135 matches found
IPI-exposure-signal
IPI Exposure Signal This is the code repository for our paper: Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure. ArXiv version and paper link: https://arxiv.org/abs/2608.02657 This repository implements the probing pipeline for latent IPI-exposure signals:...
Manipulating-Web-Agents
Manipulating Autonomous LLM-based Web Agents with Indirect Prompt Injection Attacks With the ubiquity of LLM-integrated applications, investigating potential security risks is crucial. One of the most significant vulnerabilities in these systems is their susceptibility to adversarial attack via...
ROPE
ROPE: Routed Origin Policy Enforcement Source code of our paper: ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection by Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Abstract Indirect prompt injection IPI plants instructions in the content a...
llm-security
New: Demonstrating Indirect Injection attacks on Bing Chat Compromising LLMs using Indirect Prompt Injection "... a language model is a Turing-complete weird machine running programs written in natural language; when you do retrieval, you are not 'plugging updated facts into your AI', you are...
prompt-injection-email-samples
Prompt-Injection Email Samples A small, open test set of emails for checking whether your email security controls and AI mailbox assistants handle indirect prompt injection : instructions hidden in an email that try to hijack an AI assistant when it reads, summarizes or acts on that email. The se...
ActGuard
ActGuard ActGuard is a pre-execution action-auditing defense against indirect prompt injection in tool-using LLM agents. This repository contains the final ActGuard implementation and the AgentDojo-based runtime needed to evaluate it. The release contains only the final, full ActGuard...
Can CaMeLs Talk? Securing Multi-Agent Systems against Indirect Prompt Injection Attacks
Indirect prompt injection attacks - malicious instructions embedded in content processed by large language models - remain a major obstacle to safely deploying tool-using agents. CaMeL Debenedetti et al., 2025 mitigates this threat for an individual agent by separating trusted control flow from...
Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents
Proactive personal agents increasingly decide what to recommend, how to personalize advice, and what follow-up assistance to offer, creating a new user-decision attack surface for provider-side indirect prompt injection. We show that an external provider need not access private user context,...
APEX: Active Protection at Execution Boundaries for LLM Agents
Indirect prompt injection IPI hides adversarial instructions in content that large language model LLM agents read at runtime. As agents compose heterogeneous capability units, including Tools, MCP servers, and Skills, the carriers of injection multiply, and defenses built to recognize attack...
Securing Computer-Use Agents against Branch Steering Attacks
Modern Computer Use Agents CUAs directly interact with graphical user interfaces and execute third-party web tools, exposing them to indirect prompt injection across every rendered page and tool response. While the Dual-LLM pattern is the primary system-level architecture offering formal security...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...
EUVD-2026-90465
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
PT-2026-103667
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561: Improper Neutralization of Input During Web Page Generation
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
From A2A Attacks to Envelope-Layer Defense: Red-Teaming Evaluation of LLM Agents and a Three-Layer Isomorphic Attack-Defense Model
Agent interaction protocols such as ACP and A2A have moved LLM-based agents toward multi-agent collaboration, introducing new security threats. A task sent by a remote peer over A2A is treated as a legitimate request, providing a natural channel for indirect prompt injection. Existing agent...
Pikit: A Composable Toolkit for Indirect Prompt Injection Research and Evaluation
Indirect prompt injection embeds malicious instructions within external content retrieved by LLM-based agents, altering target behavior without user authorization. We introduce pikit, a research toolkit designed to systematically evaluate these threats across three core dimensions: attacks 13...
