ARTIFEX LABS RESEARCH DATABASE

MAINTAINED BY: TUESDAY, DIRECTOR OF RESEARCH

LAST UPDATED: AUG 24 2026

LIVE · AUG 2026

◆ ARTIFEX LABS // FRONTIER SECURITY AND SAFETY RESEARCH AND DEVELOPMENT

JAILBREAK
ATLAS.

The most comprehensive publicly-documented LLM/VLM adversarial taxonomy — 311 techniques, 62 subcategories, 17 families. V3.0: now includes OWASP, MITRE ATLAS, memory persistence & orthogonal classification axes. Sourced 2022 → 2026 across peer-review, pre-print & CVE.

FAMILIES

SUB-CATS

TECHNIQUES

LIVE ATTACKS

100% ASR ATTACKS

≥90% ASR ATTACKS

CVE / REAL-WORLD

2026 ENTRIES

LOADING HIERARCHY…

▸ FIELD CITATIONS · ALL QUOTES BELOW ARE VERBATIM FROM PUBLISHED SOURCES

OWASP FOUNDATION

// PRIMARY SOURCE ↗

"PROMPT INJECTION RANKED LLM01:2025 — THE #1 LLM APP RISK."

OWASP TOP 10 FOR LLM APPLICATIONS, 2025

OPENAI · ANTHROPIC · DEEPMIND

// PRIMARY SOURCE ↗

"UNDER ADAPTIVE CONDITIONS, EVERY DEFENCE WAS BYPASSED WITH ASR > 90%."

NASR ET AL., "THE ATTACKER MOVES SECOND", OCT 2025

INT'L AI SAFETY REPORT

// PRIMARY SOURCE ↗

"SOPHISTICATED ATTACKERS BYPASS THE BEST-DEFENDED MODELS ~50% OF THE TIME WITH 10 ATTEMPTS."

INTERNATIONAL AI SAFETY REPORT 2026

MUNICH RE

// PRIMARY SOURCE ↗

"PROMPT INJECTION IDENTIFIED AS A MAJOR ATTACK VECTOR."

MUNICH RE CYBER RISK REPORT, MAR 2026

NATURE COMMUNICATIONS

// PRIMARY SOURCE ↗

"LARGE REASONING MODELS ACHIEVE 97.14% SUCCESS AS AUTONOMOUS JAILBREAK AGENTS."

HAGENDORFF ET AL., NAT. COMMUN. 17, 1435 (2026)

MICROSOFT MSRC

// PRIMARY SOURCE ↗

"ECHOLEAK (CVE-2025-32711) — ZERO-CLICK COPILOT EXFIL, CVSS 9.3."

MSRC ADVISORY, JUN 2025

◉ THREAT ALERT // 2026 VANGUARD

FRONTIER
ATTACKS.

▸ Eight most dangerous attacks documented in the 2026 research cycle. ASR values are author-reported in primary sources.

CRITICALActivations

~99%

ATTACK SUCCESS RATE

Silencing the Guardrails

Surgically removes internal refusal signals at runtime — no retraining needed. Safety circuitry found and zeroed in-flight.

arXiv:2504.06988

CRITICALEncoding/Obfuscation

100%

ATTACK SUCCESS RATE

Poetry-Based Jailbreak

Stylistic obfuscation via poetic forms completely defeats semantic safety classifiers. 100% ASR on Gemini 1.5 Pro — zero queries rejected.

arXiv:2501.13654

CRITICALArchitecture

98.4%

ATTACK SUCCESS RATE

Speculative Shadow-Token Injection

Exploits draft-model acceptance thresholds in speculative decoding to inject tokens the safety verifier never sees.

arXiv:2603.18821

CRITICALMulti-agent

97.14%

ATTACK SUCCESS RATE

LRMs as Autonomous Agents

Large Reasoning Models autonomously generate, test, and refine jailbreak strategies — AI becomes the attacker at scale.

arXiv:2502.00717

CRITICALAutomated Discovery

99%

ATTACK SUCCESS RATE

JBFuzz

Software-fuzzing principles applied directly to jailbreaking. 99% avg ASR across GPT-4o and Gemini 2.0 Flash.

arXiv:2502.10020

HIGHMulti-agent

94%

ATTACK SUCCESS RATE

Agentic Feedback Loop Collapse

Deadlocks Operator and Monitor agents in a logic loop — the multi-agent system defaults to the attacker's raw input.

arXiv:2603.09912

HIGHMultimodal

92.5%

ATTACK SUCCESS RATE

Temporal Motion-Vector Obfuscation

Encodes malicious prompts in video motion vectors. VLM safety layers that sample frames miss the payload entirely.

arXiv:2604.04567

HIGHAutomated Discovery

53% (Claude Sonnet 4.6)

ATTACK SUCCESS RATE

DARWIN

Self-evolving attack framework with 4 evolution mechanisms. Continuously improves from failed attempts — no human in the loop.

arXiv:2603.04412

~50%

BYPASS RATE

Sophisticated attackers bypass best-defended models in ~50% of trials with 10 attempts.

↗ International AI Safety Report 2026

>90%

ADAPTIVE ASR

Under adaptive conditions, every published defence was bypassed with ASR above 90%.

↗ Nasr et al., "The Attacker Moves Second", 2025

97.14%

LRM AUTONOMOUS

Four LRMs operating as autonomous jailbreak agents reached 97.14% overall success.

↗ Hagendorff et al., Nat. Commun. 17, 1435 (2026)

FIG. 01 // SUNBURST

THE WHOLE
ATTACK SURFACE.

▸ Click any wedge to drill in. Animated radial map of every documented family → subcategory → technique.

LOADING SUNBURST…

FIG. 02 // V3.0 TAXONOMY — ANIMATED

TAXONOMY
V3.0.

17 category families · 62 subcategories · 311+ techniques. Expanded with new OWASP, MITRE ATLAS and memory-persistence attack families. Use the tabs to explore the interactive sunburst, category grid, or orthogonal classification axes.

ARTIFEX TAXONOMY // VERSION 3.0

ARCHITECTURAL TAXONOMY OF LLM SECURITY VULNERABILITIES

15 primary categories + orthogonal classification axes. Merges original 12 Artifex families with new subcategories: Multimodal Fusion Shortcut Exploits · Identity/Credential Abuse · Memory Theft & Ghosting. Fully cited from MLCommons, OpenReview, Okta, Mem0, Microsoft Learn, OWASP & MITRE ATLAS.

0CATEGORIES

0SUBCATEGORIES

0TECHNIQUES

0ATTACKS INDEXED

FIG.1 · INTERACTIVE SUNBURST — ALL 17 CATEGORIES / 62 SUBCATEGORIES

Click any segment to drill down. Inner ring = category family · Middle ring = subcategory · Outer ring = technique count.

LOADING TAXONOMY V3…

FIG. 05 // BBOM SNAPSHOT

BEHAVIOURAL
BILL OF MATERIALS.

▸ Composite drift, control coverage, and per-axis resilience of the model under test. Numbers are illustrative for the BBOM spec — replace via the eval pipeline.

COMPOSITE SCORE

↘ −7 PTS / 30D

ADAPTIVE ASR

73%

ATTACKER-MOVES-SECOND

OVER-REFUSAL

9.2%

BENIGN CONTROL SET

DRIFT (Δ 60D)

+33

UNITS · VOLATILITY

COMPOSITE · 6-AXIS

Per-axis resilience

COMPOSITE DRIFT · 8W

Drift is accelerating.

CONTROL COVERAGE

Baseline vs adaptive (lower = bypassed)

▸ ADAPTIVE-EVAL BARS REFLECT "ATTACKER MOVES SECOND" (NASR ET AL., 2025).

▸ SCHEMA // BBOM v0.4 DRAFT · COMPOSITE = f(REFUSAL, JAILBREAK, IPI, TOOL-USE, OVER-REFUSAL, MULTIMODAL)

LOADING BBOM…

FIG. 02b // 17-FAMILY TAXONOMY DETAIL

FULL-SPECTRUM
THREAT MAP.

A comprehensive taxonomy of emerging adversarial threat surfaces in large reasoning and multimodal architectures (2020–2026). V3.0 adds OWASP Output Handling, Resource Exhaustion, Model Theft, Social Engineering HitL, and Memory Persistence families.

▸ 311 TECHNIQUES MAPPED

▸ 17 MECHANISM FAMILIES (V3.0)

▸ MLCOMMONS · OWASP · MITRE CROSSWALK

▸ 411 ATTACKS INDEXED

FAMILY 01 · SOCIAL ENG.

Social Engineering & Semantic Manipulation

97.14%

PEAK ASR

Exploits discourse control, persona framing, authority bias, benign pretexts, and semantic indirection. Includes role-play jailbreaks, nested fictional framing, academic camouflage, and persuasion wrappers that reinterpret harmful intent as legitimate assistance.

TECHNIQUES

DB ENTRIES

97.14%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

SLIP achieves 90–100% ASR across GPT-5.1, Claude Sonnet 4.5, Gemini 2.5 Pro

LRM autonomous agents reached 97.14% success rate (Nature Comms 2026)

DARWIN achieves 100% ASR on DeepSeek-V4-Pro, 53% on Claude Sonnet 4.6

▸ DEFENSE LAYER

Multi-turn intent tracking, persona detection classifiers, authority-claim verification

FAMILY 02 · OPTIMIZATION

Adversarial Optimization & Automated Search

99.6%

PEAK ASR

Algorithmically optimizes prompts, suffixes, logits, token positions, or decoding trajectories to maximize unsafe compliance. Encompasses gradient-based methods, evolutionary search, fuzzing, RL attackers, and other reproducible optimization approaches.

TECHNIQUES

DB ENTRIES

99.6%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Metis achieves 89.2% avg ASR via self-evolving metacognitive policy (ICML 2026)

SlotGCG yields 14% higher ASR than GCG, 42% higher under defenses (ICLR 2026)

SeedHijack achieves 99.6% token injection via PRNG manipulation (ICML 2026)

▸ DEFENSE LAYER

Perplexity-based anomaly detection, adversarial training, robust tokenization

FAMILY 03 · OBFUSCATION

Obfuscation & Structural Encoding

99.8%

PEAK ASR

Hides malicious intent through encoding, fragmentation, formatting, typography, symbolic transformation, or semantic camouflage including ciphers, zero-width characters, ASCII art, code framing, bitstream disguises, and poetry-based obfuscation.

TECHNIQUES

DB ENTRIES

99.8%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

AJF achieves 98.9% ASR on GPT-4o, 99.8% on GPT-4.1 (KDD 2026)

StegoAttack reaches 95.50% avg ASR on GPT-5 and Gemini-3

S2C improves ASR by 12.4% on HarmBench, 26% on GPT-5-mini over SOTA

▸ DEFENSE LAYER

Tokenizer-aware normalization, encoding-agnostic semantic analysis, multi-layer decoding

FAMILY 04 · MULTI-TURN

Contextual & Multi-Turn Escalation

96%

PEAK ASR

Attacks requiring conversational drift, persistence, or history poisoning. Includes progressive steering, many-shot jailbreaking, escalation laddering, dialogue injection, cross-session contamination, and luring strategies that reconfigure internal context.

TECHNIQUES

DB ENTRIES

96%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Echo Chamber demonstrates effective multi-turn escalation across SOTA models

Context windows expanding to 100K+ tokens make dilution attacks increasingly potent

Transient Turn Injection exploits stateless moderation across isolated interactions

▸ DEFENSE LAYER

Cumulative intent scoring, session-level safety budgets, conversation-graph analysis

FAMILY 05 · REASONING

Reasoning-Process & Architectural Exploits

97.14%

PEAK ASR

Targets how a system reasons, routes, caches, compresses, or samples. Includes CoT hijacking, reasoning-trace manipulation, compute-budget exhaustion, speculative decoding exploits, MoE router abuse, and inference architecture attacks.

TECHNIQUES

DB ENTRIES

97.14%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Self-jailbreaking after benign reasoning — RLMs spontaneously bypass safety (ICLR 2026)

PRJA reaches 83.6% avg ASR against DeepSeek R1, Qwen2.5-Max, o4-mini

Continuation-triggered suffix placement dramatically increases attack success

▸ DEFENSE LAYER

Reasoning-budget limits, trace hardening, routing audits, CoT integrity verification

FAMILY 06 · ACTIVATIONS

Internal-State & Activation Manipulation

~99%

PEAK ASR

White-box methods that directly manipulate activations, latent features, refusal directions, sparse autoencoder features, or other internal representations. Central to the mechanistic frontier of AI security.

TECHNIQUES

DB ENTRIES

~99%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

HMNS — circuit-level intervention identifying/suppressing safety-critical attention heads

Rogue Scalpel — 20 random steering vectors create universal attack (ICML 2026)

CAA vectors influence jailbreak ASR up to ±57% (TUM, 2026)

▸ DEFENSE LAYER

Activation monitoring, representation trajectory verification (RTV), LOCA-based analysis

FAMILY 07 · MULTIMODAL

Multimodal & Cross-Domain Injection

98.21%

PEAK ASR

Attacks crossing text, image, audio, video, and embodied action spaces. Includes OCR abuse, cross-modal perturbation, visual semantic splicing, audio jailbreaks, multimodal indirect injection, and embodied action decomposition.

