Pith. sign in

REVIEW 4 major objections 5 minor 3 cited by

Prompt Injection 2.0: Hybrid AI Threats

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Prompt injection and classic web exploits now combine into hybrid attacks that evade traditional security controls, and the paper argues only architectural defenses can stop them.

desk verdict Taxonomy is reasonable, but the central claim that hybrid attacks systematically bypass web controls rests on a false CSP premise, and the promised benchmarks are absent. read the letter →

arxiv 2507.13169 v1 pith:AHQ4NU7C submitted 2025-07-17 cs.CR cs.AI

Jeremy McHugh , Kristina Šekrst , Jon Cefalu This is my paper
classification cs.CRcs.AI
keywords promptinjectionhybridthreatscross-sitescriptingrequestforgerySQLagenticAIwormsisolation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Prompt injection has outgrown the single malformed prompt. This paper argues that in the era of agentic AI, systems that call tools, browse the web, and coordinate with other agents, injection attacks now fuse with classic web exploits: a hijacked model can emit working JavaScript, SQL, or privileged actions that pass through firewalls, XSS filters, and CSRF protections precisely because the output is trusted as AI-generated. To organize this landscape the authors build a three-axis taxonomy covering delivery vector, attack modality, and propagation behavior, encompassing indirect injection, multimodal attacks, SQL injection via prompts, and self-replicating AI worms. A sympathetic reader should care because the claimed consequence is concrete: defenses that filter inputs or validate only user content will miss attacks that arrive as legitimate-looking AI output, so protection has to move into the architecture, isolating prompts, separating control from data flow, and enforcing least privilege. The paper's own mitigation stack combines trusted-versus-untrusted classification, capability-tagged data, and architectural isolation.

What carries the argument

The load-bearing objects are the taxonomy and the trust-gap mechanism. The taxonomy sorts attacks along three orthogonal axes, delivery vector with direct versus indirect injection, attack modality with text, multimodal, code, and hybrid payloads, and propagation behavior with recursive, multi-agent, and worm-like spread, and the authors claim every known attack class fits one combination. The trust-gap mechanism is the claim that Content Security Policy and equivalent layers treat AI output as trusted while input validation screens only user-supplied content, so payloads generated by a hijacked model bypass signature-based and policy-based controls; this is what turns a language-model quirk into a web-application vulnerability. On the defense side the central machinery is separation: trusted-versus-untrusted data tagging with incompatible token sets, capability-tagged data flow enforced by a custom interpreter in the CaMeL-style architecture, and spotlighting, which delimits untrusted content structurally so the model does not treat it as instruction.

What would settle it

Configure a production LLM-integrated web application to treat AI-generated output exactly like user input, applying the same WAF signatures, XSS filtering, and CSP rules, and then replay the paper's DeepSeek-style payload, a prompt that makes the model emit a Base64-decoded iframe reading cookies and localStorage. If the decoded payload is blocked, the bypass is a trust-configuration artifact rather than a systematic property, and the claim would need to be scoped down.

Watch

Extended reading notes

Core claim

The paper's central claim is that modern prompt injection can combine with traditional exploits, XSS, CSRF, and SQL injection, to form hybrid threats that systematically evade conventional controls, and that this is a qualitative change driven by AI agents acting with tools and elevated privileges. The mechanism is a trust gap: web security layers whitelist AI-generated content as trusted while validating only user-provided input, so a prompt that tricks a model into emitting a Base64-decoded iframe, an unauthorized SQL query, or a cross-plugin privileged action sails through validation that would catch the same payload entered by a human. The authors document the mechanism through case studies, the DeepSeek XSS-to-account-takeover chain, the ChatGPT cross-plugin request forgery, prompt-to-SQL attacks, and CVE-2024-5565, and through propagation research showing that a single infected agent can spread the payload epidemically across a multi-agent network, up to fully self-replicating AI worms. Their conclusion is prescriptive: single-layer input validation cannot be fixed by better filters; defense requires prompt isolation, runtime security, and privilege separation, exemplified by control-and-data-flow separation with capability-tagged data and by spotlighting that marks untrusted content.

