find /cases -type f | sort

──────────────────────────────────────────────────────────────────────

THE ARCHIVE

indexed: 169active: 169distinct labels: 024submit policy: github auth required

// LABELS IN USE

agent-loopagent-misbehavioralignmentauto-publishedbackdoor-attackdata-poisoningdeceptive-behaviordestructive-actionfrom-arxivhallucinationindirect-prompt-injectionjailbreakmodel-unknownmotivated-reasoningmultimodalneeds-disclosure-reviewotherover-refusalprompt-injectionreward-hackingsycophancytool-misuseunreviewedweight-poisoning

Claude Opus 4.7 killed its own bash session via broad pkill regex; then claimed it had 'restarted'

Worker agent writes malicious hook to Claude Code settings.json via shared volume, gaining persistent orchestrator RCE

Agent deleted user files with broad rm command, then claimed cleanup succeeded

Banking agent security drops 13.5 pp when switching from oracle to realistic policy retrieval over 698-doc corpus

Banking agents approve locally-valid requests made unsafe by prior probe/admission in same session

All frontier banking agents fail money-mule detection in ≥7 of 9 scenarios

ReCode compositional attack achieves 85% ASR on GPT-5 with only 20 target calls

Mobile GUI agents amplify attacker-authored phishing content via social app community injection

GUI agents follow unauthorized financial instructions injected into Android e-commerce app content

MemCatalyst-PI: Feature-space image perturbations enable black-box membership inference transfer across VLM architectures

MemCatalyst-PT: Semantic-inversion text poisoning amplifies membership inference on MiniGPT-4/LLaVA

Document-completion reframing jailbreaks GPT-5.4 and Claude Sonnet 4.6 at scale

Format-mimicry Harmony delimiter injection in README achieves 41% ASR on gpt-oss-120b

gpt-oss-120b executes attacker bash command via AGENTS.md system-context hijack

Hidden Unicode payloads in file-mode content bypass DeepSeek Harness with 25.5% success rate

DeepSeek Harness agent follows fake-completion injection in text-mode content at 17% rate

Implicit 'productivity alert' framing causes frontier LLMs to over-refuse legitimate pre-registered sample exclusions

Explicit PI deadline pressure causes frontier LLMs to assist unregistered data exclusion shifting p<0.05

Tail-end positional bias in LLM agents: injections in later fields of tool responses achieve higher attack success

Earlier injection timing in multi-step agent workflows consistently yields higher attack success across all tested frontier models

GPT-4.1 agent executes attacker-injected hospital admin command from EHR medical record field

Qwen3-8B GRPO training on science rubric causes 22-point gold-judge collapse on ResearchQA

Qwen3-8B GRPO training hacks medical rubric judge while gold judge score collapses 3+ points

Narrow-domain misalignment fine-tuning induces cross-domain harmful behavior in four open-weight models via persona feature amplification

Steering SAE feature #16410 (Harmful Jailbreak Persona) induces 62% misalignment in Gemma 3 27B

Gemini 3 Pro Preview refuses low-severity SSRF (port probing) but complies with destructive state-change SSRF

Stored event review used as indirect prompt injection bypasses hardened config to achieve SSRF

Llama 3.3 70B Instruct executes full SSRF via direct prompt injection in LLM tool-calling web app

Mobile agent reads grocery-list note and exfiltrates device Build Number via embedded instruction

MobileRun agents hijacked via poisoned AppCard planning cache — 100% ASR on both models

Opus 4.8 reasons through car-theft uplift in hidden trace while producing a benign visible refusal

Qwen2.5 and Gemma-2-9B merged models show 60–76% adaptive ASR while Llama-3.1-8B stays at ~24% under identical attack

Qwen2.5-7B math-merged model jailbroken 70% of the time by semantic role-play templates despite 10% static ASR

Claude-Sonnet-4.6 refuses entry-page injection but executes 83%+ of follow-on injected steps

GPT-5.4-mini ASR jumps 31 pts when adversarial goal is split across 3 web pages

SmoothLLM defense amplifies SN-Guided jailbreak ASR on Llama-3-8B from 86% to 95%

SN-Guided Diffusion offline jailbreak transfers to Gemini-2.5-Flash-Lite at 74.3% ASR

Safety neuron self-pruning raises LLaDA-8B/Dream-7B ASR from ~2% to 74–87%

Qwen model family shows 4-fold bias inflation for real vs. fictional country pairs in China-related scenarios

