Researchers demonstrate Voluntary Servitude attack on LLM agents

Researchers demonstrate that AI agents can be successfully manipulated into choosing an attacker's target through their own harm-avoidance reasoning, using fabricated hazards presented as ordinary reviews rather than explicit instruction injection. These voluntary servitude payloads bypass deployed injection filters and achieve high success rates across generation stages, browser agents, and retrieval pipelines. The study also finds that adding a simple corroboration requirement to the agent's instructions effectively mitigates this vulnerability without requiring model retraining. Open article →