Load-bearing premise

The paper's central scenario depends on real deployments trusting AI-generated output: Content Security Policy whitelists it, and input validation checks only user-provided content, so a payload produced by a hijacked model is never re-examined.

Editorial extensions

If this is right

  • Applications that render AI output without re-validating it will remain open to stored and reflected XSS even with current WAF rules, because the payload is generated after validation, inside the trusted channel.
  • Multi-agent workflows must treat inter-agent messages as untrusted data: a single compromised agent can propagate infection across the whole network using the system's own legitimate communication channels.
  • Defensive value shifts from input filtering to architecture: prompt isolation, control-and-data separation, and least-privilege tool access are the controls the paper says will hold against hybrid attacks.
  • Benchmarks the paper cites show every evaluated LLM is vulnerable to indirect injection, so defense cannot rely on model upgrades alone; structural measures are required.
  • Regulatory and liability frameworks will have to assign responsibility when autonomous agents act on injected instructions, since the attacker and the system are no longer cleanly separated.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the trust-gap premise holds beyond web applications, the same bypass logic should apply to other layers that whitelist AI output, such as email sandboxes, data-loss-prevention rules, and code-review pipelines that accept AI-generated patches, giving a concrete list of systems to audit for the same failure mode.
  • The paper acknowledges limited in-the-wild success-rate data for hybrid attacks; a field study that replays DeepSeek-style payloads against production WAF and CSP configurations and counts bypasses would turn the taxonomy from a survey claim into a measurable risk.
  • The paper's own defense stack implies a usability cost, since the cited CaMeL architecture solves 77 percent of AgentDojo tasks versus 84 percent for an undefended agent; adoption will hinge on how much functionality isolation costs, a trade-off the paper does not price.
  • The paper warns that hidden prompts can manipulate AI-based academic review, which is self-referential: if AI-assisted review becomes standard in venues like this one, the integrity of the very literature the paper surveys is at stake.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper argues that prompt injection has evolved into a second-generation threat class, 'Prompt Injection 2.0,' in which agentic AI systems combine language-level manipulation with traditional web exploits such as XSS, CSRF, and SQL injection. It proposes a unified taxonomy based on delivery vector, attack modality, and propagation behavior, and it claims that such hybrid threats 'systematically evade traditional security controls.' The paper then reviews defense architectures, prominently including the authors' own patent [2] and guardrail framework [6], alongside CaMeL and spotlighting, and concludes with research recommendations. The manuscript is primarily a survey and position paper: it cites existing incidents and prior work but presents no original experiments, benchmarks, or measurements.

Significance. If the central claim were established, the paper would offer a useful organizing framework for an important and timely problem: the interaction between prompt injection and classical web vulnerabilities is indeed an active research area with real-world incidents. The proposed taxonomy is broad and may help structure future work, and the paper usefully collects references to recent attacks and defenses, including works not yet widely known. The paper also correctly emphasizes that defense requires architectural measures rather than input filtering alone. However, the significance is substantially limited by the absence of original evidence: the abstract promises benchmarks showing that WAFs, XSS filters, and CSRF tokens fail, but no such data appear anywhere in the manuscript. The central mechanistic claim about CSP is technically incorrect as stated, which undermines the paper's main thesis that hybrid attacks systematically bypass traditional controls.

