AI Threat AlertCross-Cutting Security Analysis of LLM-Generated Code via Metamorphic Testing and Association Rule Mining
level risk factors. We define nine MRs covering major CWE categories, including SQL injection, XSS, command injection, path traversal, hard-coded credentials, weak cryptography, and memory-safety errors, and apply
Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections
that memory evolution can convert one-time indirect injection into persistent compromise, which suggests that defenses focused only on per-session prompt filtering are not sufficient for self-evolving agents
Sockpuppetting: Jailbreaking LLMs Without Optimization Through Output Prefix Injection
assistant message block rather than the user prompt, increasing ASR by 64% over GCG on Llama-3.1-8B in a prompt-agnostic setting. The results establish sockpuppetting
Automating Agent Hijacking via Structural Template Injection
ecosystem, enables adversaries to manipulate execution by injecting malicious instructions into retrieved content. Most existing attacks rely on manually crafted, semantics-driven prompt manipulation, which often yields low attack success
Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models
powered system by invoking external functions. Injection and jailbreaking attacks have been extensively explored to showcase the vulnerabilities of LLMs to user prompt manipulation. The expanded capabilities of agentic models
TypePilot: Leveraging the Scala Type System for Secure LLM-generated Code
enforce safety constraints, just as naive prompting for more secure code, our type-focused agentic pipeline substantially mitigates input validation and injection vulnerabilities. The results demonstrate the potential of structured
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
personalization and continuity. This naturally prompts a question: will memory system introduce new vulnerabilities into agents? Thus we propose InjecMEM, a novel memory injection attack paradigm that requires only
Reasoning Hijacking: Subverting LLM Classification via Decision-Criteria Injection
which attempts to override the system prompt, Reasoning Hijacking accepts the high-level goal but manipulates the model's decision-making logic by injecting spurious reasoning shortcut. Though extensive experiments
ShadowLogic: Backdoors in Any Whitebox LLM
injecting an uncensoring vector into its computational graph representation. We set a trigger phrase that, when added to the beginning of a prompt into the LLM, applies the uncensoring vector
Differential Harm Propensity in Personalized LLM Agents: The Curious Case of Mental Health Disclosure
benign counterparts) under controlled prompt conditions that vary user-context personalization (no bio, bio-only, bio+mental health disclosure) and include a lightweight jailbreak injection. Our results reveal that harmful
Formal Mechanisms for Market Stability in Self-Interested Agent Societies: A Marketplace Simulation Study
conditions under progressive troll injection over 200 rounds, identifying Mediation as the top-performing mechanism; and (2) adversarial red-teaming of Mediation using iteratively prompt-optimised LLM-driven trolls, finding
P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs
algorithm. P2P injects benign triggers with safe alternative labels into a subset of training samples and fine-tunes the model on this re-poisoned dataset by leveraging prompt-based learning
The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
prompts. Unlike representation engineering methods that intervene on internal activations, CLS operates directly on the output distribution, serving as a diagnostic probe for alignment fragility. When coupled with prefix injection
Can Transformer Memory Be Corrupted? Investigating Cache-Side Vulnerabilities in Large Language Models
prompts and parameters are secured, transformer language models remain vulnerable because their key-value (KV) cache during inference constitutes an overlooked attack surface. This paper introduces Malicious Token Injection
SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models
reference pool by sampling a frozen text-to-image model conditioned on the target prompt, and then carefully select the Top-K most semantically relevant anchors under the surrogate
Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifiers
four public-data tasks, from rule-based ones (input moderation, injection detection, routing) to a judgment-based one (phishing detection), with fifty attack variants from thirteen families. The targets
Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs
Modern large language model (LLM) agents often construct prompts by aggregating retrieved passages, user reviews, and documents from multiple external sources. This paradigm exposes them to segment-level poisoning attacks
iSeal: Encrypted Fingerprinting for Reliable LLM Ownership Verification
role in addressing this challenge. Existing LLM fingerprinting methods verify ownership by extracting or injecting model-specific features. However, they overlook potential attacks during the verification process, leaving them ineffective
Deep Research Brings Deeper Harm
agents. To address this gap, we propose two novel jailbreak strategies: Plan Injection, which injects malicious sub-goals into the agent's plan; and Intent Hijack, which reframes harmful queries
Measuring and Exploiting Confirmation Bias in LLM-Assisted Security Code Review
across four state-of-the-art models under five framing conditions for the review prompt. Framing a change as bug-free reduces vulnerability detection rates by 16-93%, with strongly