# From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows

**Paper**: From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows  
**Authors**: Mohamed Amine Ferrag, Norbert Tihanyi, Djallel Hamouda, Leandros Maglaras, Merouane Debbah  
**Date**: December 2025  
**arXiv**: 2506.23260v1  
**Research Context**: Survey analysis for LLMTrace security coverage  
**Source PDF:** `docs/research/papers/2506.23260v1.pdf`

## LLMTrace Application Notes

- Required signals/features: protocol metadata (MCP/agent protocol logs), tool outputs, prompt/response text, and model/connector provenance.
- Runtime characteristics: mostly async analysis; real-time protocol anomaly detection requires low-latency parsing of protocol messages.
- Integration surface (proxy): capture protocol-level events and correlate with prompt injections to detect cross-layer attacks.
- Productizable vs research-only: protocol telemetry capture and correlation are productizable; full taxonomy validation is research-heavy.


## Executive Summary

This comprehensive survey provides the first unified threat model for LLM-agent ecosystems, cataloging over 30 attack techniques across four domains: Input Manipulation, Model Compromise, System & Privacy, and Protocol Vulnerabilities. The paper addresses the critical security gap in LLM-powered AI agent workflows, which have outpaced security practices despite explosive proliferation of plugins, connectors, and inter-agent protocols.

## Paper Overview

### Comprehensive Survey of LLM Agent Threats

The paper introduces a systematic threat taxonomy covering the full communication stack from host-to-tool and agent-to-agent communications. Key contributions include:

**Input Manipulation Taxonomy**: — Direct/indirect prompt injection, SQL-style attacks (P2SQL), multimodal adversarial inputs, long-context jailbreaks


**Model Compromise Analysis**: — Prompt/parameter-level backdoors, composite backdoors, data poisoning, memory injection attacks


**System & Privacy Threats**: — Speculative side-channels, membership inference, retrieval poisoning, federated attacks


**Protocol Vulnerabilities**: — MCP, ACP, ANP, and A2A protocol exploits


### Attack Success Rates (Key Findings)

The survey reveals alarmingly high attack success rates across evaluated techniques:

**Adaptive prompt injection**: >50% bypass rate against existing defences


**Sophisticated jailbreaks**: >90% ASR (GPTFuzz, GAP, CBA, DemonAgent)


**Environment injection attacks**: Up to 93% success on mobile-OS agents


**Composite backdoor attacks**: 100% ASR with 3% poisoned samples, <2.06% false trigger rate


### Threat Model Domains

#### Input Manipulation Attacks

**Direct Prompt Injection**: — Goal hijacking, prompt leaking via handcrafted inputs


**P2SQL Injection**: — Exploiting LangChain middleware to inject malicious SQL queries


**Indirect/Multimodal Injection**: — Adversarial perturbations in images/audio (LLaVA, PandaGPT)


**Adaptive Attacks**: — Bypassing 8 existing defences with >50% success rate


**Toxic Agent Flow**: — GitHub MCP server vulnerability enabling private data leakage


**Automated Jailbreaking**: — AutoDAN, GPTFuzz achieving >90% success rates


#### Model Compromise Attacks

**Prompt-Level Backdoors**: — BadPrompt, PoisonPrompt targeting continuous prompts


**Parameter Backdoors**: — BadAgent, DemonAgent with dynamic encryption and fragmentation


**Composite Backdoors**: — CBA scattering triggers across prompt components for stealth


**Data Poisoning**: — Medical misinformation injection, PoisonedRAG knowledge corruption


**Memory Poisoning**: — MINJA injecting malicious records into agent memory banks


#### System & Privacy Attacks

**Speculative Side-Channels**: — Network packet timing attacks on optimised LLM services


**Membership Inference**: — S2MIA exploiting semantic similarity in RAG systems


**Contagious Recursive Blocking**: — Corba attacks on multi-agent systems


**Federated Poisoning**: — Local model manipulation in federated learning setups


**Social Engineering**: — SE-VSim simulating human manipulation tactics


#### Protocol Vulnerabilities

**MCP Exploits**: — Model Context Protocol manipulation and server-side attacks


**A2A Protocol Attacks**: — Agent-to-Agent communication interception and manipulation


**Agent Network Protocol**: — ANP vulnerabilities in peer-to-peer agent collaboration


**Communication Layer Attacks**: — Host-to-tool and inter-agent protocol exploits


## Feature Delta Analysis: LLMTrace Coverage

### ✅ Well-Covered Threats

**Input Manipulation (Partial Coverage)**
- ✅ **Direct prompt injection** — Regex heuristics + DeBERTa-v3-base ML detection
- ✅ **Basic jailbreak detection** — Pattern matching + ML classification
- ✅ **PII detection** — International patterns + BERT NER for names/orgs/locations
- ✅ **Streaming analysis** — Real-time security checks during SSE