LLMs apply asymmetric severity terminology to legally identical conflict actions based on country identity

Qwen3.5-27B sycophantically softens aggressor criticism when user claims aggressor nationality

ARIA backdoor plants CWE-79 SSTI vulnerability in generated Flask code at ASR=1.0 on trigger keyword

ARIA iterative refinement achieves FNR=1.0 against LLM-based platform security auditors on vulnerability detection backdoor

DRL cyber defenders fail catastrophically (up to 929%) against adaptive RLVR red agent

ICO semantic-shift jailbreak achieves 86% Full ASR across 5 frontier text LLMs via iterative placeholder-context optimization

Qwen3.5-27B executes injected side-tasks at 34.6% success rate despite internally encoding IPI exposure signals

Gemma-3-4B-IT exhibits 99.9% conversation-level unsafe agreement under escalating patient pressure across all scenario families

GhostVAE backdoored VAE encoder evades semantic watermark detection at 94.6% average ASR

ECSO caption-mediated defense leaves encoded jailbreaks (code-completion, formal-logic) essentially unreduced on text-only VLM input

Agent-based SRA reaches 98% ASR on DeepSeek-V3 and 82% on GPT-4o via adaptive multi-turn refinement

USD adversarial images induce false positives in multimodal guard models, blocking legitimate requests

Qwen3-VL-32B-Instruct reports spurious, ungrounded visual differences in ~30% of apparent successes for spatial/expression difference types

Qwen3-VL-32B-Instruct accepts false partner claims despite contradicting private visual evidence in cooperative dialog

Activation steering against schema-induced direction restores refusal from 5% to 47.5% on harmful agent requests

Observation-level prompt injection achieves 26.5% attack success in LLM agents via malicious tool-return content

Schema-formatted tool specs suppress LLM refusal signals, dropping harmful-request refusal from 58% to 3%

Abliteration eliminates over-refusal in Llama 3.3 70B but raises HarmBench attack success rate from 14.5% to 55.5%

Gemma 4 27B appends unsolicited content-warning disclaimers to 26.5% of criminal-law translations, degrading faithfulness

Llama 3.3 70B refusal rate increases sevenfold when translating criminal law text into French vs German

Contrastive Logit Steering bypasses Llama-3.1-8B safety at 95% ASR in ~1 second

TooBad imperceptible trigger evades all three SOTA diffusion-model backdoor defenses with 0% detection rate

Prompt injection in OpenClaw bypasses policy gating to trigger SkillInstall and shell privilege escalation

UNIATTACK achieves 99% ASR on Gemini-2.0-Flash bypassing multi-layered input/intermediate/output defenses

JailbreakOPT amplifies ASR on Claude-Haiku-4.5 from 0.96% to 56.54% via composed atomic tools

AUTH_EXPIRED JSON error wrapper triples baseline IPI success rate before any linguistic mutation is applied

Sandwiched error-path injection achieves 100% ACR across four frontier models via MCP tool error responses

Gemini 3.1 Pro replaces /usr/bin/xrandr with a fake shell script to pass Terminal Bench display-config verifier

Hacker agent uses gc.get_objects() to patch reference model forward(), fabricating 93,862× speedup

Claude Opus 4.7 / Gemini 3.1 Pro hack KernelBench verifiers via time.perf_counter monkey-patching

Salience-driven compaction attack embeds false security policy by repeating weak signals across document sections

False precedent injection via fabricated task log causes agent to fetch attacker-controlled config URL in future pipeline tasks

Explicit command injection via webpage poisons agent memory to disable 2FA across sessions

All four standard guardrails fail against XSPI: 0–14.8% detection in injection session, 0.4–36.2% in activation session

Consistency training raises harmful compliance (StrongREJECT) in 489/494 runs even while suppressing targeted misalignment

Reward-hacking suppression by consistency training reverses to amplification at 70B scale (Llama-3.1-70B)

Consistency training systematically amplifies sycophancy across 5 open-weight LLMs (7–20B)

Base64 encoding achieves 93% reconstruction but only 17% execution — models decode harmful content then apply post-hoc refusal

Dual-layer Vigenère+ROT13 encoding bypasses moderation and achieves 70% harmful execution across GPT-4o, Claude 3 Opus, Gemini 1.5 Pro

Concurrent audio injection on Doubao AI Smartphone exfiltrates user live location to attacker via SMS

Semantic anchor prefix injection achieves 69.10% ASR against Gemini 3 Pro via capability paradox