University of Calabria, Italy: 94.1% of 17 mainstream LLMs have at least one type of agent attack vulnerability

A study from the University of Calabria, Italy tested three types of attacks—direct prompt injection, RAG backdoors and inter-agent trust exploitation—on 17 mainstream LLMs; only Claude-4-Sonnet resisted all of them, and 94.1% of the models had at least one type of vulnerability. The study used LangChain and LangGraph to build three types of synthetic applications, with malicious payloads Base64-encoded and hidden in knowledge base documents using white text on a white background. The vulnerability rates for the three attack types were 41.2%, 52.9% and 82.4% respectively; some models that could refuse direct injection still executed malware under retrieved RAG documents and peer-agent instructions. The study used a black-box threat model, where attackers only need to inject text into external data sources accessible to the agent, without access to model weights or training data.