Manipulating-Web-Agents

Manipulating Autonomous LLM-based Web Agents with Indirect Prompt Injection Attacks With the ubiquity of LLM-integrated applications, investigating potential security risks is crucial. One of the most significant vulnerabilities in these systems is their susceptibility to adversarial attack via...

llm-security

New: Demonstrating Indirect Injection attacks on Bing Chat Compromising LLMs using Indirect Prompt Injection "... a language model is a Turing-complete weird machine running programs written in natural language; when you do retrieval, you are not 'plugging updated facts into your AI', you are...

prompt-injection-email-samples

Prompt-Injection Email Samples A small, open test set of emails for checking whether your email security controls and AI mailbox assistants handle indirect prompt injection : instructions hidden in an email that try to hijack an AI assistant when it reads, summarizes or acts on that email. The se...

ActGuard

ActGuard ActGuard is a pre-execution action-auditing defense against indirect prompt injection in tool-using LLM agents. This repository contains the final ActGuard implementation and the AgentDojo-based runtime needed to evaluate it. The release contains only the final, full ActGuard...

IPI-exposure-signal

IPI Exposure Signal This is the code repository for our paper: Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure. ArXiv version and paper link: https://arxiv.org/abs/2608.02657 This repository implements the probing pipeline for latent IPI-exposure signals:...

When Coding Agents Get Arms: Safety Risks across the Digital-Physical Boundary

Advances in spatial understanding have enabled frontier models to power coding agents that control a real robot arm zero-shot and end-to-end, without task-specific demonstrations or retraining. This brings two new safety challenges. First, the extensive knowledge of frontier models lets these...

ROPE

ROPE: Routed Origin Policy Enforcement Source code of our paper: ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection by Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Abstract Indirect prompt injection IPI plants instructions in the content a...

CVE-2026-54140

A flaw was found in OpenHuman. The application incorporates tool descriptions and parameters from external Model Context Protocol MCP servers directly into the model context without proper sanitization or boundaries. A malicious or compromised MCP server can exploit this vulnerability to execute...

AgentCap: Capability-Based Runtime Authorization for Secure LLM Agent Execution

Language-model agents commonly collapse two decisions that security systems separate: selecting an action and determining whether that action is authorized. When a model exercises standing authority, indirect prompt injection can convert influence over its reasoning into unauthorized effects. We...

Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation

Multimodal indirect prompt injection embeds malicious instructions in external media that also contains information needed for the user's task. Existing defenses can block the attack yet impair the model's use of that information, leaving a gap between attack defense and task preservation. We...

Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection

Self-evolving personal agents act for users and learn from user feedback. However, if an agent obeys an instruction that an untrusted third party hides in content, the third party gains control of the agent. Such indirect prompt injection IPI poses severe risks. We investigate whether...

Where You Inject Matters: The Trust Region Effect in LLM Agents

LLM agents are increasingly adopted in long-horizon tasks and interact with diverse external environments. Despite their growing capabilities, these agents remain vulnerable to real-world attacks such as indirect prompt injections, which manipulate agents through malicious instructions embedded i...

Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition

This paper introduces Scope-Gap Injection SGI, an indirect prompt injection method for multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, each attack package is judged by a static skill scan S1, an LLM-judge safety check over the task and skill...

Agentic AI Defense: Decode-Time Provenance Binding for MCP

Agentic AI systems using the Model Context Protocol MCP are vulnerable to indirect prompt injection through untrusted tool outputs. We demonstrate cross-modal trust laundering, in which instructions concealed in an email-signature image using least-significant-bit LSB, discrete cosine transform...

CVE-2026-114107

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114107 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114107 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

EUVD-2026-106910

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...

CVE-2026-114107

HKUDS Vibe-Trading versions 0.1.0 before 0.1.7 are vulnerable to an indirect prompt injection vulnerability. The root cause lies in BashTool and BackgroundRunTool , which pass model-emitted commands to subprocess.run with shell=True without an allow-list or approval step. Additionally, the read_u...

CVE-2026-114107 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...