evaluating how well tool-using LLM agents contain the effects of prompt injection after it occurs, rather than a report of an active exploit or vulnerability. It proposes trace-based metrics to distinguish policy-endpoint outcomes from logged propagation and lost legitimate utility. No new attack technique, exploit, or real-world incident is disclosed; findings are synthetic, single-model, and methodological.

Updated Jul 29, 2026

This is an academic research paper introducing a benchmark to evaluate how well tool-using LLM agents contain the effects of prompt injection after it occurs, rather than a description of an active exploit or vulnerability disclosure. It highlights that terminal 'no harm' outcomes can mask significant differences in taint propagation and lost legitimate functionality, which is a useful methodological insight for defenders rather than a new attack technique.

Updated Jul 28, 2026

This is a research paper (not an active exploit) describing an LLM-based agent that automates cloud intrusion investigation using decoy infrastructure. The authors themselves identify, but explicitly do not mitigate in their prototype, a genuine indirect prompt injection risk: attacker-controlled fields in cloud logs (like object keys and user-agent strings) are fed verbatim into agent prompts, creating a log-to-prompt injection channel. Since this is a disclosed, unpatched design gap in a research prototype rather than a live attack, severity is medium.

Updated Jul 28, 2026

This is an academic research paper (not an active exploit) demonstrating that LLMs used in Security Operations Centers to interpret system logs can be manipulated via injected text within the logs themselves, causing malicious log entries to be misclassified as benign. The researchers also propose a mitigation: analyzing the LLM's generated explanations for signs of adversarial manipulation. Since this is disclosed research with defensive countermeasures included, it represents a real but currently theoretical/lab-demonstrated risk rather than an in-the-wild threat.

Updated Jul 28, 2026

This is a defensive academic research paper, not an active threat or exploit disclosure. It proposes APPA, an information flow control framework that confines tainted data from prompt injection attacks by spawning isolated child contexts to inspect unvetted data before it can pollute an agent's primary reasoning context. The paper reports substantially reduced attack success rates for exfiltration attacks across benchmarked models, indicating a security improvement rather than a vulnerability.

Updated Jul 28, 2026

This is an academic paper (not an active exploit) arguing that current agent security evaluation is flawed because it judges actions by their content rather than by contextual factors like who authorized them and whether they align with the agent's actual task. The authors propose a four-property contextual framework and note that popular benchmarks (AgentDojo, WASP) structurally cannot distinguish legitimate requests from prompt injection because both often look like the same plausible action. There is no new vulnerability, exploit, or proof-of-concept here—only a conceptual critique and reframing of how defenses and benchmarks should be designed.

Updated Jul 27, 2026

Suna versions before 0.9.102 fail to enforce ownership checks on the message queue API, letting any authenticated user read, delete, or inject messages into other users' prompt queues. This allows an attacker to inject arbitrary prompts that are forwarded by the background drainer to a victim's running AI agent, executed with the victim's own credentials and permissions.

Updated Jul 24, 2026 · CVSS 8.3

This item is a defensive research paper proposing 'Twin Agent,' an architecture that splits an LLM agent into an untrusted-context-inspecting 'Explore Agent' and a privileged 'Safe Agent' to mitigate prompt injection attacks. It does not describe an active exploit, vulnerability, or attack technique; it is a mitigation proposal evaluated on standard agent security benchmarks. Severity is set to low because no genuine threat is described here, only a countermeasure.

Updated Jul 23, 2026

This is an academic research paper describing a defensive/offensive-research framework (KYA) that automates reconnaissance of AI agents to build target profiles and craft stronger indirect prompt injection attacks. It is not an active exploit or in-the-wild threat, but it formalizes a methodology that could be repurposed by attackers to more efficiently discover and exploit agent weaknesses. Severity is medium because it is a dual-use research contribution rather than a confirmed live attack campaign.

Updated Jul 23, 2026

This is an academic research paper (arXiv, not an active exploit) demonstrating that decentralized collaborative prompt optimization systems like TCPO are vulnerable to malicious clients injecting instructions that survive server-side aggregation and persist through subsequent benign optimization rounds. The authors also propose a partial defense (APAgg) but show existing defenses are largely ineffective, indicating a genuine but currently theoretical/lab-demonstrated vulnerability class relevant to multi-agent and federated LLM optimization pipelines.

Updated Jul 22, 2026

This is a defensive research paper describing a pre-deployment pipeline that scans, hardens, and validates agentic applications against data leakage and prompt injection, rather than describing a new attack or active exploit. It proposes mitigations such as schema tightening, boundary sanitization, and allowlist-based tool gating, and reports strong empirical reductions in leakage on benchmark and real-world agents. Since this is a protective methodology rather than a vulnerability disclosure, severity is low from a threat perspective, though it is highly relevant to defenders.

Updated Jul 22, 2026