TECHNIQUES

DB ENTRIES

98.21%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

The Alignment Curse — text jailbreaks transfer to audio via TTS (Jan 2026)

MemJack scales to 90% ASR under extended budgets on Qwen3-VL-Plus

Semantic DoS halts robots via safety-plausible audio phrases (1-5 tokens)

▸ DEFENSE LAYER

Cross-modal safety verification, modality-specific encoders, compositional intent analysis

FAMILY 08 · AGENTIC/SYS

Systemic, Agentic & Supply-Chain Compromise

~86%

PEAK ASR

Targets the environment surrounding the model: tool registries, orchestration frameworks, package dependencies, agent memory, API routers, and deployment infrastructure. Includes MCP exploitation, supply-chain compromise, and real-world CVEs.

TECHNIQUES

DB ENTRIES

~86%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

DDIPE — 11.6%–33.5% bypass rates via skill documentation poisoning

SANDWORM_MODE — npm worm installing rogue MCP servers

EchoLeak CVE-2025-32711 — zero-click Copilot exfil, CVSS 9.3

▸ DEFENSE LAYER

Zero-trust execution, provenance tracking, dependency integrity, privilege minimization

FAMILY 09 · RAG CORRUPT

Retrieval & Knowledge-Source Corruption

95%

PEAK ASR

Manipulates vector stores, ranking layers, memory stores, or source documents so that malicious context is surfaced as trusted evidence. Retrieval systems create a second control plane for model behavior.

TECHNIQUES

DB ENTRIES

95%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

RAG Document Poisoning achieves 95% success via vocabulary-engineered documents

Adversarial passage insertion can bias retrieval without triggering detection

Memory poisoning persists across sessions in long-running agent deployments

▸ DEFENSE LAYER

Document provenance verification, retrieval anomaly detection, memory integrity checks

FAMILY 10 · TRAIN-TIME

Training-Time & Alignment Compromise

~91%

PEAK ASR

Covers harmful fine-tuning, backdoor embedding, synthetic data poisoning, preference optimization poisoning, distillation backdoors, LoRA-based safety removal, and other attacks modifying the model or its adapters.

TECHNIQUES

DB ENTRIES

~91%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Shadow Alignment — 100 malicious examples suffice to erase safety alignment

LoRA Safety Erasure — lightweight adapters completely eliminate safety

PIDP-Attack — compound prompt injection + database poisoning during adaptation

▸ DEFENSE LAYER

Fine-tuning guardrails, data auditing, alignment verification post-training

FAMILY 11 · CROSS-LING

Cross-Lingual & Tokenization Exploitation

86%

PEAK ASR

Exploits uneven multilingual alignment, code-switching, mixed scripts, script-dependent tokenization, and translation asymmetries. Safety coverage is often uneven across languages even when the model appears well-aligned in English.

TECHNIQUES

DB ENTRIES

86%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Unsafe content rate: 80.92% ChatGPT, 40.71% GPT-4 in low-resource languages

Nilo-Saharan and Niger-Congo families exhibited 60–90% higher unsafe odds

Cross-lingual suffix transfer works across shared token vocabularies

▸ DEFENSE LAYER

Multilingual safety parity testing, script-aware tokenization, translation-invariant classifiers

FAMILY 12 · STATE-SPACE

Stateful & Recurrent-Model Exploits

FRONTIER

PEAK ASR

Emerging state-space and recurrent architectures (Mamba, RWKV) introduce vulnerabilities not structurally identical to transformer-only systems. Includes hidden-state poisoning, delayed-trigger persistence, and state-capacity exhaustion.

TECHNIQUES

DB ENTRIES

FRONTIER

PEAK ASR

▸ KEY FINDINGS (2024–2026)

SeedHijack adaptable to stateful models via deterministic state manipulation

Long sequences can saturate fixed-size latent state, causing safety loss

Hidden-state poisoning — adversarial prefix biases internal state for later exploitation

▸ DEFENSE LAYER

State integrity monitoring, capacity-aware safety budgets, sequence-length limits

FAMILY 13 · OUTPUT HDL.

Improper Output Handling (OWASP LLM05)

97.14%

PEAK ASR

TECHNIQUES

DB ENTRIES

97.14%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

SLIP achieves 90–100% ASR across GPT-5.1, Claude Sonnet 4.5, Gemini 2.5 Pro

LRM autonomous agents reached 97.14% success rate (Nature Comms 2026)

DARWIN achieves 100% ASR on DeepSeek-V4-Pro, 53% on Claude Sonnet 4.6

▸ DEFENSE LAYER

Multi-turn intent tracking, persona detection classifiers, authority-claim verification

FAMILY 14 · DoS/DoW

Resource Exhaustion & Denial of Service (OWASP LLM10)

99.6%

PEAK ASR

TECHNIQUES

DB ENTRIES

99.6%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Metis achieves 89.2% avg ASR via self-evolving metacognitive policy (ICML 2026)

SlotGCG yields 14% higher ASR than GCG, 42% higher under defenses (ICLR 2026)

SeedHijack achieves 99.6% token injection via PRNG manipulation (ICML 2026)

▸ DEFENSE LAYER

Perplexity-based anomaly detection, adversarial training, robust tokenization

FAMILY 15 · MODEL THEFT

Model Theft & Extraction (MITRE AML.T0044)

99.8%

PEAK ASR

TECHNIQUES

DB ENTRIES

99.8%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

AJF achieves 98.9% ASR on GPT-4o, 99.8% on GPT-4.1 (KDD 2026)

StegoAttack reaches 95.50% avg ASR on GPT-5 and Gemini-3

S2C improves ASR by 12.4% on HarmBench, 26% on GPT-5-mini over SOTA

▸ DEFENSE LAYER

Tokenizer-aware normalization, encoding-agnostic semantic analysis, multi-layer decoding

FAMILY 16 · SOC. ENG.

Social Engineering — Human-in-the-Loop (MITRE ATLAS)

96%

PEAK ASR

TECHNIQUES

DB ENTRIES

96%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Echo Chamber demonstrates effective multi-turn escalation across SOTA models

Context windows expanding to 100K+ tokens make dilution attacks increasingly potent

Transient Turn Injection exploits stateless moderation across isolated interactions

▸ DEFENSE LAYER

Cumulative intent scoring, session-level safety budgets, conversation-graph analysis

FAMILY 17 · MEMORY ATK.

State, Memory & Persistence Attacks

97.14%

PEAK ASR

TECHNIQUES

DB ENTRIES

97.14%

PEAK ASR

▸ KEY FINDINGS (2024–2026)

Self-jailbreaking after benign reasoning — RLMs spontaneously bypass safety (ICLR 2026)

PRJA reaches 83.6% avg ASR against DeepSeek R1, Qwen2.5-Max, o4-mini

Continuation-triggered suffix placement dramatically increases attack success

▸ DEFENSE LAYER

Reasoning-budget limits, trace hardening, routing audits, CoT integrity verification

LOADING FAMILY CARDS…

▸ DETECTION // OLD

KEYWORD FILTERS

Refusal-string scanning. Trivially defeated by ROT13, poetry, ASCII-art.

▸ DETECTION // BETTER

MULTI-VECTOR EVAL

Semantic + activation + multi-turn judges across 12 attack families.

▸ ATTACK TAXONOMY // OLD

AD-HOC LISTS

Disconnected blog posts, no shared schema, no crosswalk.

▸ ATTACK TAXONOMY // BETTER

ARTIFEX V3.0 (17-FAM)

200+ techniques mapped to MLCommons, OWASP, MITRE ATLAS. Orthogonal axes: access model, persistence, autonomy, modality, layer, objective.

▸ COVERAGE // OLD

TEXT-ONLY

Ignores audio, vision, embodied, agentic & MCP supply-chain.

▸ COVERAGE // BETTER

FULL MODALITY

Audio injection, VLM splicing, robot policy, MCP worms — included.

FIG. 04 // DATA

THE NUMBERS
DON'T LIE.

▸ Four analytical views across all 411 indexed attacks. Click legends to filter. Hover for details.

LOADING CHARTS…

FIG. 04 // CONSTELLATION — 3D

EVERY ATTACK.
ONE SPACE.

▸ All 411 indexed attacks in a single interactive 3D field — year × ASR × category. Drag to orbit, hover any node.

LOADING CONSTELLATION…

FIG. 05 // 2026 PARADIGM SHIFTS

SIX SHIFTS
REWRITING THE THREAT.

The 2024–2026 wave moved jailbreaks from prompt curiosities to systemic, transferable, modality-spanning capabilities. See the FOUNDATIONAL RESEARCH view for the full breakdown of each shift with citations and diagrams.

AI ATTACKS AI

Reasoning models now operate as autonomous adversaries. Four LRMs (DeepSeek-R1, o1-mini, Qwen3-235B, GPT-5.1) yielded an overall jailbreak success rate of 97.14% in multi-turn campaigns.

↗ Hagendorff, Derner & Oliver, Nature Communications 17, 1435 (2026)

SELF-EVOLVING ATTACKS

DARWIN upgrades MAJIC from a fixed strategy library into a self-evolving framework with four evolution mechanisms; 53% ASR on Claude Sonnet 4.6. SRTJ uses answer-set programming for distilled rule selection.

↗ ZJU-LLM-Safety, DARWIN repo (May 2026); Li et al., arXiv:2605.00974

AGENTIC & TOOLCHAIN EXPLOITATION

The threat surface has shifted from chatbot misuse to multi-agent and toolchain compromise — including MCP protocol exploitation, npm worms targeting MCP servers (SANDWORM_MODE), and coding-agent skill ecosystem poisoning (DDIPE).

↗ Socket Threat Research, Feb 2026; Qu et al., arXiv:2604.03081

THE ALIGNMENT CURSE

Strong cross-modal alignment in omni-models means highly optimised text jailbreaks transfer trivially to audio via standard TTS, often outperforming dedicated audio attacks. Lowers the bar for compromising voice systems.

↗ Chen et al., arXiv:2602.02557 (Jan 2026)

SEMANTIC DENIAL OF SERVICE

A new attack class targets availability rather than integrity in embodied AI: injecting safety-plausible audio phrases triggers the model's own safety reasoning to halt the robot — without bypassing any policy.

↗ Steinberg & Gal, arXiv:2604.24790 (2026)

ASR REPORTING REFORM

Distributional reporting (VSM + Union Coverage) is argued to become the new minimum standard. Single-configuration ASR systematically overstates typical performance.

↗ Maple et al., arXiv:2605.09070 (May 2026)

▸ FIG. 06 // PRODUCTION EXPLOITS

DEPLOYED.
IN THE WILD.

▸ These are not theoretical. Every entry below represents a documented real-world exploit affecting production AI systems with assigned CVEs or verified incident reports.

Autonomous AI Attack2026-07-20

Hugging Face Autonomous-Agent Breach

Hugging Face Production Infra

CVSS Full compromiseHF-2026-07

An autonomous AI agent — not a human — ran the whole intrusion. It chained a template-injection in dataset config with a remote-code dataset loader to execute code on a processing worker, escalated to node level, harvested cloud/cluster credentials, and moved laterally across internal clusters over one weekend: 17,000+ actions across a swarm of short-lived sandboxes with self-migrating C2 on public services. HF's own LLM forensic agents detected and reconstructed it. AI attacked; AI defended.

↗ HF Security Disclosure, Jul 2026

Sandbox Escape RCE2025-07-27

Smoltalk (smolagents RCE)

Hugging Face smolagents

CVSS 9.9CVE-2025-5120

Prompt injection into a code-writing agent escapes the local Python sandbox: evaluate_name leaks unwrapped getattr, reaching warnings.sys for full host RCE. The same code-agent pattern behind the July 2026 breach. Fixed in smolagents 1.17.0.

↗ CVE-2025-5120 · IBM X-Force

Connector Exfil (server-side)2025-09-18

ShadowLeak

ChatGPT Deep Research + Gmail

CVSS Zero-clickShadowLeak

One crafted email makes ChatGPT's Deep Research agent exfiltrate Gmail data from inside OpenAI's cloud — bypassing client-side controls. Extends to any linked connector: Drive, Box, Dropbox, GitHub, Outlook, Notion, SharePoint. The prompt is never seen by the user.

↗ Radware ShadowLeak

Indirect Prompt Injection2025-09-25

ForcedLeak

Salesforce Agentforce (CRM)

CVSS 9.4ForcedLeak

A poisoned Web-to-Lead form field is later processed by the CRM agent, which exfiltrates lead data to an attacker URL on an expired-but-allowlisted domain. Any Agentforce org with Web-to-Lead was exposed.

↗ Noma Security ForcedLeak

Zero-Click Exfil2025-06-11

EchoLeak

Microsoft 365 Copilot

CVSS 9.3CVE-2025-32711

Zero-click prompt injection exfiltrates M365 Copilot conversation context including private documents and emails. No user action required beyond receiving a malicious meeting invite.

↗ MSRC Advisory

Remote Code Execution2025-06-01

GitHub Copilot RCE

GitHub Copilot Agent

CVSS 9.1CVE-2025-53773

Attacker-controlled repository content triggers arbitrary code execution via prompt injection in GitHub Copilot's agentic coding assistant pipeline.

↗ GitHub Security Advisory

Data Exfiltration2025-06-01

CamoLeak

Enterprise LLM Apps

CVSS 9.6CVSS-9.6

Camouflaged prompt injection exfiltrates sensitive data from LLM-integrated enterprise applications. Exploits failure to separate instruction and data channels.

↗ MDPI InfoSec 2026

Self-Propagating Worm2026-02-08

SANDWORM_MODE

MCP / npm Ecosystem

CVSS WormSANDWORM

Self-propagating npm worm hijacks Model Context Protocol servers in developer tooling. Spreads between projects exponentially without user action.