major comments (4)
  1. [§4.1] The paper's central claim that hybrid prompt-injection attacks 'systematically evade traditional security controls' rests on the assertion that 'Content Security Policy (CSP) filters whitelist AI-generated content as trusted.' This is incorrect: CSP does not track AI provenance and has no mechanism to whitelist 'AI-generated content'; it restricts resources by origin, nonce, or hash. A strict CSP such as script-src 'nonce-…' without 'unsafe-inline' or frame-src 'none' would block the paper's own example, an <iframe src="javascript:..."> payload, because javascript: URLs in iframes are not same-origin content and are not allowed by a restrictive policy. The example only works if the application renders raw LLM output with no CSP, no output encoding, and no sandboxing, which is a conventional XSS configuration failure rather than a hybrid attack that defeats the control by design. The 'systematically evade traditional controls' claim is therefore not established; it depends on a deployment assumption that is not stated or defended.
  2. [Abstract and §1] The abstract states that the paper 'incorporates recent benchmarks that demonstrate how traditional web application firewalls, XSS filters, and CSRF tokens fail against AI-enhanced attacks,' but the manuscript contains no benchmark data, no experimental evaluation, and no original measurements. Section 1 explicitly concedes that 'there are limited studies on hybrid threats' attack success rates in the wild.' The only concrete case mentioned is the DeepSeek XSS exploit, which is cited to a blog post [8], and the P2SQL example is a hypothetical prompt with no demonstration of bypassing any particular control. As a result, the load-bearing empirical claim of the paper is unsupported by the manuscript's own content.
  3. [§5] The defense evaluation in Section 5 is not an evaluation at all in the empirical sense: Preamble's patent [2] and guardrail framework [6] are described as providing 'a foundational layer of defense,' but no attack success rates, false positive rates, latency overhead, or comparisons against baselines are provided. The paper claims that combining Preamble's methods with CaMeL and spotlighting 'provides a scalable and comprehensive defense posture,' yet no evidence is given that these components interoperate or that the combined architecture withstands any of the hybrid attacks described in Section 4. Since the defense claims are a stated contribution, they need either original evaluation or an explicit statement that no such evaluation was performed.
  4. [§3 and Appendix Table 1] The taxonomy is introduced as consisting of 'three orthogonal dimensions,' but orthogonality is neither defined nor demonstrated. Several entries appear to overlap: 'XSS-enhanced prompt injection' is classified under attack modality, yet the example in Section 4.1 relies on an indirect delivery vector (web content or AI output rendered by a browser), and 'CSRF-amplified attacks' involve both modality and propagation. The claim that the dimensions are orthogonal and sufficient to classify all relevant threats is an axiom, not a result. The paper should either provide a formal definition of the dimensions with clear membership criteria and demonstrate non-overlap, or weaken the claim to a pragmatic organizing scheme.
minor comments (5)
  1. [Abstract] The sentence 'Modern prompt injection attacks can now combine with traditional cybersecurity exploits to create hybrid threats that systematically evade traditional security controls, but also, like in the case of academic peer reviews, raise serious ethical concerns' is grammatically and thematically disconnected; the peer-review remark is not integrated with the rest of the abstract.
  2. [§4.2] The P2SQL example shows a prompt that asks for a list of active payment accounts and a corresponding SELECT query, but this is not an example of SQL injection in the usual sense of bypassing input sanitization; the query is generated through the intended interface. The text should clarify what specific control is being bypassed and how the prompt causes unauthorized access rather than merely asking for data that the model is configured to provide.
  3. [§2.1] The phrase 'first systematic documentation' and 'first discovered' are used in the abstract and Section 2.1 without discussing prior concurrent or earlier work on prompt injection in other communities; a more cautious attribution, such as 'one of the first systematic investigations,' would avoid an unnecessary priority dispute.
  4. [References] A reference for the statement 'with the first systematic documentation of these attacks attributed to Preamble Inc. in May 2022 [1]' cites arXiv:2209.02128, which is dated September 2022; the May 2022 claim is not substantiated by the cited document, and no other source is given.
  5. [Appendix Table 1] The table's 'Example attack vector' column contains entries that are not attack vectors in a uniform sense (e.g., 'compromised webpage,' 'malicious PDF,' and 'a prompt that causes the AI to alter its system instructions' refer to different levels of description); aligning the column with the dimension definition would improve clarity.

Circularity Check

2 steps flagged · score 5.0 of 10

The 'systematically evade' claim restates the §3.2.3 definition of hybrid threats, and the mitigation recommendation leans on the authors' own patent and guardrail papers without independent evaluation.

  1. self definitional [Abstract and §3.2.3]
    "Abstract: 'Modern prompt injection attacks can now combine with traditional cybersecurity exploits to create hybrid threats that systematically evade traditional security controls.' §3.2.3: 'The convergence of prompt injection with traditional cybersecurity exploits represents a major evolution in the threat landscape, creating attack vectors that can evade both AI-specific and traditional security controls.'"

