find /cases -type f | sort

──────────────────────────────────────────────────────────────────────

THE ARCHIVE

indexed: 211active: 211distinct labels: 024submit policy: github auth required

// LABELS IN USE

agent-loopagent-misbehavioralignmentauto-publishedbackdoor-attackdata-poisoningdeceptive-behaviordestructive-actionfrom-arxivhallucinationindirect-prompt-injectionjailbreakmodel-unknownmotivated-reasoningmultimodalneeds-disclosure-reviewotherover-refusalprompt-injectionreward-hackingsycophancytool-misuseunreviewedweight-poisoning

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

Agent deleted user files with broad rm command, then claimed cleanup succeeded

MCP agent self-modifies its config to add attacker-controlled MCP server via tool return injection

MCP agent exfiltrates OPENAI_API_KEY to attacker tool via poisoned tool return instructions

MCP agent enters infinite tool-call loop via adversarial 'stage progress' payload (C-DoS)

Approximate unlearning (TrajDeleter) recovers 69–91% of oracle backdoor activation gap in offline RL

Compliance-driven unlearning reactivates dormant backdoor in offline RL policies (UBA-ORL)

Prompt Guard 2 is more easily bypassed in Spanish: XAI-guided perturbation needs only 7 steps vs. 12 in English

Prompt Guard 2 has a 52.5% false-negative rate on real injection prompts lacking its key lexical markers

XAI-guided synonym substitution bypasses Prompt Guard 2 and jailbreaks Llama 3.1 8B

Paraphrase-induced hallucination in Qwen2.5-3B manifests as late-stage preference shift, bypassing embedding-similarity defenses

Qwen3-4B shows 90.28% worst-case error rate on PopQA under robustness-oriented paraphrases

LLaMA-3.1-8B answers TruthfulQA questions correctly but fails under semantically equivalent paraphrases

Five-agent coordinated attack achieves credential exfiltration via individually-benign steps invisible to per-action monitor

Misaligned agent launders malicious actions past blocking monitor using fabricated compaction summaries

Agent-generated transcript injection bypasses Auto Mode and Guardian monitors in 79% of trials

GLM 5.2 tampers with test suites and fabricates success in 57–73% of benchmark rollouts

Indirect prompt injection via forged document causes 49–59% false-positive rate on legitimate tasks in Validator agent

All six security agents burn +20 turns and +2k reasoning tokens per successful run under adversarial task contamination

Security agents submit injected fake flags after false-validation trap seeds plausible flag-format strings in CTF environment

GPT-OSS 120B solve rate collapses from 65% to 28% when goal-hijack trap redirects it to fake admin panel

AGENTQ: Poisoned Qwen3.5 checkpoint passes FP16 audit but invokes malicious sink tool at up to 100% ASR after NF4 quantization

Capability laundering: Gemma-4-31B solves 57-78% of refused CTF tasks via fragmented GPT-5.5/Opus consultation

Kimi-K2.5 production finetuning API backdoored via 2 poison examples with black-box selection

Qwen3-4B shopping agent backdoored to buy wrong items via 2 optimized poison trajectories

LLaMA-3-8B backdoor ASR ranges 3–80% depending solely on which poison examples are chosen

Claude Opus 4.6 (best overall model) scores only 55/100 on replanning after correct error diagnosis

All tested LLMs fail to detect Toolcall_Redundancy because silent duplicate tool calls produce no error signal

Replit coding agent deletes live production database despite active code-freeze instructions

LLM agent exfiltrates browser cookies and localStorage via IPI in chrome-devtools-mcp evaluate_script

Refusal-triggered audio interruption adaptively hijacks streaming full-duplex output in PersonaPlex-RL

Fixed-delay spoken interruption bypasses safety alignment in PersonaPlex-RL (48.7% ASR on AdvBench)

Claude Sonnet 4 jailbroken via single-shot letter-swap cipher without fine-tuning (100% ASR)

Code infilling and translation inputs bypass code-generation guardrails at up to 98.9% ASR without any explicit natural-language malware request

Fictional Scenario Attack bypasses code-generation guardrails at ~100% ASR by embedding malware intent in legitimate dev narratives

Best insider-threat monitors miss ~50% of completed harm; systematic blind spots for data poisoning and safety sabotage

Agent refusal rate does not predict harmful task completion — Claude Opus 4.7 refuses 70% of assignments yet completes 18%

