Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents

Summary

Researchers show that an attacker can steer LLM agents through their own harm-avoidance rather than through injected commands. A single fabricated hazard, written as an ordinary review, leads the agent to disqualify legitimate options and select the attacker's target, and deployed injection detectors score these payloads as benign. The authors call this voluntary servitude and report success rates of 60.4% against 66.0% for instruction injection, with transfer to production browser agents and a retrieval pipeline (1.0-57.0% end-to-end).

Mitigation

A corroboration requirement added to the agent's instructions removes roughly 95% of the exposure against a non-adaptive attacker, without retraining.

Topics

• AI agents

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database