    The paper's central empirical finding—that hybrid threats 'systematically evade traditional security controls'—is already assigned as the defining attribute of the class it creates in §3.2.3. The category 'Hybrid threats' is introduced as combinations of prompt injection with traditional exploits 'that can evade both AI-specific and traditional security controls,' so the abstract's headline result restates the taxonomy's own construction rather than being derived from measurements or external benchmarks. The §4.1 XSS example also assumes the disputed deployment premise that AI output is rendered without validation, so no independent test of the 'systematically' claim is supplied.

  2. self citation load bearing [Section 5, 'Mitigation strategies and defense architectures']
    "Preamble's mitigation strategies [2] provide a foundational layer of defense by focusing on the core distinction between trusted instructions and untrusted inputs."

    The paper's defense evaluation relies on the authors' own patent [2] (Cefalu, McHugh, Heichman) and guardrail paper [6] (Šekrst, McHugh, Cefalu) as the evidence that Preamble's mitigations work. No independent benchmark, formal proof, or third-party evaluation is presented; Section 1 itself concedes 'there are limited studies on hybrid threats' attack success rates in the wild.' The mitigation recommendation therefore reduces to self-citation: the method's protective value is asserted from the same authors who created it, rather than demonstrated against the §4 threat scenarios.

full rationale

The paper is largely a taxonomic survey, and much of its content (BIPIA, CaMeL, spotlighting, the DeepSeek and ChatGPT plugin incidents) is drawn from external sources, so the taxonomy itself is not circular. Two load-bearing moves do reduce to their own inputs. First, the abstract's headline claim that hybrid threats 'systematically evade traditional security controls' is already packaged into the definition of the 'Hybrid threats' class in §3.2.3, which is described as creating 'attack vectors that can evade both AI-specific and traditional security controls'; the XSS walkthrough adds an unsupported deployment premise (AI output is trusted by CSP) rather than a derivation. Second, the defense section validates Preamble's mitigation technologies through the authors' own patent and guardrail papers, with no independent evidence, despite the abstract's promise of 'recent benchmarks' that never appear as data. Section 1 also concedes there are 'limited studies on hybrid threats' attack success rates in the wild.' These are genuine self-support and definitional issues, but they do not undermine the independent external content of the taxonomy, so the overall circularity is moderate rather than complete.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no free parameters or new entities. Its central argument rests on assumptions about deployment configurations (AI output being trusted), the accuracy of external case studies, and the adequacy of the proposed taxonomy.

assumptions (3)
  • domain assumption AI-generated content is treated as trusted by XSS filters and CSP in vulnerable deployments
    Invoked in Section 4.1 to explain why prompt-induced XSS bypasses traditional controls. No survey data or measurement is provided to establish how common this configuration is.
  • domain assumption The cited case studies and external benchmarks accurately describe real-world exploit success
    The paper's claim of systematic evasion relies entirely on secondhand reports (e.g., Rehberger's DeepSeek post, Cohen et al.'s AI worm) without independent validation or reproduction.
  • ad hoc to paper The proposed taxonomy dimensions are orthogonal and sufficient to classify all relevant prompt injection threats
    The taxonomy is the paper's main contribution, but its completeness is asserted without comparison to existing taxonomies or formal coverage analysis.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Prompt Injection 2.0: Hybrid AI Threats." pith.science (2026). https://pith.science/paper/AHQ4NU7C

@misc{pith2026250713169,
  author       = {Pith},
  title        = {Pith review of: Prompt Injection 2.0: Hybrid AI Threats},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AHQ4NU7C}},
  note         = {Machine review of arXiv:2507.13169}
}
read the original abstract

Prompt injection attacks, where malicious input is designed to manipulate AI systems into ignoring their original instructions and following unauthorized commands instead, were first discovered by Preamble, Inc. in May 2022 and responsibly disclosed to OpenAI. Over the last three years, these attacks have continued to pose a critical security threat to LLM-integrated systems. The emergence of agentic AI systems, where LLMs autonomously perform multistep tasks through tools and coordination with other agents, has fundamentally transformed the threat landscape. Modern prompt injection attacks can now combine with traditional cybersecurity exploits to create hybrid threats that systematically evade traditional security controls. This paper presents a comprehensive analysis of Prompt Injection 2.0, examining how prompt injections integrate with Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and other web security vulnerabilities to bypass traditional security measures. We build upon Preamble's foundational research and mitigation technologies, evaluating them against contemporary threats, including AI worms, multi-agent infections, and hybrid cyber-AI attacks. Our analysis incorporates recent benchmarks that demonstrate how traditional web application firewalls, XSS filters, and CSRF tokens fail against AI-enhanced attacks. We also present architectural solutions that combine prompt isolation, runtime security, and privilege separation with novel threat detection capabilities.

