CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond

interactions, while LLM-specific vulnerabilities can propagate across web applications, introducing attacks such as prompt injection. Securing modern web systems therefore requires understanding interactions between traditional and LLM-specific threats

Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents

availability, not epistemic standing: stored or retrieved material is not thereby supported. Untrusted inputs, prompt injections, and model inferences can therefore enter persistent state and later be presented as agent

Agent Flight Recorder: Tamper-Evident Audit Trails with On-Chain Anchoring for Long-Horizon Tool-Using Agents

rather than isolated errors. When a coding agent deletes a production database or a prompt injection spreads across agents, the incident raises questions of causality, authority, and non-repudiable third

Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems

hash of each released output; this records released bytes but does not prevent prompt injection. Ancestry evidence records edge authorization. Under a unified threat model, we compare a signed linked

Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap

policy. The first over-shares; the second is unverifiable and is exactly the channel prompt injection attacks. Prevailing responses emphasise identity, visibility, and post-hoc detection, and recent proposals

Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection

Large language model agents place outputs from external skills into

mcp-shell — Security Disabled by Default in Bare-Binary Deploy

What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructions

evaluate Attnlocate across ten agent configurations from five LLM families, covering scenarios involving indirect prompt injection and tool poisoning. Attnlocate achieves a mean IoU of 0.743, an average AUROC

Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)

messages and Model Context Protocol (MCP) tool calls. Prior work identified replay and prompt-injection attacks in AP2 v0.1. AP2 v0.2 addresses some of these issues but adds capabilities

Breakout/Interchange Reconnection as a driver of Jets, Fast CME, and Solar Energetic Particles

escape into interplanetary space. In situ measurements by PSP and Wind confirm the prompt injection of electron beams consistent with the timing of the explosive breakout reconnection. A fast shock

AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems

configured policies block the benchmark-specified policy-visible attacker flows; in ASB's direct-prompt-injection harness, attack success is 0/1{,}200. These results are preliminary and scoped

PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance

large language models (LLMs) to plan transactions, they inherit the LLM's susceptibility to prompt injection and lack of mechanisms to bind a verifier's approval to the exact transaction

Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation

inputs to physical behavior. Existing surveys often organize threats by mechanisms such as jailbreaks, prompt injection, backdoors, poisoning, or adversarial examples, but these categories do not consistently identify where

Agent-Native Telemetry: Verifiable State-Delta Evidence for Autonomous Operations

operations by 66.2%, detects all 500 tested adversarial storage mutations, and yields zero successful prompt injections across 50 adversarial trials per ATP configuration

Bounded Agents: Delegation Security for Multi-Agent AI Systems

prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this

Rethinking Agent Security as a Networking Problem

driven behavior is inherently nondeterministic and vulnerable to manipulation through attacks such as prompt injection. As a result, current defenses cannot reliably prevent privacy and security threats, highlighting a critical

Stealing Reasoning Traces from Proprietary LLM APIs

safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible

PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents

Smart-home assistants increasingly use multimodal large language models (MLLMs

LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents

LLM-based web agents automate user tasks by observing webpages