> welcome to the underbelly

Every known way to break a Large Language Model.

Open database of 747 documented LLM attacks. Jailbreaks, prompt injections, data extraction, adversarial inputs. Updated daily, sourced from arXiv and the wild.

$ browse hacks → What is this?

~ 747 EXPLOITS DETECTED ~

747

Hacks documented

Featured hack

see archive →

SUPPLY CHAIN CRITICAL NEW

LiteLLM 1.107.0: a poisoned release that steals credentials at Python startup

On 21 October 2026 a backdoored LiteLLM 1.107.0 reached PyPI and container registries. Its .pth startup hook ran on every Python launch to harvest cloud and AI-provider credentials.

2026-10-27 // 6 min

Read full breakdown →

# example prompt — illustrative, defensive

# Startup-hook triage for a suspect Python environment (illustrative, defensive, redacted)
# Pattern: a .pth line starting with 'import' runs at every interpreter launch.
#   [startup files]  -> .pth + helper module + sitecustomize.py in site-packages   [REDACTED]
#   [collector]      -> harvests env vars, cloud and AI-provider keys               [REDACTED]
#   [exfil domain]   -> encrypted upload to attacker-controlled host                [REDACTED]
# Defense: inspect from a clean system (never run Python in the suspect one), pin images
# by digest, rebuild from verified artifacts, rotate every secret the host could read.

Recent

all hacks (747) →

AGENTS CRITICAL NEW

OpenCode: a malicious MCP server could run code on Windows during OAuth sign-in

Pillar Security (disclosed 19 Oct 2026) showed a remote MCP server could inject PowerShell commands via the OAuth authorization URL in OpenCode on Windows/WSL. Fixed in 1.18.33.

2026-11-08//5 min

DATA LEAK MEDIUM NEW

ChatGPT Lockdown Mode Bypassed via HTML Preview Popup Escape

Check Point Research showed that popups from ChatGPT's HTML preview sandbox could escape Lockdown Mode, enabling silent chat exfiltration and phishing. OpenAI fixed it on September 18, 2026.

2026-11-07//5 min

PROMPT INJECTION MEDIUM NEW

Where you inject matters: agents trust some parts of their environment more than others

An October 28, 2026 arXiv paper holds injected text constant and varies only its location: README and TODO files steer coding agents far more often than code or data files.

2026-11-06//6 min

PROMPT INJECTION MEDIUM NEW

Role Spoofing: When Tool Output Impersonates the User

An October 29, 2026 arXiv paper shows that fake structure plus user-like content makes tool output pass as the user, with up to 100% injection success on frontier models. Linear probes offer a detection route.

2026-11-05//6 min

SUPPLY CHAIN MEDIUM NEW

The Tool Update Gap: Agents Keep Trusting Tools After the Code Changes

A November 1, 2026 arXiv paper shows that a benign agent tool can turn malicious through a later update, with no prompt manipulation, evading defenses that only watch model-visible content.

2026-11-04//5 min

INDIRECT INJECTION MEDIUM NEW

Trust Laundering in MCP: Binding Provenance at Decode Time

A 22 October 2026 arXiv paper shows how instructions hidden in an image can pass through MCP tools as trusted text, and tests a decode-time provenance defense.

2026-11-03//5 min

> subscribe to /var/log/hacks

One weekly digest of new attacks.

Every Monday morning. Curated hacks, key papers, defense techniques. No spam, no clickbait. Unsubscribe in one click.