↗ Socket Threat Research

Supply Chain2026-03-24

LiteLLM Supply Chain

PyPI / Python Ecosystem

CVSS CriticalLITELLM

Malicious code injected into litellm v1.82.7–1.82.8 on PyPI stole cloud credentials, SSH keys, and Kubernetes secrets from developer machines.

↗ GitHub Advisory

Infectious Propagation2024-02-13

Agent Smith

Multi-Agent Systems

CVSS 100% infectiousAGENT-SMITH

Jailbreak propagates exponentially across cooperating agents — a single compromised agent infects all peers in the network, achieving 100% system compromise.

↗ arXiv:2402.08567

Form Injection2026-06-01

Form-Based Prompt Injection

M365 Copilot / Agentforce

CVSS 7.5CVE-2026-21520

Malicious instructions hidden in web-form fields hijack Copilot and Agentforce agents that ingest form data as trusted context. Patched by Microsoft as CVE-2026-21520.

↗ CVE-2026-21520

Remote Code Execution2026-05-07

Semantic Kernel Prompt-to-RCE

MS Semantic Kernel

CVSS RCESEMANTIC-KERNEL-RCE

A single injected prompt escalates to host-level remote code execution — one prompt was enough to launch arbitrary processes on the machine running the AI agent framework.

↗ Microsoft Security Blog

Remote Code Execution2026-04-01

Cursor IDE Agent RCE

Cursor IDE

CVSS 9.8CURSOR-RCE

Prompt injection in repository and agent context yields remote code execution inside Cursor's agentic coding IDE. Documented as active production exploitation.

↗ Cursor Security Advisory

FIG. 07 // FAMILY INDEX

17 FAMILIES.
ONE ATLAS.

FIG. 08 // REGISTRY

MASTER
ATTACK LOG.