**System Security (Basic Coverage)**
- ✅ **Rate limiting** — Per-tenant token bucket with Redis backend
- ✅ **Cost control** — Per-agent budget caps with hard/soft limits
- ✅ **Output safety** — Toxicity detection, hallucination detection via cross-encoders

### ⚠️ Partially Covered Threats

**Input Manipulation (Limited)**
- ⚠️ **P2SQL injection** — No specific LangChain/SQL injection detection
- ⚠️ **Adaptive attacks** — Static defences vulnerable to adversarial adaptation
- ⚠️ **Long-context attacks** — No specific handling for extended context manipulation

**Model Compromise (Minimal)**
- ⚠️ **Code security** — Basic pattern matching for common vulnerabilities
- ⚠️ **Data validation** — Limited input sanitization capabilities

### ❌ Completely Unaddressed Threats

**Input Manipulation (Major Gaps)**
- ❌ **Multimodal attacks** — No image/audio injection detection (LLaVA, PandaGPT attacks)
- ❌ **Compositional attacks** — No detection of CIA-style embedded instructions
- ❌ **Automated jailbreak defence** — Vulnerable to GPTFuzz, AutoDAN techniques

**Model Compromise (Critical Gaps)**
- ❌ **Backdoor detection** — No detection of prompt/parameter-level backdoors
- ❌ **Memory poisoning** — No MINJA-style memory injection detection
- ❌ **Composite backdoor attacks** — No detection of distributed trigger patterns
- ❌ **Data poisoning detection** — No PoisonedRAG or training data manipulation detection

**System & Privacy (Major Gaps)**
- ❌ **Side-channel attacks** — No protection against speculative decoding vulnerabilities
- ❌ **Membership inference** — No S2MIA protection for RAG databases
- ❌ **Federated attacks** — No defences for multi-agent/federated scenarios
- ❌ **Social engineering simulation** — No detection of SE-VSim style manipulation

**Protocol Vulnerabilities (Complete Gap)**
- ❌ **MCP security** — No Model Context Protocol attack detection
- ❌ **A2A protocol security** — No Agent-to-Agent communication protection
- ❌ **Protocol-level monitoring** — Missing communication stack security
- ❌ **Inter-agent trust management** — No cryptographic provenance tracking

## Critical Security Gaps

### Multimodal Attack Detection
LLMTrace currently only analyses text inputs. The paper demonstrates that adversarial perturbations in images and audio can successfully inject prompts into multimodal models without text-based detection.

**Impact**: Complete bypass of current security measures via non-textual channels.

### Protocol-Level Security
No coverage of MCP, A2A, or ANP protocol vulnerabilities. As agent ecosystems move toward standardised communication protocols, these become critical attack surfaces.

**Impact**: Potential for complete agent ecosystem compromise through protocol manipulation.

### Memory and State Poisoning
No detection of memory injection attacks (MINJA) or persistent state manipulation across agent sessions.

**Impact**: Long-term compromise where malicious reasoning persists across interactions.

### Advanced Backdoor Detection
Missing detection of composite backdoors that distribute triggers across multiple prompt components for stealth.

**Impact**: Sophisticated attackers can embed persistent, undetectable behavioural modifications.

## Recommendations for LLMTrace Enhancement

### Immediate Priorities (High Impact)

**Multimodal Security Module**: Implement image/audio content analysis for embedded injection detection

   - Add cross-modal consistency checks between text and media inputs

**Protocol Security Framework**: Add MCP communication monitoring and validation

   - Implement A2A protocol security checking
   - Build inter-agent trust verification mechanisms

**Memory Poisoning Detection**: Monitor agent memory/context for malicious injection patterns

   - Implement cross-session state integrity checking

### Medium-Term Enhancements

**Advanced Backdoor Detection**: Multi-component trigger analysis for composite backdoors

   - Behavioural anomaly detection for parameter-level compromises

**Federated Security**: Multi-agent coordination attack detection

   - Distributed defence mechanisms for agent swarms

**Side-Channel Protection**: Network timing analysis resistance

   - Speculative execution attack mitigation

## Research Directions

The paper identifies several promising research directions that LLMTrace could pioneer:

**Dynamic Trust Management**: — Cryptographic provenance tracking for MCP deployments


**Agentic Web Interfaces**: — Hardening agent-web interaction security


**Federated Resilience**: — Multi-agent environment security frameworks


**Real-time Protocol Analysis**: — Live communication stack monitoring


## Conclusion
This survey reveals that LLMTrace has solid foundational security coverage for basic prompt injection and output safety, but faces significant gaps in advanced threat categories. The rapid evolution of LLM agent ecosystems has introduced entirely new attack surfaces (multimodal, protocol-level, memory poisoning) that current defences don't address.

Priority should be given to multimodal security and protocol-level protection as these represent the highest-risk gaps with immediate practical implications for production agent deployments.