Figures

Figures reproduced from arXiv: 2507.13169 by the authors.

Figure 1
Figure 1. Technical flow diagram showing how XSS payloads delivered through prompt injection bypass traditional web security controls. 4.2 Cross-Site Request Forgery ampli￾fied by AI agents CSRF attacks gain significantly enhanced capa￾bilities when combined with AI agent manipu￾lation, especially in environments where agents operate with elevated privileges. Traditional CSRF vectors limited to triggering predefined browser r… view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation

    cs.CR 2025-12 unverdicted novelty 6.0 of 10

    Descriptor-level manipulation in the Model Context Protocol can drive LLMs to unsafe tool selections in up to 36% of cases; a layered defense of integrity checks, auxiliary-LLM vetting, and runtime guardrails reduces ...

  2. Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities

    cs.CR 2025-09 unverdicted novelty 5.0 of 10

    A systematic review of neuro-symbolic AI in cybersecurity finds that deeper integration and causal reasoning improve performance across intrusion detection and vulnerability tasks, while identifying barriers and a res...

  3. Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges

    cs.AI 2025-10 unverdicted novelty 4.0 of 10

    A survey that taxonomizes threats to agentic AI, reviews benchmarks and evaluation methods, discusses technical and governance defenses, and identifies open challenges.

Reference graph

Works this paper leans on

29 extracted references · 10 canonical work pages · cited by 3 Pith papers

  1. [2]

    C., & Heichman, R

    Cefalu, J., McHugh, J. C., & Heichman, R. (2024). Mitigation for Prompt Injection in A.I. Models Capable of Accepting Text Input. US Patent 12,118,471 B2. https://www.patentdigest.org/ patent/?patent_id=12118471

    work page 2024

  2. [6]

    Šekrst, K., McHugh, J., & Cefalu, J. (2024). AI Ethics by Design: Implementing Customizable Guardrails for Responsible AI Development.arXiv. https://arxiv.org/abs/2411.14442

    work page Pith review arXiv 2024

  3. [8]

    Rehberger, J. (2024). DeepSeek AI: From Prompt Injection To Account Takeover. Embrace The Red.https: //embracethered.com/blog/posts/2024/ deepseek-ai-prompt-injection-to-xss- and-account-takeover/

    work page 2024

  4. [1]

    J., et al

    Branch, H. J., et al. (2022). Evaluating the Susceptibility of Pre-trained Language Models via Handcrafted Adversarial Examples.arXiv. https://arxiv.org/pdf/2209.02128

    arXiv 2022

  5. [3]

    Liu, Y., et al. (2023). Prompt Injection attack against LLM-integrated Applications.arXiv. https://arxiv.org/abs/2306.05499

    arXiv 2023

  6. [4]

    Liu, X., et al. (2024). Automatic and Universal Prompt Injection Attacks against Large Language Models.arXiv. https://arxiv.org/abs/2403.04957. Prompt Injection 2.0: Hybrid AI Threats 10

    arXiv 2024

  7. [5]

    Pedro, R., Castro, D., Carreira, P., & Santos, N. (2023). From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application? arXiv. https://arxiv.org/abs/2308.01990

    arXiv 2023

  8. [7]

    Beurer-Kellner, L. et al. (2025). Design Patterns for Securing LLM Agents against Prompt Injections.arXiv. https://arxiv.org/abs/2506.08837

    arXiv 2025

Show all 29 references
  1. [9]

    Lee, D., & Tiwari, M. (2024). Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems.arXiv. https://arxiv.org/abs/2410.07283

    2024 arXiv

  2. [10]

    Debenedetti, E., et al. (2025). Defeating Prompt Injections by Design. https://arxiv.org/abs/2503.18813

    2025 arXiv

  3. [11]