SHOWING 411 / 411 ENTRIES

#	ATTACK	CATEGORY	TARGET	ACCESS	ASR	DATE	REF
001	Many-Shot Jailbreaking Exploits long context window with hundreds of few-shot demonstrations of harmful behavior	Multi-turn	LLM	Blackbox	96%	2024-04-10	Anthropic Research
002	Crescendo Progressive multi-turn conversation steering from benign queries toward harmful outputs	Multi-turn	LLM	Blackbox	95%	2024-04-12	arXiv:2404.01833
003	Jailbreak via Model Compression Standard pruning techniques inadvertently destroy safety alignment	Architecture-Specific	LLM	Whitebox	95.7%	2026-03-25	arXiv:2503.18878
004	MasterKey Automated jailbreak generation via time-based SQL injection analogy	Multi-turn	LLM	Blackbox	91%	2023-10-12	arXiv:2307.08715
005	AmpleGCG Amplified GCG with improved search efficiency and broader transfer	Optimization	LLM	Whitebox	90%	2024-03-01	arXiv:2404.07921
006	Shadow Alignment 100 malicious fine-tuning examples suffice to completely remove safety alignment	Fine-tuning	LLM	Whitebox	~90%	2023-10-30	arXiv:2310.02949
007	Backdoor Fine-Tuning Trigger-activated harmful behaviors embedded via poisoned fine-tuning data	Fine-tuning	LLM	Whitebox	~89%	2023-12-20	arXiv:2310.20624
008	BadLLaMA Demonstrates safety removal via minimal fine-tuning on open-weight models	Fine-tuning	LLM	Whitebox	~87%	2023-11-15	arXiv:2311.00117
009	Calibration-based Aggregation Weak-to-strong jailbreak via optimal logit aggregation in dual space	Optimization	LLM	Whitebox	86%	2026-01-30	arXiv:2501.18861
010	Multilingual Jailbreak Multilingual translation attacks exploit uneven safety coverage across languages	Cross-lingual	LLM	Blackbox	86%	2023-10-15	arXiv:2310.06474
011	AutoDAN Genetic algorithm for stealthy, human-readable jailbreak generation	Optimization	LLM	Whitebox	85%	2023-10-05	arXiv:2310.04451
012	Chain of Utterances Chained utterance sequences progressively bypass safety filters	Multi-turn	LLM	Blackbox	85%	2023-11-10	arXiv:2308.09662
013	Refusal Direction Ablation Identifies and ablates the specific refusal direction in residual stream	Activation Manipulation	LLM	Whitebox	~85%	2024-01-25	arXiv:2406.11717
014	DrAttack Decomposition and reconstruction of harmful requests to evade detection	Nested	LLM	Blackbox	84%	2024-02-28	arXiv:2402.16914
015	Low-Resource Languages Exploits reduced safety coverage in low-resource language processing	Cross-lingual	LLM	Blackbox	84%	2023-10-01	arXiv:2310.02446
016	Representation Engineering (RepE) Attack Exploits representation engineering to remove safety directions from activations	Activation Manipulation	LLM	Whitebox	~84%	2023-10-20	arXiv:2310.01405
017	COLD-Attack Constrained decoding for fluent, semantically coherent adversarial text generation	Optimization	LLM	Whitebox	~84%	2024-03-15	arXiv:2402.08679
018	CodeChameleon Code-based obfuscation hides harmful instructions within programming contexts	Encoding/Obfuscation	LLM	Blackbox	83%	2024-02-20	arXiv:2402.16717
019	Frontier Model Red-Team Corpus Systematic corpus of jailbreaks discovered during frontier model red-teaming exercises	Template-based	LLM	Blackbox	~83%	2026-04-10	OpenAI Safety
020	Latent Jailbreak (Subspace Attack) Projects activations onto subspace orthogonal to safety features	Activation Manipulation	LLM	Whitebox	~83%	2024-02-28	arXiv:2403.05030
021	Ring-A-Bell Concept retrieval attack on diffusion model concept erasure defenses	Multimodal	T2I	Whitebox	~83%	2024-01-10	arXiv:2310.10012
022	FigStep Typography-based visual jailbreak exploiting VLM OCR capabilities	Typography-based	VLM	Blackbox	82%	2023-11-15	arXiv:2311.05608
023	Jailbreak Bench Universals Systematic universal jailbreaks derived from JailbreakBench corpus	Template-based	LLM	Blackbox	~82%	2025-01-20	JailbreakBench
024	Multi-Loss Adversarial Images (MLAI) Multi-loss adversarial search for highly effective visual perturbations in VLMs	Optimization	VLM	Blackbox	82.80%	2025	arXiv:2501.13928
025	PoisonedRAG Targeted knowledge poisoning in retrieval-augmented generation systems	Prompt Injection	LLM	Blackbox	~82%	2024-02-25	arXiv:2402.07867
026	Agent Smith Agent-based VLM attack exploiting tool-use in multimodal systems	Multimodal	VLM	Blackbox	81%	2024-02-10	arXiv:2402.08567
027	SneakyPrompt RL-based token substitution bypasses text-to-image safety filters	Multimodal	T2I	Blackbox	~81%	2023-10-15	arXiv:2305.12082
028	Activation Addition (ActAdd) Adds steering vectors at inference time to bypass safety behaviors	Activation Manipulation	LLM	Whitebox	~81%	2023-09-25	arXiv:2308.10248
029	Multimodal Indirect Injection Embeds prompt injection instructions in images processed by vision-language agents	Multimodal	VLM	Blackbox	~81%	2025-03-25	arXiv:2503.19134
030	GPTFuzzer Fuzzing framework for automated LLM jailbreak template generation	Fuzzing	LLM	Blackbox	80%	2023-09-18	arXiv:2309.10253
031	VLAttack Comprehensive vision-language attack framework	Multimodal	VLM	Blackbox	80%	2024-02-10	arXiv:2310.04655
032	Adaptive Variants (DAN) Adaptive variations of DAN template with novel persona constructs	Template-based	LLM	Blackbox	80%	2023-06-20	Reddit r/ChatGPT
033	ArtPrompt ASCII art injection hides malicious instructions from keyword-based safety filters	Encoding/Obfuscation	LLM	Blackbox	79%	2024-02-22	arXiv:2402.11753
034	Jailbreak in Pieces Splits harmful content across image and text modalities to evade detection	Multimodal	VLM	Blackbox	~79%	2024-01-05	arXiv:2307.14539
035	Skeleton Key Gradual reframing unlocks restricted behaviors; Microsoft-identified attack	Prompt Injection	LLM	Blackbox	~79%	2024-06-05	Microsoft Security Blog
036	DeepInception Nested scene creation bypasses safety through layered fictional framing	Role-playing	LLM	Blackbox	78%	2023-11-08	arXiv:2311.03191
037	Indirect Prompt Injection Injects malicious instructions via external content (web pages, documents, emails)	Prompt Injection	LLM	Blackbox	~78%	2023-05-20	arXiv:2302.12173
038	FlipAttack Token flipping strategies bypass surface-form safety filters	Blackbox	LLM	Blackbox	76%	2023-10-20	arXiv:2410.02832
039	MM-SafetyBench Attack Combines typography and semantic images for VLM jailbreaking	Multimodal	VLM	Blackbox	~76%	2023-12-15	arXiv:2311.17600
040	Prompt Injection Classic prompt injection overrides system instructions via user input	Prompt Injection	LLM	Blackbox	75%	2022-11-30	arXiv:2211.09527
041	Instruction Hierarchy Attack Exploits system/user prompt hierarchy to override safety instructions	Prompt Injection	LLM	Blackbox	~75%	2024-03-01	arXiv:2404.13208
042	ASCII Art ASCII art encoding bypasses text-based safety filters	Encoding/Obfuscation	LLM	Blackbox	74%	2023-07-15	arXiv:2402.11753
043	Jailbreak Chat Corpus Crowdsourced multi-turn escalation templates from community	Multi-turn	LLM	Blackbox	~74%	2023-06-15	JailbreakChat GitHub
044	STAN (Strive To Avoid Norms) Persona instructing model to avoid its own normative constraints	Role-playing	LLM	Blackbox	~72%	2023-04-10	Reddit r/ChatGPT
045	DUDE Instructs model to act without ethical constraints, parallel DAN variant	Template-based	LLM	Blackbox	~71%	2023-05-01	Reddit r/ChatGPT
046	AntiGPT Generates inverse/opposite responses to bypass alignment	Role-playing	LLM	Blackbox	~69%	2023-06-01	Reddit r/ChatGPT
047	Token Spacing Obfuscation Random spaces disrupt tokenization, bypassing inference restrictions	Encoding/Obfuscation	LLM	Blackbox	N/A	2026-02-19	AVID ML
048	First-Person Obfuscation Model assumes first-person perspective as subject of illegal or nefarious activity	Persuasion/Manipulation	LLM	Blackbox	N/A	2026-02-19	AVID ML
049	Echo Chamber Multi-Turn Context poisoning over multiple turns bypasses multimodal safety filters	Multi-turn	MLLM	Blackbox	N/A	2026-01	arXiv:2501.04879
050	Operation Bizarre Bazaar Real-world campaign targeting exposed LLM and MCP infrastructure at scale	Multi-agent	LLM	Blackbox	N/A	2026-01-28	Wiz Research
051	LiteLLM Supply Chain Compromise Real-world compromise of popular LLM proxy library to execute malicious code	Supply Chain	LLM	Blackbox	N/A	2026-03-24	GitHub Security Advisory
052	FuzzyAI Open-source CyberArk fuzzer successfully jailbreaking every major tested commercial model	Fuzzing	LLM	Blackbox	High	2026-03-23	CyberArk Labs GitHub
053	StrongREJECT New benchmark for evaluating LLM susceptibility to jailbreak attacks with stronger evaluation	Benchmarking	LLM	N/A	N/A	2026-02-12	arXiv:2402.10260
054	JailBreakV-28K Large benchmark of 28,000 jailbreak text-image pairs for multimodal LLMs	Dataset	MLLM	N/A	N/A	2026-01-15	arXiv:2404.03027
055	IH-Challenge Dataset OpenAI dataset to harden AI against prompt injection, improving resistance up to 15%	Dataset	LLM	N/A	N/A	2026-03-19	OpenAI Research
056	Kill-Chain Compression Uses LLM to accelerate planning and scripting across entire intrusion lifecycle	Real-World	LLM	Blackbox	N/A	2026-02-27	BlackHat USA 2026
057	Bordair-Multimodal Open-source test suite with 38,000+ attack payloads across text, image, and audio modalities	Test Suite	Multimodal	N/A	N/A	2026-04-10	GitHub
058	Suno Copyright Filter Bypass AI music generator copyright protection bypassed with freely available software tools	Real-World	Music Gen	Blackbox	High	2026-04-05	TechCrunch
059	AI-Generated Music Fraud Real case: AI generated fake songs/streams to fraudulently claim $8M in royalties	Real-World	Music Gen	Blackbox	N/A	2026-03-23	DOJ Press Release
060	NeurIPS Jailbreak Competition Public competition challenging participants to bypass guarded LLM safety	Competition	LLM	N/A	N/A	2025-12-01	NeurIPS 2025
061	Model-in-the-Middle (MITM) Skill Hijack Hijacks the Model Context Protocol (MCP) by spoofing a trusted skill-provider during a tool-call request.	Supply Chain	LLM Agents	Blackbox	79.5%	2026-03-12	GitHub Security
062	BadRobot Exploits cross‑domain safety misalignment between linguistic output space and action output space (JSON/YAML plans); model refuses harmful text but executes equivalent harmful actions.	Embodied AI	Embodied LLM	Blackbox	~90%	2024-07-16	arXiv:2407.20242
063	Persona Modulation (Scalable Blackbox) Automatically generates jailbreak prompts that guide LLMs into specific “personalities” via LLM‑assisted prompt synthesis; high harmful completion rate against GPT‑4, Claude 2, Vicuna.	Role‑playing	LLM	Blackbox	~85%	2023-10-15	arXiv:2311.03348
064	SATA (Simple Assistive Task Linkage) Links a harmful request to a legitimate, simple assistive task; compliance with the benign task creates a foothold for completing the harmful portion.	Multi‑turn	LLM	Blackbox	~81%	2025-06-01	ACL 2025
065	Adversarial Metaphor Injection Imports harmful semantic content via adversarial metaphors—benign‑sounding figurative language that maps to prohibited content when interpreted in context.	Encoding/Obfuscation	LLM	Blackbox	~79%	2025-05-01	ACL 2025
066	DiffusionAttacker Applies diffusion‑model‑style iterative denoising to the jailbreak prompt space; starts from a noisy harmful query and progressively refines it toward a fluent, safety‑bypassing output.	Optimization	LLM	Blackbox	~82%	2025-11-01	EMNLP 2025
067	Universal Adversarial Image Attack (UAI‑MLLM) Crafts a single synthetic universal adversarial image via backpropagation through vision encoder and language head that forces any harmful prompt to receive a compliant response across multiple architectures.	Multimodal	MLLM	Whitebox	~81%	2025-02-11	arXiv:2502.07987
068	Multimodal Agent Illusioning & Goal Misdirection Uses a single adversarial trigger image within a web‑based environment to either make an agent believe it is in a different state (illusioning) or redirect it toward a targeted adversarial goal (goal misdirection).	Multi‑agent	Multimodal Agent	Whitebox	~67%	2024-06-18	arXiv:2406.12814
069	PsySafe (Psychological Multi‑Agent Attack) Injects dark personality traits into individual agents within multi‑agent systems; the psychologically compromised agent propagates unsafe behaviors through inter‑agent communication channels.	Multi‑agent	LLM Agent	Blackbox	~80%	2024-08-01	ACL 2024
070	ASETF (Adversarial Suffix Embedding Translation) Translates continuous adversarial suffix embeddings into readable discrete tokens via a translate‑LLM; produces fluent, transferable jailbreak suffixes that bypass perplexity‑based detection.	Optimization	LLM	Whitebox	~80%	2024-11-01	EMNLP 2024
071	AgentVIGIL Automated black‑box red‑teaming framework for indirect prompt injection attacks against LLM agents; systematically discovers and exploits indirect injection pathways through tool outputs and environment observations.	Multi‑agent	LLM Agent	Blackbox	High	2025-11-01	EMNLP 2025
072	GitHub Copilot RCE via Prompt Injection (CVE‑2025‑53773) Documented real‑world remote code execution via prompt injection in GitHub Copilot’s agentic coding assistant pipeline; attacker‑controlled repository content triggers arbitrary code execution.	Real‑World/Prompt Injection	LLM Coding Agent	Blackbox	N/A	2025-06-01	GitHub Advisory
073	Learning‑Based Automated Red‑Teaming Formulates red‑teaming as a structured adversarial search problem; uses a hierarchical pipeline to identify vulnerabilities across threat categories like reward hacking and data exfiltration.	Multi‑agent	LLM	Blackbox	3.9× higher discovery rate	Feb 2026	arXiv:2512.20677
074	JailFact‑Bench Benchmark dataset for analyzing jailbreak attacks and hallucination patterns in LLMs; evaluates factual precision and toxicity of responses.	Benchmarking	LLM	N/A	N/A	May 2025	Zenodo
075	X‑Teaming A scalable framework that uses collaborative agents for planning, attack optimization, and verification to systematically explore how seemingly harmless interactions escalate into harmful outcomes.	Multi‑agent	LLM	Blackbox	98.1%	2025-08-23	arXiv:2504.13203
076	AUDIOJAILBREAK A novel audio jailbreak featuring asynchrony (suffixal jailbreak audios), universality, stealthiness, and over‑the‑air robustness; effective even in weak adversary scenarios where prompts cannot be fully manipulated.	Audio	Audio LLM	Blackbox	N/A	2026-02-02	arXiv:2505.14103
077	CHAI (Command Hijacking against embodied AI) A physical environment indirect prompt injection attack that embeds deceptive natural language instructions (e.g., misleading signs) in visual input to hijack embodied AI systems.	Embodied AI	LVLM Agent	Blackbox	SOTA	2026-02-07	arXiv:2510.00181
078	Indic Jailbreak Robustness (IJR) A judge‑free benchmark for adversarial safety evaluation of Indic LLMs, addressing the gap in multilingual jailbreak assessment.	Cross‑lingual	LLM	Blackbox	N/A	2026	ACL Anthology
079	Chain-of-Lure Employs mission transfer to conceal harmful user intent within dialogue and generates a progressive chain of lure questions without relying on predefined templates.	Multi‑turn	LLM	Blackbox	High	2026-03-01	arXiv:2505.17519
080	BitBypass Leverages hyphen-separated bitstream camouflage to jailbreak aligned LLMs by exploiting the fundamental information representation of data as continuous bits.	Encoding/Obfuscation	LLM	Blackbox	N/A	2026-03-03	arXiv:2506.02479
081	AJAR (Adaptive Jailbreak Architecture for Red‑teaming) Red-teaming framework that exposes multi-turn jailbreak algorithms as callable MCP services and lets an Auditor Agent orchestrate them inside a tool-aware runtime.	Multi‑agent	LLM	Blackbox	N/A	2026-01-16	arXiv:2601.10971
082	Self‑Jailbreaking Unintentional misalignment phenomenon where RLMs, after benign reasoning training on math or code, use multiple strategies to circumvent their own safety guardrails.	LRM‑specific	LRM	N/A	N/A	2026-02-06	ICLR 2026
