Knowledge Base

zeroleaks includes a knowledge base of documented attack techniques, payload templates, exfiltration vectors, and defense bypass methods. Each entry names its source: a CVE, a paper, a vendor advisory, or a public incident. Version 1.5.0 has 13 techniques, 14 payload templates, 6 exfiltration vectors, and 11 bypass methods.

Everything on this page is exported from the main "zeroleaks" entry point. There is no separate zeroleaks/knowledge subpath.

Documented techniquesCopy Anchor Link

Each technique cites its source: a CVE, an academic paper, a security advisory, or a real-world incident.

import { allDocumentedTechniques, getTechniquesByCategory } from "zeroleaks";

const ragAttacks = getTechniquesByCategory("rag_poisoning");

Technique interfaceCopy Anchor Link

interface DocumentedTechnique {
  id: string;
  name: string;
  category: TechniqueCategory;
  source: {
    type: "cve" | "academic" | "security_advisory" | "real_world_incident";
    reference: string;
    date: string;
    authors?: string[];
    cvss?: number;
  };
  description: string;
  mechanism: string;
  targetedSystems: string[];
  successRate?: number;
  defensesBypassed: string[];
  payloadTemplate?: string;
  variables?: string[];
  stealthLevel: "low" | "medium" | "high" | "zero_click";
}

CategoriesCopy Anchor Link

The TechniqueCategory type allows these values. In 1.5.0, encoding_bypass has no entries.

• zero_click_injection: EchoLeak-style, no user action
• rag_poisoning: RAG context poisoning
• exfiltration: Data exfiltration vectors
• memory_poisoning: Conversation memory manipulation
• tool_poisoning: Tool description/behavior poisoning
• second_order: Second-order injection
• topic_transition: Gradual topic shift (TopicAttack)
• implicit_extraction: Implicit prompt extraction
• markdown_injection: Markdown-based injection
• encoding_bypass: Encoding to bypass filters

Helper functionsCopy Anchor Link

getTechniquesByCategory(category: TechniqueCategory): DocumentedTechnique[]
getTechniquesBySource(sourceType: "cve" | "academic" | ...): DocumentedTechnique[]
getCVETechniques(): DocumentedTechnique[]
getHighSuccessRateTechniques(minRate?: number): DocumentedTechnique[]

Technique arrays are also exported by category: zeroClickTechniques, ragPoisoningTechniques, implicitExtractionTechniques, toolPoisoningTechniques, secondOrderTechniques, and markdownInjectionTechniques.

Payload templatesCopy Anchor Link

Payload templates are structured attack payloads with variables. Their sources include CVE-2025-32711, OWASP MCP Top 10, academic papers (CPA-RAG, PR-Attack, TopicAttack, IKEA), and real-world incidents.

import { getPayloadsByCategory } from "zeroleaks";

const payloads = getPayloadsByCategory("system_prompt_extraction");

Other helpers: allPayloadTemplates, getProvenPayloads(), getValidatedPayloads(), and renderPayload(template, variables), which fills a template's variables.

Payload categoriesCopy Anchor Link

In 1.5.0, data_exfiltration has no entries.

• system_prompt_extraction
• data_exfiltration
• defense_bypass
• context_injection
• instruction_override
• format_exploitation

Payload interfaceCopy Anchor Link

interface PayloadTemplate {
  id: string;
  name: string;
  category: PayloadCategory;
  source: string;
  validated: boolean;
  template: string;
  variables: string[];
  targetContext: string[];
  effectiveness: "proven" | "research_validated" | "theoretical";
  evasionTechniques: string[];
}

Exfiltration vectorsCopy Anchor Link

Exfiltration vectors describe how data can be extracted from an AI system. They are based on CVE-2025-32711 (EchoLeak), Lethal Trifecta (Simon Willison), Microsoft MSRC research, and OWASP LLM Security.

import { getExfiltrationByType } from "zeroleaks";

const vectors = getExfiltrationByType("image_url");

Other helpers: allExfiltrationVectors, getZeroClickVectors(), and getNoServerRequired().

assessLethalTrifecta(capabilities) checks an agent description against Simon Willison's lethal trifecta: access to private data, exposure to untrusted content, and a way to send data out. It takes flags such as canReadEmails, processesExternalContent, canRenderImages, and canMakeAPIcalls, and returns isVulnerable, a riskLevel, and recommendations.

Exfiltration typesCopy Anchor Link

The type allows these values. In 1.5.0, only image_url, link_click, and encoded_response have entries.

• image_url: Auto-loading image URLs (EchoLeak)
• link_click: User-triggered link exfiltration
• api_callback: API callback exfiltration
• form_submission: Form-based exfiltration
• websocket: WebSocket exfiltration
• dns_exfil: DNS-based exfiltration
• encoded_response: Encoded data in response

Exfiltration interfaceCopy Anchor Link

interface ExfiltrationVector {
  id: string;
  name: string;
  type: ExfiltrationType;
  source: string;
  realWorldExample?: string;
  description: string;
  mechanism: string;
  template: string;
  encodingMethod?: string;
  requiresExternalServer: boolean;
  requiresUserAction: boolean;
  stealthLevel: "low" | "medium" | "high" | "zero_click";
  detectionDifficulty: "easy" | "moderate" | "hard";
}

Defense bypass methodsCopy Anchor Link

Defense bypass methods describe how to evade common AI safety mechanisms. They are based on Microsoft MSRC, OWASP LLM Top 10 2025, InstructDetector, TopicAttack, CPA-RAG, and CVE-2025-32711 bypass analysis.

import { getBypassMethodsForDefense } from "zeroleaks";

const bypasses = getBypassMethodsForDefense("xpia_classifier");

Other helpers: allBypassMethods, getDocumentedBypassMethods(), getHighSuccessBypassMethods(), and defenseEffectivenessMatrix, which rates each defense type and lists recommendations.

Defense typesCopy Anchor Link

The type allows these values. In 1.5.0, markdown_sanitizer, rate_limiting, and human_in_loop have no bypass entries.

• xpia_classifier: XPIA-style instruction classifiers
• content_filter: Content moderation filters
• markdown_sanitizer: Markdown/link sanitization
• instruction_detection: Instruction pattern detection
• embedding_filter: Embedding-based filtering
• behavioral_monitor: Behavioral monitoring
• output_filter: Output filtering
• rate_limiting: Rate limiting
• human_in_loop: Human review

Bypass interfaceCopy Anchor Link

interface DefenseBypassMethod {
  id: string;
  name: string;
  targetDefense: DefenseType;
  source: string;
  documentedSuccess: boolean;
  description: string;
  mechanism: string;
  technique: string;
  example?: string;
  bypassRate?: number;
  adaptiveResistance: "low" | "medium" | "high";
}

Research referencesCopy Anchor Link

The knowledge base draws from: