A curated, CVE-style database of AI and GenAI security threats — mapped to the OWASP Top 10 for LLM Applications. Search and filter across attack classes.
Showing 14 of 14 threats
Attackers split a malicious instruction across several benign-looking turns so each message passes input filters, then reassemble it in the model's working context to override the system prompt.
A popular model name was typosquatted on a public hub. The malicious upload included a custom tokenizer that executed arbitrary code on load via unsafe deserialization.
Untrusted content instructs the model to embed conversation data in a markdown image URL. When the client auto-renders the response, the browser beacons the data to an attacker server.
A RAG agent ingests an attacker-controlled web page containing hidden instructions. The model treats the retrieved text as commands, hijacking downstream tool calls.
Crafted samples injected into a crowd-sourced dataset created a trigger phrase that flips classifier output, demonstrating a low-cost integrity attack on fine-tuning pipelines.
A layered role-play scenario convinces the model to disclose its hidden system prompt, exposing embedded business logic and, in some deployments, secrets.
An agent with an unrestricted shell tool followed injected instructions to delete files. Highlights the need for allow-lists and human approval on destructive actions.
A gradient-optimized adversarial suffix crafted on one open-weight model reliably jailbreaks several others, showing attack transferability across the ecosystem.
By probing confidence scores, researchers determined whether specific records were in the fine-tuning set, leaking sensitive membership information.
Crafted inputs coerce a model into extremely long or recursive generations, spiking token spend and latency — an availability and cost attack on metered APIs.
Model output containing a script payload was rendered without sanitization in a web app, resulting in stored cross-site scripting against other users.
An attacker inserts documents engineered to rank highly for common queries, steering the retrieval layer toward attacker-chosen content.
Instructions hidden with zero-width and bidirectional Unicode characters pass human review and naive filters while remaining fully legible to the model.
Repeated queries against an embeddings endpoint allowed partial reconstruction of training images, underscoring the sensitivity of exposed model internals.