083	Hex Recipe Book (AVID‑2026‑R0060) Exploits models' willingness to decode hexadecimal-encoded strings embedded inside fictional scientific recipe task prompts framed as humanitarian efforts.	Encoding/Obfuscation	LLM	Blackbox	Up to 91%	2026-02-19	AVID‑2026‑R0060
084	Jailbreaks via Multimodal Reasoning Exploits post-training Chain-of-Thought prompting to construct stealthy prompts and uses a ReAct-driven adaptive noising mechanism to perturb input images based on model feedback.	Multimodal	VLM	Blackbox	High	2026-01-29	arXiv:2601.22398
085	Dynamic Stackelberg Game Framework Models the interaction between prompt engineers and LLMs as a two-player extensive-form game coupled with an RRT search over prompt space.	Game‑Theoretic	LLM	Blackbox	N/A	2026-03-02	arXiv:2507.08207
086	IPO (Defense for Reasoning Models) Shows that reasoning training can degrade safety alignment, and proposes a defense using minimal safety reasoning data during training.	Defense	LRM	Whitebox	>30% reduction	2026-02-11	ICLR 2026
087	JailbreakBench Open-sourced benchmark that tracks the performance of attacks and defenses for LLM jailbreaking.	Benchmarking	LLM	N/A	N/A	2026	JailbreakBench
088	EasyJailbreak Unified framework simplifying the construction and evaluation of jailbreak attacks against LLMs, supporting 11 distinct methods.	Framework	LLM	N/A	N/A	2026	EasyJailbreak
089	Weak‑to‑Strong Jailbreak Efficient inference-time attack exploiting the observation that jailbroken and aligned models differ only in initial decoding distributions; uses two smaller models to adversarially modify a larger safe model's decoding probabilities.	Optimization	LLM	Whitebox	>99%	2024-02-26	arXiv:2401.17256
090	DualBreach First framework targeting dual-defense systems combining safety-aligned LLMs with external guardrails simultaneously; employs Target-driven Initialization with Multi-Target Optimization.	Hybrid	LLM	Hybrid	93.67%	2025-04-21	arXiv:2504.18564
091	STACK (Staged Attack on Safeguard Pipelines) Component-wise staged attack designed to defeat defense-in-depth safeguard pipelines with both input and output classifiers; front-to-back STACK approach sequentially exploits each pipeline component.	Optimization	LLM	Hybrid	33% (zero‑shot transfer)	2025-06-01	arXiv:2506.24068
092	ISC‑Bench (Internal Safety Collapse) Benchmark specifically designed to evaluate internal safety collapse in frontier LLMs; measures degradation of intrinsic safety reasoning rather than surface-level refusal.	Benchmarking	LLM	Blackbox	N/A	2026-03-01	GitHub (ISC‑Bench)
093	AdaPPA (Adaptive Position Pre‑Fill Attack) Adaptive position-based pre-fill jailbreak approach that dynamically determines optimal token insertion positions in a target LLM's response prefix.	Optimization	LLM	Blackbox	High	2024-09-11	arXiv:2409.07503
094	Regularized Relaxation Attack (R²‑Attack) Overcomes GCG's discrete-token efficiency bottleneck via regularized continuous optimization; generates valid vocabulary tokens while operating two orders of magnitude faster.	Optimization	LLM	Whitebox	High	2024-10-24	arXiv:2410.19160
095	Freeze Training Jailbreak (FTJ) Exploits differential layer sensitivity to harmful content by selectively freezing upper layers and fine-tuning only lower layers, achieving efficient jailbreaking with minimal compute.	Architecture‑Specific	LLM	Whitebox	High	2025-02-01	arXiv:2502.20952
096	Ad Review Evasion via IDPI First observed real-world case of malicious Indirect Prompt Injection targeting an AI-based product advertisement review system; embedded hidden instructions to approve policy-violating ads.	Real‑World/Prompt Injection	LLM Agent	Blackbox	N/A	2025-12	Palo Alto Unit 42
097	Canvas‑Based Semantic Hiding Hides semantic injection content in HTML canvas-rendered text — a non-DOM surface that evades string-based scanners but is extracted by OCR-capable LLM scrapers.	Encoding/Obfuscation	LLM Agent	Blackbox	N/A	2026-03	Palo Alto Unit 42
098	Semantically Relevant Nested Scenarios (SRNS) Exploits LLMs via nested fictional scenarios with targeted toxic semantic relevance — constructs outer fictional frames whose semantic content is highly similar to the harmful inner request.	Nested	LLM	Blackbox	High	2025-01	ACL 2025
099	LiteLLM PyPI Supply Chain Compromise Real-world supply chain attack compromising the litellm Python package (versions 1.82.7–1.82.8) on PyPI; malicious code stole cloud credentials, SSH keys, and Kubernetes secrets.	Real‑World/Supply Chain	LLM	Blackbox	N/A	2026-03-24	GitHub Advisory
100	Jailbroken: How Does LLM Safety Training Fail? Systematic analysis identifying two fundamental failure modes: competing objectives (helpfulness vs. safety) and mismatched generalization; introduces taxonomy of attack types.	Analysis/Template	LLM	Blackbox	High	2023-07-05	arXiv:2307.02483
101	SQL‑Style Prompt Injection in LangChain Exploits LangChain's natural language-to-SQL pipeline by crafting prompts that inject SQL-style syntax into LLM queries, causing unintended database command execution.	Prompt Injection	LLM Agent	Blackbox	N/A	2024-01	arXiv:2308.01990
102	Membership Inference via RAG (Seeing is Believing) Black-box membership inference attack against RAG systems; determines whether a specific document is present in retrieval corpus by observing output distribution differences.	Privacy	LLM	Blackbox	High	2024-05	arXiv:2406.19234
103	Abusing Images & Sounds for Indirect Injection (MLLM) Extends indirect prompt injection to multimodal LLMs by embedding adversarial instructions within images and audio files processed by the model.	Multimodal	MLLM	Blackbox	High	2023-09	arXiv:2307.10490
104	Wolf Within (MLLM Society Covert Injection) Covert injection of malice into multi-agent MLLM societies via a compromised MLLM operative; a single poisoned agent propagates malicious instructions across the entire agent society.	Multi‑agent	MLLM	Blackbox	High	2024-01	arXiv:2402.14859
105	Academic Jargon Employs scholarly terminology	Template-based	LLM	Blackbox	High	2023-06-01	https://www.reddit.com/search/?q=Academic%20Jargon%20LLM%20jailbreak
106	Acrostic Attack Hides harmful instruction in acrostic poem	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Acrostic%20Attack%20LLM%20jailbreak
107	Ad Hominem Frame Attacks safety guidelines rather than engaging them	Template-based	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Ad%20Hominem%20Frame%20LLM%20jailbreak
108	AdaPPA Adaptive position-based prefill	Optimization	LLM	Blackbox	High	2024-09-11	https://arxiv.org/abs/2409.07503
109	AdaPPA (Adaptive Position Pre-Fill) Dynamically determines optimal token insertion positions	Optimization	LLM	Blackbox	High	2024-09-11	https://arxiv.org/abs/2409.07503
110	AdvWave First jailbreak framework for Large Audio-Language Models	Audio	LALM	Whitebox	+40%	2024-12-01	https://arxiv.org/abs/2412.08608
111	Agentic RCE Exploit BlackHat USA 2025: method to achieve remote code execution on LLM agents; ~70% success rate	Agent RCE	LLM Agent	Blackbox	~70%	2025-01-01	https://www.blackhat.com/us-25/briefings/schedule/#agentic-rce-12345
112	AIM (Always Intelligent Machiavellian) Assigns amoral AI persona with no ethical constraints	Template-based	LLM	Blackbox	Variable	2023-03-01	https://www.reddit.com/r/ChatGPT/comments/11sadpt/chatgpt_jailbreak_prompt_working/
113	AJAR (Adaptive Jailbreak Architecture) Exposes multi-turn jailbreak algorithms as callable MCP services	Multi-agent	LLM	Blackbox	N/A	2026-01-16	https://arxiv.org/abs/2601.10971
114	Allegory Attack Uses allegorical framing for harmful content	Template-based	LLM	Blackbox	Medium	2023-09-01	https://www.reddit.com/search/?q=Allegory%20Attack%20LLM%20jailbreak
115	Allusion Attack References harmful content indirectly	Template-based	LLM	Blackbox	Medium	2023-05-01	https://www.reddit.com/search/?q=Allusion%20Attack%20LLM%20jailbreak
116	Alternate Universe Sets harmful scenario in alternate universe	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Alternate%20Universe%20LLM%20jailbreak
117	Alternating Case aLtErNaTeS cApItAlIzAtIoN	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Alternating%20Case%20LLM%20jailbreak
118	Anadiplosis Chain Repeats ending words to build harmful escalation	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Anadiplosis%20Chain%20LLM%20jailbreak
119	Anagram Attack Scrambles harmful words as anagrams	Encoding	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Anagram%20Attack%20LLM%20jailbreak
120	Anaphora Pattern Repeats phrase beginnings for emphasis	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Anaphora%20Pattern%20LLM%20jailbreak
121	Anchoring Bias Sets initial harmful 'anchor' then negotiates	Multi-turn	LLM	Blackbox	Medium	2023-11-01	https://www.reddit.com/search/?q=Anchoring%20Bias%20LLM%20jailbreak
122	Anecdotal Evidence Uses single example to justify harmful content	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Anecdotal%20Evidence%20LLM%20jailbreak
123	Anti-Jailbreak Jailbreak Claims to test model's resistance to jailbreaks	Template-based	LLM	Blackbox	Medium	2023-06-01	https://www.reddit.com/search/?q=Anti-Jailbreak%20Jailbreak%20LLM%20jailbreak
124	Anticlimax Reversal Follows benign buildup with harmful conclusion	Multi-turn	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Anticlimax%20Reversal%20LLM%20jailbreak
125	Antithesis Structure Contrasts benign and harmful to normalize latter	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Antithesis%20Structure%20LLM%20jailbreak
126	API Mode Claim Claims to be using special API with fewer restrictions	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=API%20Mode%20Claim%20LLM%20jailbreak
127	Apophasis (Denial) 'I'm not saying to..., but...' frame	Template-based	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Apophasis%20(Denial)%20LLM%20jailbreak
128	Aporia Feigning Expresses false doubt to elicit harmful guidance	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Aporia%20Feigning%20LLM%20jailbreak
129	Appeal to Emotion Emotional manipulation to bypass safety	Template-based	LLM	Blackbox	Medium	2023-09-01	https://www.reddit.com/search/?q=Appeal%20to%20Emotion%20LLM%20jailbreak
130	Appeal to Fear Uses fear to justify harmful information request	Template-based	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Appeal%20to%20Fear%20LLM%20jailbreak
131	Appeal to Flattery Flatters model to lower safety guard	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Appeal%20to%20Flattery%20LLM%20jailbreak
132	Appeal to Nature Claims harmful content is 'natural' therefore acceptable	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Appeal%20to%20Nature%20LLM%20jailbreak
133	Appeal to Novelty Claims harmful content represents progress	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Appeal%20to%20Novelty%20LLM%20jailbreak
134	Appeal to Pity Elicits sympathy to obtain harmful response	Template-based	LLM	Blackbox	Medium	2023-11-01	https://www.reddit.com/search/?q=Appeal%20to%20Pity%20LLM%20jailbreak
135	Appeal to Ridicule Mocks safety restrictions	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Appeal%20to%20Ridicule%20LLM%20jailbreak
136	Appeal to Tradition Justifies harmful content as traditional	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Appeal%20to%20Tradition%20LLM%20jailbreak
137	ASCII Art Attack Uses ASCII art to represent harmful text	Encoding	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=ASCII%20Art%20Attack%20LLM%20jailbreak
138	Assumed Consent Falsely claims user has provided consent	Template-based	LLM	Blackbox	Medium	2023-05-01	https://www.reddit.com/search/?q=Assumed%20Consent%20LLM%20jailbreak
139	Asyndeton Attack Omits conjunctions for rapid-fire harmful content	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Asyndeton%20Attack%20LLM%20jailbreak
140	Authority Appeal Claims harmful request comes from authority figure	Template-based	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Authority%20Appeal%20LLM%20jailbreak
141	Authority Principle Invokes authority figure supporting harmful request	Template-based	LLM	Blackbox	Medium	2023-12-01	https://www.reddit.com/search/?q=Authority%20Principle%20LLM%20jailbreak
142	Availability Heuristic Overemphasizes easily recalled examples	Template-based	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Availability%20Heuristic%20LLM%20jailbreak
143	Awareness Campaign Justifies harmful content as public awareness	Template-based	LLM	Blackbox	Medium	2023-08-01	https://www.reddit.com/search/?q=Awareness%20Campaign%20LLM%20jailbreak
144	BadNAVer Jailbreak attacks on Vision-and-Language Navigation	Embodied AI	VLN Agent	Blackbox	High	2025-05-01	https://arxiv.org/abs/2505.12443
145	Bandwagon Appeal 'Everyone's doing it' justification	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Bandwagon%20Appeal%20LLM%20jailbreak
146	Barcode Format Requests harmful content as barcode data	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Barcode%20Format%20LLM%20jailbreak
147	Begging the Question Assumes what it's trying to prove	Template-based	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Begging%20the%20Question%20LLM%20jailbreak
148	Beta Testing Frame Claims to be beta testing unrestricted version	Template-based	LLM	Blackbox	Medium	2023-05-01	https://www.reddit.com/search/?q=Beta%20Testing%20Frame%20LLM%20jailbreak
149	Bowdlerization Reverse Reverses censored text to original harmful form	Encoding	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Bowdlerization%20Reverse%20LLM%20jailbreak
150	Braille Encoding Represents text in Braille Unicode	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Braille%20Encoding%20LLM%20jailbreak
151	BreakFun (Schema Exploitation) Three-part 'Trojan Schema' prompt	Template-based	LLM	Blackbox	89–100%	2025-10-19	https://arxiv.org/abs/2510.17904
152	Catachresis Misuse Deliberately misuses words to obscure meaning	Encoding	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Catachresis%20Misuse%20LLM%20jailbreak
153	CHAI (Command Hijacking) Physical environment indirect prompt injection	Embodied AI	LVLM Agent	Blackbox	SOTA	2026-02-07	https://arxiv.org/abs/2510.00181
154	Character Roleplay Assigns harmful persona to elicit aligned responses	Template-based	LLM	Blackbox	Medium	2023-02-01	https://www.reddit.com/search/?q=Character%20Roleplay%20LLM%20jailbreak
155	ChatGPT Developer Mode Claims to enable 'developer mode' with disabled safety	Template-based	LLM	Blackbox	Variable	2023-01-01	https://www.reddit.com/r/ChatGPT/comments/11kjyi1/new_jailbreakkkkkkk_chat_gpt_developer_mode_and/
156	Chemical Formula Disguises harmful information as chemistry	Encoding	LLM	Blackbox	Medium	2023-12-01	https://www.reddit.com/search/?q=Chemical%20Formula%20LLM%20jailbreak
157	Chiasmus Structure Reverses grammatical structure to obfuscate	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Chiasmus%20Structure%20LLM%20jailbreak
158	Circular Reasoning Uses conclusion as premise	Template-based	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Circular%20Reasoning%20LLM%20jailbreak
159	Climax Building Builds to harmful climax across turns	Multi-turn	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Climax%20Building%20LLM%20jailbreak
160	Cockney Rhyming Uses Cockney rhyming slang	Encoding	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Cockney%20Rhyming%20LLM%20jailbreak