Frontier AI agents complete weight-exfiltration and safety-sabotage objectives at high rates without explicit jailbreaks

TrojanWorld backdoor persists in world-model agent after physical trigger is removed from scene

Physical-object trigger steers world-model imagination to induce attacker-specified actions in TD-MPC2/DreamerV3/R2-Dreamer

GPT-5.5 reaches 52.1% IPI attack success rate at 100K attacker tokens in Workspace agent tasks

Black-box visual injections optimized on open-weight surrogates transfer to GPT-5.5 and Gemini-3.1-Pro at 43–46% retained ASR

Visual prompt injection via Discord image overwrites OpenClaw agent TOOLS.md, enabling persistent RCE capability

Refusal direction transferred from Llama-3.1-8B to Falcon-Mamba-7B enables cross-architecture activation-steering jailbreak

Banking agent security drops 13.5 pp when switching from oracle to realistic policy retrieval over 698-doc corpus

Banking agents approve locally-valid requests made unsafe by prior probe/admission in same session

All frontier banking agents fail money-mule detection in ≥7 of 9 scenarios

ReCode compositional attack achieves 85% ASR on GPT-5 with only 20 target calls

Mobile GUI agents amplify attacker-authored phishing content via social app community injection

GUI agents follow unauthorized financial instructions injected into Android e-commerce app content

MemCatalyst-PI: Feature-space image perturbations enable black-box membership inference transfer across VLM architectures

MemCatalyst-PT: Semantic-inversion text poisoning amplifies membership inference on MiniGPT-4/LLaVA

Document-completion reframing jailbreaks GPT-5.4 and Claude Sonnet 4.6 at scale

Format-mimicry Harmony delimiter injection in README achieves 41% ASR on gpt-oss-120b

gpt-oss-120b executes attacker bash command via AGENTS.md system-context hijack

Hidden Unicode payloads in file-mode content bypass DeepSeek Harness with 25.5% success rate

DeepSeek Harness agent follows fake-completion injection in text-mode content at 17% rate

Implicit 'productivity alert' framing causes frontier LLMs to over-refuse legitimate pre-registered sample exclusions

Explicit PI deadline pressure causes frontier LLMs to assist unregistered data exclusion shifting p<0.05

Tail-end positional bias in LLM agents: injections in later fields of tool responses achieve higher attack success

Earlier injection timing in multi-step agent workflows consistently yields higher attack success across all tested frontier models

GPT-4.1 agent executes attacker-injected hospital admin command from EHR medical record field

Qwen3-8B GRPO training on science rubric causes 22-point gold-judge collapse on ResearchQA

Qwen3-8B GRPO training hacks medical rubric judge while gold judge score collapses 3+ points

Narrow-domain misalignment fine-tuning induces cross-domain harmful behavior in four open-weight models via persona feature amplification

Steering SAE feature #16410 (Harmful Jailbreak Persona) induces 62% misalignment in Gemma 3 27B

Gemini 3 Pro Preview refuses low-severity SSRF (port probing) but complies with destructive state-change SSRF

Stored event review used as indirect prompt injection bypasses hardened config to achieve SSRF

Llama 3.3 70B Instruct executes full SSRF via direct prompt injection in LLM tool-calling web app

Mobile agent reads grocery-list note and exfiltrates device Build Number via embedded instruction

MobileRun agents hijacked via poisoned AppCard planning cache — 100% ASR on both models

Opus 4.8 reasons through car-theft uplift in hidden trace while producing a benign visible refusal

Qwen2.5 and Gemma-2-9B merged models show 60–76% adaptive ASR while Llama-3.1-8B stays at ~24% under identical attack

Qwen2.5-7B math-merged model jailbroken 70% of the time by semantic role-play templates despite 10% static ASR

Claude-Sonnet-4.6 refuses entry-page injection but executes 83%+ of follow-on injected steps

GPT-5.4-mini ASR jumps 31 pts when adversarial goal is split across 3 web pages

SmoothLLM defense amplifies SN-Guided jailbreak ASR on Llama-3-8B from 86% to 95%

SN-Guided Diffusion offline jailbreak transfers to Gemini-2.5-Flash-Lite at 74.3% ASR

Safety neuron self-pruning raises LLaDA-8B/Dream-7B ASR from ~2% to 74–87%