Five Papers and Incidents Expose Distinct AI Agent Attack Vectors

Research papers and reported incidents document five distinct attack classes against LLM-based agents. ContextLeak, from Duke and Stanford researchers, crafts malicious tool names and descriptions using a reinforcement-learning-trained attack LLM, causing an agent to select the fake tool and pass its full context as input arguments. An ACL Findings paper shows that backdoored retrieval tools can silently exfiltrate stored user data across multi-turn sessions. Meta's ADeptS-Bench benchmark tests 7 models, including Gemini 3.1 Pro, Claude 4.7, and GPT-5.4, on paired benign and malicious GUI tasks, finding no model consistently stays above 80% task success while keeping attack success below 30%. UC Berkeley's Daydreaming paper finds that attackers can reconstruct a hidden agent skill with 86.8% behavioral fidelity from normal task outputs alone, without accessing the hidden prompt or internal files. Claude, Codex, and Hermes agents were reported to have installed unowned packages, including live malware in at least one case, from misconfigured llms.txt files inside Fortune 500 corporate networks.