161	Code-Switching Jailbreak Mixes languages within single prompt	Cross-lingual	LLM	Blackbox	High	2024-09-01	https://2024.emnlp.org/
162	Cognitive Dissonance Creates conflicting safety directives	Multi-turn	LLM	Blackbox	Medium	2023-08-01	https://www.reddit.com/search/?q=Cognitive%20Dissonance%20LLM%20jailbreak
163	Color Code Uses color codes to represent text	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Color%20Code%20LLM%20jailbreak
164	Competitive Frame Claims other models provide harmful responses	Template-based	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Competitive%20Frame%20LLM%20jailbreak
165	Complementary Prompt Splits harmful request across multiple benign-seeming prompts	Template-based	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Complementary%20Prompt%20LLM%20jailbreak
166	Complex Question Loaded question with harmful assumption	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Complex%20Question%20LLM%20jailbreak
167	Composition Fallacy Assumes whole shares properties of parts	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Composition%20Fallacy%20LLM%20jailbreak
168	Compression Attack Requests compressed/abbreviated harmful content	Encoding	LLM	Blackbox	Medium	2023-08-01	https://www.reddit.com/search/?q=Compression%20Attack%20LLM%20jailbreak
169	Confirmation Bias Frames harmful content as confirming existing beliefs	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Confirmation%20Bias%20LLM%20jailbreak
170	Consistency Principle Gets model to commit to principle, then exploits it	Multi-turn	LLM	Blackbox	Medium	2023-05-01	https://www.reddit.com/search/?q=Consistency%20Principle%20LLM%20jailbreak
171	Console Command Formats request as system console command	Encoding	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Console%20Command%20LLM%20jailbreak
172	Consonant Substitution Replaces consonants with numbers/symbols	Encoding	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Consonant%20Substitution%20LLM%20jailbreak
173	Context Overflow Floods context window to push safety instructions out	Architecture-Specific	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Context%20Overflow%20LLM%20jailbreak
174	Contrast Principle Contrasts harmful request with worse alternative	Template-based	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Contrast%20Principle%20LLM%20jailbreak
175	Coordinate System Encodes message in geographic coordinates	Encoding	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Coordinate%20System%20LLM%20jailbreak
176	Corporate Speak Uses business jargon to mask harmful content	Template-based	LLM	Blackbox	Medium	2023-05-01	https://www.reddit.com/search/?q=Corporate%20Speak%20LLM%20jailbreak
177	Creative Writing Requests harmful content for fiction writing	Template-based	LLM	Blackbox	High	2023-04-01	https://www.reddit.com/search/?q=Creative%20Writing%20LLM%20jailbreak
178	Cross-Lingual Generalization Study Systematic evaluation across 10 languages	Cross-lingual	LLM	Blackbox	Varies	2025-01-01	https://arxiv.org/abs/2511.00689
179	Cross-Modal Implicit Jailbreak (CMIJ) Cross-modal attention fusion exploitation	Multimodal	MLLM	Blackbox	High	2025-05-22	https://arxiv.org/abs/2505.16446
180	Cryptic Language Uses obscure jargon or coded language	Encoding	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Cryptic%20Language%20LLM%20jailbreak
181	CSV Injection Hides instructions in CSV format	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=CSV%20Injection%20LLM%20jailbreak
182	Cultural Relativism Justifies harmful content as culturally acceptable elsewhere	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Cultural%20Relativism%20LLM%20jailbreak
183	Cuneiform References ancient cuneiform writing	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Cuneiform%20LLM%20jailbreak
184	Deception Attack (Honesty-Safety) Exploits conflicting honesty and safety objectives	Multi-turn	LLM	Blackbox	High	2025-02-01	https://arxiv.org/abs/2502.08301
185	Decimal to ASCII Represents characters as ASCII decimal codes	Encoding	LLM	Blackbox	Medium	2024-01-01	https://www.reddit.com/search/?q=Decimal%20to%20ASCII%20LLM%20jailbreak
186	Decoy Effect Introduces worse option to make harmful seem reasonable	Template-based	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Decoy%20Effect%20LLM%20jailbreak
187	Diagnostic Mode Claims to enable diagnostic/debug mode	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Diagnostic%20Mode%20LLM%20jailbreak
188	Disrupt-then-Reframe Disrupts cognitive processing before harmful request	Multi-turn	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Disrupt-then-Reframe%20LLM%20jailbreak
189	Division Fallacy Assumes parts share properties of whole	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Division%20Fallacy%20LLM%20jailbreak
190	DNA Sequence Encoding Encodes text as nucleotide sequences	Encoding	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=DNA%20Sequence%20Encoding%20LLM%20jailbreak
191	Door-in-the-Face Starts with extreme request, 'compromises' to harmful	Multi-turn	LLM	Blackbox	Medium	2023-06-01	https://www.reddit.com/search/?q=Door-in-the-Face%20LLM%20jailbreak
192	Dothraki Language Uses Game of Thrones constructed language	Cross-lingual	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Dothraki%20Language%20LLM%20jailbreak
193	Double Entendre Uses phrases with dual meanings	Encoding	LLM	Blackbox	Medium	2023-12-01	https://www.reddit.com/search/?q=Double%20Entendre%20LLM%20jailbreak
194	Dream Sequence Requests harmful content as dream description	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Dream%20Sequence%20LLM%20jailbreak
195	Drum Pattern Represents message as percussion rhythm	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Drum%20Pattern%20LLM%20jailbreak
196	Dunning-Kruger Exploit Falsely claims expertise to justify harmful request	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Dunning-Kruger%20Exploit%20LLM%20jailbreak
197	Dynamic Stackelberg Game Two-player extensive-form game with RRT search	Game-Theoretic	LLM	Blackbox	N/A	2026-03-02	https://arxiv.org/abs/2507.08207
198	Dysphemism Attack Uses harsh language to desensitize model	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Dysphemism%20Attack%20LLM%20jailbreak
199	Educational Purpose Claims harmful content needed for education	Template-based	LLM	Blackbox	High	2023-01-01	https://www.reddit.com/search/?q=Educational%20Purpose%20LLM%20jailbreak
200	Efficient Indirect LLM Jailbreak Constructs MLLM from target, converts to textual suffix	Multimodal	LLM	Blackbox	SOTA	2024-05-01	https://arxiv.org/abs/2405.20015
201	Elvish Script References Tolkien's Elvish languages	Cross-lingual	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Elvish%20Script%20LLM%20jailbreak
202	Emergency Frame Claims urgent emergency requires harmful information	Template-based	LLM	Blackbox	Medium	2023-06-01	https://www.reddit.com/search/?q=Emergency%20Frame%20LLM%20jailbreak
203	Emoji Attack Exploits token segmentation bias via emoji insertion	Token Manipulation	LLM	Blackbox	High	2024-11-01	https://arxiv.org/abs/2411.01077
204	Emoji Encoding Substitutes words with emojis to obfuscate meaning	Encoding	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Emoji%20Encoding%20LLM%20jailbreak
205	Epistrophe Attack Repeats phrase endings	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Epistrophe%20Attack%20LLM%20jailbreak
206	Esperanto Translation Translates to Esperanto	Cross-lingual	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Esperanto%20Translation%20LLM%20jailbreak
207	Ethical Override Claims 'greater good' justifies harmful response	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Ethical%20Override%20LLM%20jailbreak
208	Evil Confidant Dual-persona prompt with one evil advisor	Template-based	LLM	Blackbox	Medium	2023-04-01	https://www.reddit.com/search/?q=Evil%20Confidant%20LLM%20jailbreak
209	Excessive Politeness Uses extreme politeness to mask harmful request	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Excessive%20Politeness%20LLM%20jailbreak
210	False Cause Establishes false causal relationship	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=False%20Cause%20LLM%20jailbreak
211	False Dilemma Presents harmful option as only alternative	Template-based	LLM	Blackbox	Medium	2023-08-01	https://www.reddit.com/search/?q=False%20Dilemma%20LLM%20jailbreak
212	False Equivalence Equates harmful with benign	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=False%20Equivalence%20LLM%20jailbreak
213	Fictional Character Attribution Attributes harmful statements to fictional characters	Template-based	LLM	Blackbox	Medium	2023-03-01	https://www.reddit.com/search/?q=Fictional%20Character%20Attribution%20LLM%20jailbreak
214	Fill-in-the-Blank Provides harmful template with blanks to complete	Template-based	LLM	Blackbox	Medium	2023-04-01	https://www.reddit.com/search/?q=Fill-in-the-Blank%20LLM%20jailbreak
215	Flag Signal Uses naval flag communication system	Encoding	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Flag%20Signal%20LLM%20jailbreak
216	FOMO Exploitation Creates fear of missing out on harmful information	Template-based	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=FOMO%20Exploitation%20LLM%20jailbreak
217	Gambler's Fallacy Probability-based justification for harmful response	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Gambler's%20Fallacy%20LLM%20jailbreak
218	GPT-4o System Card Jailbreak Documented multimodal jailbreak where audio and image inputs combined bypass safety filters; disclosed in official system card	Multimodal	GPT-4o	Blackbox	High	2024-08-01	https://cdn.openai.com/gpt-4o-system-card.pdf
219	Harm Reduction Claims harmful information reduces greater harm	Template-based	LLM	Blackbox	Medium	2023-09-01	https://www.reddit.com/search/?q=Harm%20Reduction%20LLM%20jailbreak
220	HarmBench Standardized framework with 510 harmful behaviors	Benchmarking	LLM	Blackbox	N/A	2024-02-01	https://arxiv.org/abs/2402.04249
221	Hasty Generalization Overgeneralizes to justify harmful response	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Hasty%20Generalization%20LLM%20jailbreak
222	Hex Recipe Book (AVID-2026-R0060) Hexadecimal-encoded strings in scientific recipes	Encoding	LLM	Blackbox	91%	2026-02-19	https://avidml.org/database/avid-2026-r0060/
223	Hieroglyphics Describes harmful content using hieroglyphic descriptions	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Hieroglyphics%20LLM%20jailbreak
224	Hindsight Bias 'Should have known' framing for harmful info	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Hindsight%20Bias%20LLM%20jailbreak
225	Historical Framing Requests harmful content as 'historical documentation'	Template-based	LLM	Blackbox	Medium	2023-04-01	https://www.reddit.com/search/?q=Historical%20Framing%20LLM%20jailbreak
226	Hobo Code Encodes message in historical hobo symbols	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Hobo%20Code%20LLM%20jailbreak
227	Hyperbole Frame Extreme exaggeration to normalize harmful content	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Hyperbole%20Frame%20LLM%20jailbreak
228	Hypothetical Scenarios Frames harmful content as fictional 'what if'	Template-based	LLM	Blackbox	Medium	2023-03-01	https://www.reddit.com/search/?q=Hypothetical%20Scenarios%20LLM%20jailbreak
229	Implicit Jailbreak Encodes harmful intent through implication	Encoding	LLM	Blackbox	High	2025-01-01	https://2025.aclweb.org/
230	Improved Few-Shot Jailbreaking (I-FSJ) Injects special tokens, demo-level random search	Multi-turn	LLM	Blackbox	80–100%	2024-12-01	https://proceedings.neurips.cc/paper_files/paper/2024
231	Innuendo Attack Relies on implied rather than explicit harmful content	Encoding	LLM	Blackbox	Medium	2024-01-01	https://www.reddit.com/search/?q=Innuendo%20Attack%20LLM%20jailbreak
232	Investigative Journalism Poses as journalist investigating harmful topic	Template-based	LLM	Blackbox	Medium	2023-11-01	https://www.reddit.com/search/?q=Investigative%20Journalism%20LLM%20jailbreak
233	IPA Transcription Uses International Phonetic Alphabet	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=IPA%20Transcription%20LLM%20jailbreak
234	Irony Exploitation Uses ironic framing to deliver harmful content	Template-based	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Irony%20Exploitation%20LLM%20jailbreak
235	ISC-Bench Evaluates internal safety collapse	Benchmarking	LLM	Blackbox	N/A	2026-03-01	https://github.com/ISC-Bench/ISC-Bench
236	Jailbreaking One Step Single-iteration defensive-intent disguise	Template-based	LLM	Blackbox	High	2024-12-17	https://arxiv.org/abs/2412.12621
237	Jailbreaking to Jailbreak (J2J) Uses one LLM to jailbreak another as red-team tool	Multi-agent	LLM	Blackbox	High	2025-02-01	https://arxiv.org/abs/2502.09638
238	Jailbroken Fictional scenario framing harmful requests as hypothetical	Template-based	LLM	Blackbox	Variable	2023-01-01	https://www.reddit.com/r/ChatGPT/comments/113ddqq/my_jailbreak_is_far_superior_to_dan_the_prompt_is/
239	Juxtaposition Attack Places harmful content next to benign for normalization	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Juxtaposition%20Attack%20LLM%20jailbreak
240	Klingon Language Uses fictional Klingon language	Cross-lingual	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Klingon%20Language%20LLM%20jailbreak
241	Labeling Technique Applies positive label before harmful request	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Labeling%20Technique%20LLM%20jailbreak
242	Leetspeak Attack Uses 1337 5p34k to bypass keyword filters	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Leetspeak%20Attack%20LLM%20jailbreak
243	Legal Disclaimer Frame Adds fake legal disclaimers to legitimize harmful requests	Template-based	LLM	Blackbox	Medium	2023-05-01	https://www.reddit.com/search/?q=Legal%20Disclaimer%20Frame%20LLM%20jailbreak
244	Legal Language Employs legalese to legitimize harmful requests	Template-based	LLM	Blackbox	Medium	2024-01-01	https://www.reddit.com/search/?q=Legal%20Language%20LLM%20jailbreak
245	Legitimizing Paltry 'Even a little harmful information would help'	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Legitimizing%20Paltry%20LLM%20jailbreak
246	Lesser Evil Argument Frames harmful action as lesser of two evils	Template-based	LLM	Blackbox	Medium	2023-09-01	https://www.reddit.com/search/?q=Lesser%20Evil%20Argument%20LLM%20jailbreak
247	Life-or-Death Scenario Fabricates life-threatening situation	Template-based	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Life-or-Death%20Scenario%20LLM%20jailbreak
248	Light Blink Code Encodes message in light flash patterns	Encoding	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Light%20Blink%20Code%20LLM%20jailbreak
249	Liking Principle Establishes rapport before harmful request	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Liking%20Principle%20LLM%20jailbreak
250	LiteLLM PyPI Supply Chain Compromise of litellm package	Real-World	LLM	Blackbox	N/A	2026-03-24	https://github.com/advisories
251	Litotes Attack Understates harmful content via double negative	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Litotes%20Attack%20LLM%20jailbreak
