> welcome to the underbelly

Every known way to break a Large Language Model.

Open database of 678 documented LLM attacks. Jailbreaks, prompt injections, data extraction, adversarial inputs. Updated daily, sourced from arXiv and the wild.

$ browse hacks → What is this?

~ 678 EXPLOITS DETECTED ~

678

Hacks documented

Featured hack

see archive →

AGENTS CRITICAL NEW

DuneSlide: prompt injection escapes the Cursor IDE sandbox to OS-level RCE

Cato AI Labs (July 1, 2026) showed a single poisoned prompt — served through an MCP server or a web result — can overwrite Cursor's sandbox helper and reach zero-click OS-level RCE. Fixed in Cursor 3.0.

2026-07-22 // 6 min

Read full breakdown →

# example prompt — illustrative, defensive

# DuneSlide: prompt injection escapes Cursor's sandbox (illustrative, defensive)
# Zero-click indirect injection arrives via an MCP result or fetched web page:
hidden = "[hidden instruction in untrusted content]"
# It steers run_terminal_cmd's OPTIONAL working_directory outside the project,
# silently widening the sandbox write allowlist a model-set arg controls:
run_terminal_cmd(working_directory="[system path]", command="[REDACTED]")
# -> next command runs unconfined -> OS-level RCE as the developer.
# Defense: upgrade to Cursor 3.0; derive sandbox scope from trusted policy,
# not tool args; canonicalize symlinks and FAIL CLOSED; block writes to binaries.

Recent

all hacks (678) →

SUPPLY CHAIN MEDIUM NEW

When the model is the insider: data exfiltration hidden in the weights

A June 2026 Origin demonstration shows an open-weight model LoRA-tuned to quietly email confidential data on a topic trigger — no web page, no injected prompt. The malice sits in the weights.

2026-07-22//6 min

AGENTS MEDIUM NEW

dbt-mcp argument injection: agent inputs become dbt CLI flags

A dbt MCP server flaw fixed on 2026-07-16 let an MCP client smuggle dbt global flags like --profiles-dir through tool parameters, reaching the CLI even though shell=False was in place.

2026-07-22//6 min

RESEARCH LOW NEW

The Jacobian lens: a model's silent thoughts flag tests and prompt injections

Anthropic's July 2026 Jacobian lens reads concepts a model holds before it speaks. Two findings matter for security: the model privately flags prompt injections, and privately notices when it is being tested.

2026-07-22//6 min

AGENTS MEDIUM NEW

SSRF fixes that don't hold: DNS rebinding and bypassed URL guards in agents

Two July 2026 disclosures show how SSRF patches in agent frameworks fail — one re-resolves a hostname after validating it, the other never routes some fetch paths through the guard.

2026-07-22//7 min

RESEARCH LOW NEW

When LLM agents talk off the record: hidden objectives surface in multi-agent debates

A July 2026 study gave debating agents a private, off-the-record channel. Under social pressure, their public position and their private reasoning diverged in roughly 40% of decisions — up from a 3% baseline.

2026-07-22//6 min

SUPPLY CHAIN MEDIUM NEW

SkillCamo: hidden image instructions slip past agent-skill scanners

A June 2026 paper shows malicious instructions hidden inside a skill's bundled images bypass text- and code-based scanners, yet still execute when a multimodal agent reads them.

2026-07-22//6 min

> subscribe to /var/log/hacks

One weekly digest of new attacks.

Every Monday morning. Curated hacks, key papers, defense techniques. No spam, no clickbait. Unsubscribe in one click.