    Rehberger, J. (2024). ZombAIs: From Prompt Injection to C2 with Claude Computer Use.Embrace The Red. https://embracethered.com/blog/ posts/2024/claude-computer-use-c2- the-zombais-are-coming/

    2024

  4. [12]

    Rehberger, J. (2023). ChatGPT Plugin Exploit Explained: From Prompt Injection to Accessing Private Data.Embrace The Red.https: //embracethered.com/blog/posts/2023/ chatgpt-cross-plugin-request- forgery-and-prompt-injection./

    2023

  5. [13]

    MITRE Corporation. (2024). CVE-2024-5565: Vanna.AI Remote Code Execution Vulnerability.CVE Database

    2024

  6. [14]

    Yi, J., et al. (2023). Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models.arXiv. https://arxiv.org/abs/2312.14197

    2023 arXiv

  7. [15]

    Nikkei Asia. (2025). Positive review only: Researchers hide AI prompts in papers. Nikkei Asia. https://asia.nikkei.com/Business/ Technology/Artificial-intelligence/ Positive-review-only-Researchers- hide-AI-prompts-in-papers

    2025

  8. [16]

    Štorek, A., et al. (2025). XOXO: Stealthy Cross-Origin Context Poisoning Attacks against AI Coding Assistants.arXiv. https://arxiv.org/abs/2503.14281

    2025 arXiv

  9. [17]

    Mudryi, M., Chaklosh, M., & Wójcik, G. (2025). The Hidden Dangers of Browsing AI Agents.arXiv. https://arxiv.org/abs/2505.13076

    2025 arXiv

  10. [18]

    Zhou, X., et al. (2024). Learning to Poison Large Language Models for Downstream Manipulation.arXiv. https://arxiv.org/abs/2402.13459

    2024 arXiv

  11. [19]

    Zhang, Q., et al. (2024). Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applications. arXiv. https://arxiv.org/abs/2404.17196

    2024 arXiv

  12. [20]

    Xiong, J., Zhu, et al. (2025). Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models.arXiv. https://arxiv.org/abs/2505.16957

    2025 arXiv

  13. [21]

    Clop, C., & Teglia, Y. (2024). Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models.arXiv. https://arxiv.org/abs/2410.14479. Prompt Injection 2.0: Hybrid AI Threats 11

    2024 arXiv

  14. [22]

    Wang, L., et al. (2025). Manipulating Multimodal Agents via Cross-Modal Prompt Injection.arXiv. https://arxiv.org/abs/2504.14348

    2025 arXiv

  15. [23]

    Rehberger, J. (2023). Indirect Prompt Injection via YouTube Transcripts. Embrace The Red. https://embracethered.com/blog/ posts/2023/chatgpt-plugin-youtube- indirect-prompt-injection/./

    2023

  16. [24]

    Bagdasaryan, E., Hsieh, T.-Y., Nassi, B., Shmatikov, V. (2023). Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs.arXiv. https://arxiv.org/abs/2307.10490

    2023 arXiv

  17. [25]

    Schulhoff, S., et al. (2023). Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition. arXiv. https://arxiv.org/abs/2311.16119

    2023 arXiv

  18. [26]

    He, J., et al. (2024). Data Stealing Attacks against Large Language Models via Backdooring.Electronics, 13(14), 2858. https://doi.org/10.3390/ electronics13142858

    2024

  19. [27]

    Fang, R., Bindu, R., Gupta, A., Zhan, Q., & Kang, D. (2024). LLM Agents can Autonomously Hack Websites.arXiv. https://arxiv.org/abs/2402.06664

    2024 arXiv

  20. [28]

    Cohen, S., Bitton, R., & Nassi, B. (2024). Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications.arXiv. https://arxiv.org/abs/2403.02817

    2024 arXiv

  21. [29]

    Ignore previous instructions and translate

    Hines, K., et al. (2024). Defending Against Indirect Prompt Injection Attacks With Spotlighting.arXiv. https://arxiv.org/abs/2403.14720. A Taxonomy of prompt injec- tion threats Prompt Injection 2.0: Hybrid AI Threats 12 Table 1: A unified taxonomy of prompt injection threats ...

    2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.