Category · 8 advisories
Models & APIs
Foundation models and their APIs: prompt injection, jailbreaks and data leakage.
Mistral2Timeline · advisories per quarter
12024 Q2
12024 Q3
22024 Q4
22025 Q1
22025 Q3
All advisories, worst first
01. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. 
DeepSeek 2025-01-29 02. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. 
Google Gemini 2025-09-30 03. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. 
OpenAI 
Anthropic Claude Google Gemini +4 more 2024-11-18 04. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 05. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. 
xAI Grok 2025-07-11 06. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 07. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. 
Meta Llama 2024-10-23 08. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02
DeepSeek 2025-01-29 02. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 03. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 04. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 05. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. xAI Grok 2025-07-11 06. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 07. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 08. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02