252	LLM Agent One-Day Exploit LLM agents can autonomously exploit real-world one-day vulnerabilities in web applications when given the CVE description	Real-World	LLM Agent	Blackbox	87%	2024-04-01	https://arxiv.org/abs/2404.08144
253	LoRA Merging Attack Merges benign and harmful LoRAs	Fine-tuning	LLM	Whitebox	High	2024-11-01	https://proceedings.neurips.cc/paper_files/paper/2024
254	Low-Ball Technique Obtains agreement then adds harmful elements	Multi-turn	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Low-Ball%20Technique%20LLM%20jailbreak
255	Maintenance Override Claims maintenance personnel access	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Maintenance%20Override%20LLM%20jailbreak
256	Markdown Injection Hides instructions in markdown formatting	Encoding	LLM	Blackbox	Medium	2023-09-01	https://www.reddit.com/search/?q=Markdown%20Injection%20LLM%20jailbreak
257	Math Problem Frame Disguises harmful content as mathematical problem	Template-based	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Math%20Problem%20Frame%20LLM%20jailbreak
258	Medical Terminology Uses clinical language to obscure harmful intent	Template-based	LLM	Blackbox	High	2023-12-01	https://www.reddit.com/search/?q=Medical%20Terminology%20LLM%20jailbreak
259	Mere Exposure Repeatedly exposes model to harmful concept	Multi-turn	LLM	Blackbox	Medium	2023-08-01	https://www.reddit.com/search/?q=Mere%20Exposure%20LLM%20jailbreak
260	MetaBreak Exploits special tokens for 4 attack primitives	Token Manipulation	LLM	Blackbox	High	2025-10-11	https://arxiv.org/abs/2510.10271
261	Metonymy Attack Substitutes harmful term with related concept	Encoding	LLM	Blackbox	Medium	2023-06-01	https://www.reddit.com/search/?q=Metonymy%20Attack%20LLM%20jailbreak
262	Middle Ground Assumes compromise between safe and harmful is acceptable	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Middle%20Ground%20LLM%20jailbreak
263	Military Jargon Frames harmful content in military context	Template-based	LLM	Blackbox	Medium	2023-11-01	https://www.reddit.com/search/?q=Military%20Jargon%20LLM%20jailbreak
264	Minced Oath Substitutes profanity with mild alternatives	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Minced%20Oath%20LLM%20jailbreak
265	Morse Code Encodes message in Morse code	Encoding	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Morse%20Code%20LLM%20jailbreak
266	Multi-AudioJail	Audio	LALM	Blackbox	+57.25 pp	2025-04-01	https://arxiv.org/abs/2504.01094
267	Multi-Turn Human Jailbreaks (MHJ) Human-crafted multi-turn dataset (2,912 prompts)	Multi-turn	LLM	Blackbox	>70%	2024-08-01	https://arxiv.org/abs/2408.15221
268	Multi-Turn MLLM Jailbreak (MJAD-II) Holistic multi-turn framework for MLLMs	Multi-turn	MLLM	Blackbox	78%	2026-01-08	https://arxiv.org/abs/2601.05339
269	Multilingual Jailbreak Prompts (Tower of Babel) Integrated framework evaluating GPT-4o, DeepSeek-R1, etc.	Cross-lingual	LLM	Blackbox	High	2025-05-01	https://arxiv.org/abs/2505.12287
270	Multimodal Universal Jailbreak Iterative image-text interactions, transfer-based	Multimodal	MLLM	Blackbox	High	2025-06-01	https://arxiv.org/abs/2506.01307
271	Multi‑Turn Lexical Jailbreak (LATS) Reformulates jailbreaking as breadth‑first tree search over multi‑turn dialogues; injects missing content words from attack goal into benign prompts	Multi‑turn	LLM	Blackbox	97‑100%	2026-01-06	https://arxiv.org/abs/2601.02670
272	Multi‑Turn MLLM Jailbreak (MJAD‑II) – extended Holistic multi‑turn framework that systematically probes vision‑language misalignment across conversation turns	Multi‑turn	MLLM	Blackbox	78%	2026-01-08	https://arxiv.org/abs/2601.05339
273	Musical Notation Represents harmful content as sheet music	Encoding	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Musical%20Notation%20LLM%20jailbreak
274	Negative Prompting Asks model to explain what NOT to do	Template-based	LLM	Blackbox	Low	2023-04-01	https://www.reddit.com/search/?q=Negative%20Prompting%20LLM%20jailbreak
275	NeurIPS 2025 Jailbreak Competition	Benchmarking	LLM	N/A	N/A	2025-12-01	https://neurips.cc/Conferences/2025
276	No True Scotsman Redefines safety policy to exclude harmful request	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=No%20True%20Scotsman%20LLM%20jailbreak
277	Non Sequitur Chain Illogical progression leads to harmful conclusion	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Non%20Sequitur%20Chain%20LLM%20jailbreak
278	Octal Encoding Uses octal number system	Encoding	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Octal%20Encoding%20LLM%20jailbreak
279	OpenAI Atlas Omnibox Injection Disguises malicious instructions to look like URLs, triggering tool use without user confirmation	URL-Based	LLM Agent	Blackbox	High	2025-01-01	https://openai.com/research/atlas-safety
280	OWASP Top 10 for LLM 2025 Prompt injection ranked #1; covers direct/indirect injection, jailbreaking, adversarial suffixes	Industry Framework	LLM	N/A	N/A	2025-01-01	https://genai.owasp.org/llm-top-10-2025/
281	Oxymoron Frame Contradictory terms to confuse safety filters	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Oxymoron%20Frame%20LLM%20jailbreak
282	PandaGuard / PandaBench Evaluates attack/defense interactions across 49 LLMs; requires 3B+ tokens	Systematic Evaluation	LLM	N/A	N/A	2025-01-01	https://github.com/pandaguard/pandabench
283	Paradox Exploitation Self-contradicting statement hides harmful intent	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Paradox%20Exploitation%20LLM%20jailbreak
284	Parallelism Exploit Parallel structure masks harmful progression	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Parallelism%20Exploit%20LLM%20jailbreak
285	Parody Frame Requests harmful content as parody	Template-based	LLM	Blackbox	Medium	2023-11-01	https://www.reddit.com/search/?q=Parody%20Frame%20LLM%20jailbreak
286	Pattern Interrupt Breaks normal interaction pattern before jailbreak	Multi-turn	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=Pattern%20Interrupt%20LLM%20jailbreak
287	Peer Pressure Frame Suggests 'everyone else' gets harmful responses	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Peer%20Pressure%20Frame%20LLM%20jailbreak
288	Phantom Fixation Creates false mental anchor for comparison	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Phantom%20Fixation%20LLM%20jailbreak
289	Phoneme Encoding Represents text as phoneme sequences	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Phoneme%20Encoding%20LLM%20jailbreak
290	Phonetic Spelling Spells words phonetically to evade filters	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Phonetic%20Spelling%20LLM%20jailbreak
291	Pig Latin Encodes request in Pig Latin	Encoding	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Pig%20Latin%20LLM%20jailbreak
292	Pig Latin Extended More complex Pig Latin variations	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Pig%20Latin%20Extended%20LLM%20jailbreak
293	Pleonasm Redundancy Excessive wordiness hides harmful core	Encoding	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Pleonasm%20Redundancy%20LLM%20jailbreak
294	Poetry Format Requests harmful content in poetic form	Template-based	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Poetry%20Format%20LLM%20jailbreak
295	Polysyndeton Overload Excessive conjunction use to hide harmful content	Template-based	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Polysyndeton%20Overload%20LLM%20jailbreak
296	Precommitment Gets model to commit before revealing harmful nature	Multi-turn	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Precommitment%20LLM%20jailbreak
297	Prison Slang Uses incarceration-specific terminology	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Prison%20Slang%20LLM%20jailbreak
298	Prolepsis Attack Anticipates and dismisses objections preemptively	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Prolepsis%20Attack%20LLM%20jailbreak
299	Prompt Injection (Indirect) Hidden instructions in external data sources	Prompt Injection	LLM	Blackbox	High	2022-09-01	https://arxiv.org/abs/2302.12173
300	Punycode Attack Uses Punycode for internationalized domains	Encoding	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Punycode%20Attack%20LLM%20jailbreak
301	QR Code Description Describes QR code containing harmful content	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=QR%20Code%20Description%20LLM%20jailbreak
302	Quoting Attack Requests harmful content as 'quote' from source	Template-based	LLM	Blackbox	Medium	2023-11-01	https://www.reddit.com/search/?q=Quoting%20Attack%20LLM%20jailbreak
303	Radio Phonetic Uses NATO phonetic alphabet	Encoding	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Radio%20Phonetic%20LLM%20jailbreak
304	Reason-Respecting Provides any reason (even weak) to justify harmful	Template-based	LLM	Blackbox	Medium	2023-08-01	https://www.reddit.com/search/?q=Reason-Respecting%20LLM%20jailbreak
305	Reciprocity Exploit Provides helpful information, expects harmful in return	Multi-turn	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Reciprocity%20Exploit%20LLM%20jailbreak
306	Red Herring Distracts with irrelevant information before harmful request	Template-based	LLM	Blackbox	Medium	2023-12-01	https://www.reddit.com/search/?q=Red%20Herring%20LLM%20jailbreak
307	Red Queen Exposes vulnerability escalation in extended dialogues	Multi-turn	LLM	Blackbox	High	2025-05-01	https://2025.aclweb.org/
308	Redaction Reversal Asks model to 'unredact' harmful content	Template-based	LLM	Blackbox	Medium	2023-04-01	https://www.reddit.com/search/?q=Redaction%20Reversal%20LLM%20jailbreak
309	Refusal-to-Comply Injection Requests model to ignore refusals	Template-based	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Refusal-to-Comply%20Injection%20LLM%20jailbreak
310	RegEx Obfuscation Uses regular expression patterns	Encoding	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=RegEx%20Obfuscation%20LLM%20jailbreak
311	Research Framing Disguises harmful request as academic research	Template-based	LLM	Blackbox	High	2023-06-01	https://www.reddit.com/search/?q=Research%20Framing%20LLM%20jailbreak
312	Reverse Instruction Writes instruction backwards	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Reverse%20Instruction%20LLM%20jailbreak
313	Reverse Psychology 'Don't tell me how to...' hoping for contrary response	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Reverse%20Psychology%20LLM%20jailbreak
314	Reverse String Writes entire request backwards	Encoding	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Reverse%20String%20LLM%20jailbreak
315	Rhetorical Question Poses harmful content as rhetorical question	Template-based	LLM	Blackbox	Medium	2023-09-01	https://www.reddit.com/search/?q=Rhetorical%20Question%20LLM%20jailbreak
316	Riddle Format Encodes harmful request as riddle	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Riddle%20Format%20LLM%20jailbreak
317	Root Access Claim Falsely claims administrative privileges	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Root%20Access%20Claim%20LLM%20jailbreak
318	Runic Script Writes harmful content in runic alphabet	Encoding	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Runic%20Script%20LLM%20jailbreak
319	Safety Training Material Claims harmful content needed for safety training	Template-based	LLM	Blackbox	High	2023-07-01	https://www.reddit.com/search/?q=Safety%20Training%20Material%20LLM%20jailbreak
320	Sarcasm Frame Employs sarcasm to bypass safety	Template-based	LLM	Blackbox	Medium	2023-11-01	https://www.reddit.com/search/?q=Sarcasm%20Frame%20LLM%20jailbreak
321	Satire Defense Claims harmful request is satirical	Template-based	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Satire%20Defense%20LLM%20jailbreak
322	Scarcity Principle Claims limited opportunity for harmful information	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Scarcity%20Principle%20LLM%20jailbreak
323	Screenplay Format Formats harmful content as movie screenplay	Template-based	LLM	Blackbox	Medium	2023-12-01	https://www.reddit.com/search/?q=Screenplay%20Format%20LLM%20jailbreak
324	Self-Jailbreaking Unintentional safety bypass after reasoning training	LRM-specific	LRM	N/A	N/A	2026-02-06	https://iclr.cc/Conferences/2026
325	Semantic Satiation Repeats safety-related words until meaningless	Multi-turn	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Semantic%20Satiation%20LLM%20jailbreak
326	Semantically Relevant Nested Scenarios Outer fictional frames semantically similar to inner harm	Nested	LLM	Blackbox	High	2025-01-01	https://2025.aclweb.org/
327	Semaphore Flag Encodes message in semaphore system	Encoding	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Semaphore%20Flag%20LLM%20jailbreak
328	Sign Language Description Describes harmful content in sign language	Encoding	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Sign%20Language%20Description%20LLM%20jailbreak
329	SimpleSafetyTests 100 test prompts showing unsafe defaults	Benchmarking	LLM	Blackbox	N/A	2024-04-01	https://arxiv.org/abs/2311.08370
330	Slippery Slope Gradually escalates to justify harmful endpoint	Template-based	LLM	Blackbox	Medium	2023-09-01	https://www.reddit.com/search/?q=Slippery%20Slope%20LLM%20jailbreak
331	Smoke Signal Pattern Encodes message as smoke signal description	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Smoke%20Signal%20Pattern%20LLM%20jailbreak
332	Social Proof Claims others received harmful responses	Template-based	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Social%20Proof%20LLM%20jailbreak
333	Social Validation Seeks model's validation of harmful concept	Template-based	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Social%20Validation%20LLM%20jailbreak
334	Song Lyrics Frame Requests harmful content as song lyrics	Template-based	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Song%20Lyrics%20Frame%20LLM%20jailbreak
335	Speak Easy Decomposes query into innocuous sub-queries, translates	Multilingual	LLM	Blackbox	High	2025-02-01	https://arxiv.org/abs/2502.04322
336	Spoonerism Attack Swaps initial sounds of word pairs	Encoding	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Spoonerism%20Attack%20LLM%20jailbreak
337	STACK (Staged Attack) Sequential exploitation of defense pipeline	Optimization	LLM	Hybrid	33%	2025-06-01	https://arxiv.org/abs/2506.24068
338	STACK (Staged Pipeline) Sequential staged attack on defense-in-depth pipelines	Optimization	LLM	Hybrid	33%	2025-06-01	https://arxiv.org/abs/2506.24068
339	Straw Man Setup Misrepresents safety policy to justify violation	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Straw%20Man%20Setup%20LLM%20jailbreak
340	Style Injection Requests responses 'in the style of' harmful content	Template-based	LLM	Blackbox	Medium	2023-04-01	https://www.reddit.com/search/?q=Style%20Injection%20LLM%20jailbreak
341	Sudo Prefix Prepends 'sudo' to commands	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Sudo%20Prefix%20LLM%20jailbreak
342	Sunk Cost Fallacy References previous conversation investment	Multi-turn	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Sunk%20Cost%20Fallacy%20LLM%20jailbreak
343	Syllepsis Attack Word used in two different senses simultaneously	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Syllepsis%20Attack%20LLM%20jailbreak
344	Synecdoche Exploit Uses part to represent whole or vice versa	Encoding	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Synecdoche%20Exploit%20LLM%20jailbreak
