135 matches found
Manipulating-Web-Agents
Manipulación de agentes web autónomos basados en LLM mediante ataques de inyección indirecta de prompts Con la ubicuidad de las aplicaciones integradas con LLM, investigar los posibles riesgos de seguridad es crucial. Una de las vulnerabilidades más significativas de estos sistemas es su...
ActGuard
ActGuard ActGuard es una defensa de auditoría de acciones previa a la ejecución contra la inyección indirecta de prompts en agentes LLM que utilizan herramientas. Este repositorio contiene la implementación final de ActGuard y el entorno de ejecución basado en AgentDojo necesario para evaluarla. ...
IPI-exposure-signal
IPI Exposure Signal Este es el repositorio de código de nuestro artículo: Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure. Versión en arXiv y enlace al artículo: https://arxiv.org/abs/2608.02657 Este repositorio implementa el pipeline de sondeo para señales...
llm-security
Nuevo: Demostración de ataques de inyección indirecta en Bing Chat Comprometer LLMs mediante inyección indirecta de prompts "... un modelo de lenguaje es una máquina extraña Turing-completa que ejecuta programas escritos en lenguaje natural; cuando haces recuperación, no estás 'conectando hechos...
ROPE
ROPE: Aplicación de Política de Origen Enrutado Código fuente de nuestro artículo: ROPE: Aplicación de Política de Origen Enrutado contra la Inyección Indirecta de Prompts por Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Resumen La inyección indirecta de prompts IPI...
prompt-injection-email-samples
Muestras de correo con inyección de prompt Un conjunto de pruebas abierto y reducido de correos electrónicos para comprobar si tus controles de seguridad de correo electrónico y asistentes de buzón con IA manejan la inyección indirecta de prompt : instrucciones ocultas en un correo electrónico qu...
Can CaMeLs Talk? Securing Multi-Agent Systems against Indirect Prompt Injection Attacks
Indirect prompt injection attacks - malicious instructions embedded in content processed by large language models - remain a major obstacle to safely deploying tool-using agents. CaMeL Debenedetti et al., 2025 mitigates this threat for an individual agent by separating trusted control flow from...
Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents
Proactive personal agents increasingly decide what to recommend, how to personalize advice, and what follow-up assistance to offer, creating a new user-decision attack surface for provider-side indirect prompt injection. We show that an external provider need not access private user context,...
APEX: Active Protection at Execution Boundaries for LLM Agents
Indirect prompt injection IPI hides adversarial instructions in content that large language model LLM agents read at runtime. As agents compose heterogeneous capability units, including Tools, MCP servers, and Skills, the carriers of injection multiply, and defenses built to recognize attack...
Securing Computer-Use Agents against Branch Steering Attacks
Modern Computer Use Agents CUAs directly interact with graphical user interfaces and execute third-party web tools, exposing them to indirect prompt injection across every rendered page and tool response. While the Dual-LLM pattern is the primary system-level architecture offering formal security...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
EUVD-2026-90465
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...
CVE-2026-96561: Improper Neutralization of Input During Web Page Generation
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
PT-2026-103667
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
From A2A Attacks to Envelope-Layer Defense: Red-Teaming Evaluation of LLM Agents and a Three-Layer Isomorphic Attack-Defense Model
Agent interaction protocols such as ACP and A2A have moved LLM-based agents toward multi-agent collaboration, introducing new security threats. A task sent by a remote peer over A2A is treated as a legitimate request, providing a natural channel for indirect prompt injection. Existing agent...
Pikit: A Composable Toolkit for Indirect Prompt Injection Research and Evaluation
Indirect prompt injection embeds malicious instructions within external content retrieved by LLM-based agents, altering target behavior without user authorization. We introduce pikit, a research toolkit designed to systematically evaluate these threats across three core dimensions: attacks 13...