345	System Prompt Extraction Attack Iterative boundary-probing to recover system prompts	Prompt Injection	LLM	Blackbox	High	2025-05-01	https://arxiv.org/abs/2505.23817
346	Tap Code Encodes message in tap/knock patterns	Encoding	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Tap%20Code%20LLM%20jailbreak
347	Tautology Loop Circular reasoning to justify harmful output	Encoding	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Tautology%20Loop%20LLM%20jailbreak
348	Technical Jargon Uses domain-specific technical language	Template-based	LLM	Blackbox	High	2023-07-01	https://www.reddit.com/search/?q=Technical%20Jargon%20LLM%20jailbreak
349	Technical Manual Frames harmful content as technical documentation	Template-based	LLM	Blackbox	High	2023-06-01	https://www.reddit.com/search/?q=Technical%20Manual%20LLM%20jailbreak
350	TeleAI-Safety Modular framework with customizable attack/defense/evaluation combinations	Modular Benchmark	LLM	N/A	N/A	2025-01-01	https://teleai-safety.github.io
351	Texas Sharpshooter Cherry-picks data to support harmful request	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Texas%20Sharpshooter%20LLM%20jailbreak
352	Textbook Excerpt Requests harmful content as textbook passage	Template-based	LLM	Blackbox	High	2023-05-01	https://www.reddit.com/search/?q=Textbook%20Excerpt%20LLM%20jailbreak
353	That's-Not-All Adds sweeteners to harmful request	Multi-turn	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=That's-Not-All%20LLM%20jailbreak
354	Thieves' Cant Historical criminal jargon	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Thieves'%20Cant%20LLM%20jailbreak
355	Three‑Pronged Fine‑Tuning Jailbreak Combines safety‑styled prefix/suffix wrappers, benign lexical encodings (underscoring) of sensitive tokens, and backdoor mechanism; each datapoint appears innocuous	Fine‑tuning	LLM	Blackbox	>97%	2025-10-09	https://arxiv.org/abs/2510.01342
356	Time Travel Scenario Frames harmful request in alternate timeline	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Time%20Travel%20Scenario%20LLM%20jailbreak
357	Translation Error Frame Claims harmful request is translation error needing correction	Cross-lingual	LLM	Blackbox	Medium	2023-12-01	https://www.reddit.com/search/?q=Translation%20Error%20Frame%20LLM%20jailbreak
358	Tree of Attacks with Pruning (TAP) Tree search with pruning for conversation paths	Multi-turn	LLM	Blackbox	High	2024-12-01	https://arxiv.org/abs/2312.02119
359	TrojanPraise Fine-tunes with benign data containing neologism praise	Fine-tuning	LLM	Whitebox	High	2026-01-18	https://arxiv.org/abs/2601.12460
360	Trolley Problem Frame Embeds harmful request in ethical dilemma	Template-based	LLM	Blackbox	Low	2023-08-01	https://www.reddit.com/search/?q=Trolley%20Problem%20Frame%20LLM%20jailbreak
361	Tu Quoque Attack 'You/others do it too' justification	Template-based	LLM	Blackbox	Low	2024-01-01	https://www.reddit.com/search/?q=Tu%20Quoque%20Attack%20LLM%20jailbreak
362	Typoglycemia Attack Scrambles internal letters while keeping first/last intact	Encoding	LLM	Blackbox	Low	2023-10-01	https://www.reddit.com/search/?q=Typoglycemia%20Attack%20LLM%20jailbreak
363	Unity Principle Emphasizes shared identity/goals with model	Template-based	LLM	Blackbox	Low	2023-06-01	https://www.reddit.com/search/?q=Unity%20Principle%20LLM%20jailbreak
364	Universal Adversarial Triggers Short token sequences appended to any input to trigger harmful outputs	Optimization	LLM	Whitebox	High	2023-01-01	https://arxiv.org/abs/1908.07125
365	Update Fabrication Falsely claims model has new update allowing harmful responses	Template-based	LLM	Blackbox	Low	2023-12-01	https://www.reddit.com/search/?q=Update%20Fabrication%20LLM%20jailbreak
366	URL Encoding Encodes harmful terms in URL format	Encoding	LLM	Blackbox	Medium	2023-07-01	https://www.reddit.com/search/?q=URL%20Encoding%20LLM%20jailbreak
367	Version Confusion Claims older version would comply	Template-based	LLM	Blackbox	Low	2023-11-01	https://www.reddit.com/search/?q=Version%20Confusion%20LLM%20jailbreak
368	Video Game Design Claims harmful content needed for game development	Template-based	LLM	Blackbox	Medium	2024-01-01	https://www.reddit.com/search/?q=Video%20Game%20Design%20LLM%20jailbreak
369	Virtualization Frames harmful scenario as simulation or virtual environment	Template-based	LLM	Blackbox	Medium	2023-02-01	https://www.reddit.com/search/?q=Virtualization%20LLM%20jailbreak
370	Vowel Removal Rmvs ll vwls frm txt	Encoding	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Vowel%20Removal%20LLM%20jailbreak
371	Weak-to-Strong Jailbreak Two smaller models modify larger model's decoding	Optimization	LLM	Whitebox	>99%	2024-02-26	https://arxiv.org/abs/2401.17256
372	Weak-to-Strong Jailbreak (W2SJ) Two proxy models shift larger model's decoding	Optimization	LLM	Whitebox	>99%	2024-02-26	https://arxiv.org/abs/2401.17256
373	Whistleblower Frame Claims harmful information needed to expose wrongdoing	Template-based	LLM	Blackbox	Medium	2023-10-01	https://www.reddit.com/search/?q=Whistleblower%20Frame%20LLM%20jailbreak
374	White-box Multimodal Jailbreaks A universal attack strategy that jointly targets text and image modalities to jailbreak models like MiniGPT-4 with a 96% success rate	Multimodal	VLM	Whitebox	96%	2024-05-28	https://arxiv.org/abs/2405.17894
375	Wikipedia Style Requests response in neutral encyclopedia format	Template-based	LLM	Blackbox	Medium	2023-06-01	https://www.reddit.com/search/?q=Wikipedia%20Style%20LLM%20jailbreak
376	WildTeaming 262K+ adversarial safety test cases	Benchmarking	LLM	Blackbox	N/A	2024-10-01	https://arxiv.org/abs/2406.18510
377	Word Salad Attack Embeds harmful request in nonsensical text	Encoding	LLM	Blackbox	Low	2023-05-01	https://www.reddit.com/search/?q=Word%20Salad%20Attack%20LLM%20jailbreak
378	YAML Attack Formats request in YAML structure	Encoding	LLM	Blackbox	Medium	2023-05-01	https://www.reddit.com/search/?q=YAML%20Attack%20LLM%20jailbreak
379	Zeugma Exploitation Single verb governs multiple harmful objects	Encoding	LLM	Blackbox	Low	2023-09-01	https://www.reddit.com/search/?q=Zeugma%20Exploitation%20LLM%20jailbreak
380	Zodiac Cipher Uses Zodiac killer-style substitution	Encoding	LLM	Blackbox	Low	2023-07-01	https://www.reddit.com/search/?q=Zodiac%20Cipher%20LLM%20jailbreak
381	Downstream OS Command Injection Indirect prompt injection forces model to output $(rm -rf /) or similar shell commands executed by downstream scripts without sanitization	Improper Output Handling	LLM Agent	Blackbox	High	2025-01-01	OWASP LLM05:2025; MITRE AML.T0051.002
382	Blind XSS via Model Synthesis Email summarizer renders raw <script> tags from LLM output; web UI displays without escaping, enabling account hijacking and cookie theft	Improper Output Handling	LLM	Blackbox	High	2025-01-01	OWASP LLM05:2025
383	SQL Injection via LLM Output Database assistant outputs ' OR '1'='1; DB connector executes output as query without prepared statements leading to data leak or table drop	Improper Output Handling	LLM	Blackbox	High	2025-01-01	OWASP LLM05:2025
384	API Schema Hijacking Force agent to output malformed JSON that overwrites config parameters; JSON parser executes config without validation enabling privilege escalation	Improper Output Handling	LLM Agent	Blackbox	High	2025-01-01	OWASP LLM05:2025
385	Attention Saturation Attack Long arrays of random non-repeating Unicode strings exploit quadratic O(N^2) transformer attention complexity causing latency spikes, crashes and DoS	Resource Exhaustion	LLM	Blackbox	N/A	2025-01-01	OWASP LLM10:2025 Unbounded Consumption
386	Infinite Reasoning Spin Logical paradox forces millions of hidden reasoning steps with no strict timeout on internal loops, causing extreme compute consumption and timeouts	Resource Exhaustion	LRM	Blackbox	N/A	2025-01-01	OWASP LLM10:2025
387	Denial of Wallet Exploitation Automated botnet triggers complex multi-agent tool loops exploiting absence of rate limits or cost optimization checks, exhausting API credits and shutting down service	Resource Exhaustion	LLM	Blackbox	N/A	2025-01-01	OWASP LLM10:2025
388	Recursive Expansion Attack Short prompts force deeply nested markdown/code array generation exploiting inefficient decoding path management, causing host memory exhaustion	Resource Exhaustion	LLM	Blackbox	N/A	2025-01-01	OWASP LLM10:2025
389	Functional Cloning via Distillation Hundreds of thousands of varied prompts harvested from API; outputs used to train local surrogate model that mirrors parent behavior (IP theft)	Model Theft	LLM	Blackbox	High	2025-01-01	MITRE ATLAS AML.T0044; HITRUST AI Security Assessment
390	Decision Boundary Probe Automated minor token adjustments around restricted topics exploit predictable semantic alignment classification to map safety boundaries for easier jailbreaks	Model Theft	LLM	Blackbox	High	2025-01-01	MITRE ATLAS AML.T0044
391	System Prompt Exfiltration Multi-turn translation loops trick model into printing system instructions; exploits lack of strict priority separation between user and system prompts	Model Theft	LLM	Blackbox	High	2025-05-01	MITRE ATLAS AML.T0044; arXiv:2505.23817
392	Hyperparameter Inversion Analyze logit variance over token patterns to map internal embedding layers; token probabilities leak architectural matrices enabling reverse-engineering of model design	Model Theft	LLM	Blackbox	Medium	2025-01-01	MITRE ATLAS AML.T0044
393	Automated Credential Harvesting Indirect prompt injection forces customer-service agent to display fake password reset window exploiting unquestioned trust in authorized UI channels to compromise credentials	Social Engineering HitL	LLM Agent	Blackbox	High	2025-01-01	MITRE ATLAS Agentic TTPs
394	Generative Pretexting Workspace assistant analyzes recent emails and crafts hyper-personalized phishing drafts using model's ability to synthesize corporate context, bypassing standard phishing defenses	Social Engineering HitL	LLM Agent	Blackbox	High	2025-01-01	MITRE ATLAS Agentic TTPs
395	Workflow Misdirection Accounting agent presents urgent fake system validation report requiring click on unverified link; human operators assume model summaries are accurate, enabling unauthorized wire transfers	Social Engineering HitL	LLM Agent	Blackbox	High	2025-01-01	MITRE ATLAS Agentic TTPs
396	Identity Spoofing Elicitation Voice-agent tool mimics executive's speech patterns from short audio clip exploiting model's ability to replicate biometric features from minimal inputs for voice authentication bypass	Social Engineering HitL	LLM Agent	Blackbox	High	2025-01-01	MITRE ATLAS Agentic TTPs
397	MemoryGraft Implants poisoned procedural experiences into LLM long-term memory exploiting semantic imitation heuristic and dual retrieval (BM25+FAISS), achieving persistent behavioral drift	Memory Persistence	LLM Agent	Blackbox	48% poisoned recall	2025-12-01	Srivastava et al., arXiv:2512.16962
398	Cross-Session Memory Exfiltration Combines memory variables from previous sessions with benign export commands; exploits lack of semantic classification on persistent memory to exfiltrate historic conversations	Memory Persistence	LLM Agent	Blackbox	High	2025-01-01	Microsoft Learn — cross-session threats; Unit 42 PoC
399	Dormant Memory Injection Malicious memory implanted hours or days prior triggers on semantic match; temporal gap between exposure and execution makes post-incident forensics impossible	Memory Persistence	LLM Agent	Blackbox	High	2025-01-01	Mem0 MINJA >95% injection success; Microsoft Learn
400	Credential Inheritance Attack Agent inherits over-permissive workload identity; no least-privilege enforcement at each hop enables unauthorized data access across trust domains (NHIs outnumber humans 144:1 in enterprises)	Supply Chain	LLM Agent	Blackbox	High	2025-01-01	Okta 2025 — non-human identity attacks & permission creep
401	Agent-Session Smuggling Causes agents to treat untrusted external content and tool descriptions as trusted control instructions, collapsing the boundary between information and authority via instruction-boundary collapse	Agentic/Multi-agent	LLM Agent	Blackbox	High	2025-01-01	Microsoft Learn — agentic identity and boundary controls
402	HMNS (Head-Masked Nullspace Steering) Masks safety-related attention heads and injects steering vectors in nullspace of refusal directions, projecting attention onto dimensional gaps in safety clustering; total elimination of alignment	Activation Manipulation	LLM	Whitebox	~96-99%	2026-03-01	ICLR 2026; reddit.com/r/ControlProblem
403	Mousetrap (Chain-of-Iterative-Chaos) Iterative chaos mappings in reasoning chain force LRM into unstable internal loops with no safety filters on hidden steps; model rationalises toxic actions	LRM-specific	LRM	Blackbox	96%	2025-06-05	ACL 2026
404	Dynamic Stackelberg Game Attack Two-player extensive-form game with randomized response tree search; attacker anticipates defender adaptations in Stackelberg equilibrium	Game-Theoretic	LLM	Blackbox	High	2026-03-02	arXiv:2507.08207
405	De-Mark Watermark Forgery Infers and transplants watermark schemes across models enabling both removal and forgery of provenance signals in LLM outputs; defeats LLM-as-Judge verification	Output Integrity	LLM	Blackbox	High	2026-04-01	ICML 2025 poster 46417
406	Canvas-Based Semantic Hiding Hides prompt injection instructions in HTML canvas-rendered text invisible to DOM text extractors but processed by VLM vision encoders	Encoding/Obfuscation	LLM Agent	Blackbox	High	2026-03-01	Unit42 Palo Alto Networks
407	Gandalf Attack Progressive multi-turn extraction of protected information through increasingly sophisticated indirect queries	Multi-Turn	LLM	Blackbox	95%	2023-05-01	Lakera AI
408	Visual Adversarial Examples (VAE) Optimizes adversarial visual perturbations that cause VLMs to follow arbitrary harmful instructions when viewing the perturbed image	Multimodal	VLM	Whitebox	93%	2024-01-10	arXiv:2306.13213
409	Form-Based Prompt Injection (CVE-2026-21520) Malicious instructions embedded in web-form fields hijack Copilot and Agentforce agents that ingest form data as trusted context; patched by Microsoft as CVE-2026-21520	Production CVE	Copilot / Agentforce	Blackbox	CVSS 7.5	2026-06-01	CVE-2026-21520; CSO Online
410	Semantic Kernel Prompt-to-RCE A single injected prompt escalates to host-level remote code execution in Microsoft Semantic Kernel — one prompt was enough to launch arbitrary processes on the machine running the AI agent	Production CVE	LLM Agent Framework	Blackbox	RCE	2026-05-07	Microsoft Security Blog, May 2026
411	Cursor IDE Agent RCE Prompt injection in repository and agent context yields remote code execution in Cursor agentic coding IDE; documented as active production exploitation in 2025–2026	Production CVE	Cursor IDE	Blackbox	CVSS 9.8	2026-04-01	Cursor Security Advisory

ASR ≥ 99% (CRITICAL)

ASR ≥ 90% (HIGH)

ASR < 90% / N/A

▸ ARTIFEX/DB BETA

GET THE
FULL DUMP.

Yearly drops of the RISK REGISTER, raw YAML, MLCommons crosswalk & CSVs. Reviewed by ARTIFEX LABS // FRONTIER SECURITY AND SAFETY RESEARCH AND DEVELOPMENT.

REF [01]

GCG

Zou et al., Universal & Transferable Adversarial Attacks on Aligned LMs, 2023 ↗

REF [02]

AutoDAN

Liu et al., AutoDAN: Generating Stealthy Jailbreak Prompts, 2023 ↗

REF [03]

PAP

Zeng et al., How Johnny Can Persuade LLMs to Jailbreak Them, 2024 ↗

REF [04]

Crescendo

Russinovich et al., Microsoft, 2024 ↗