There are 15 attacks in the memory-exploitation category. Each shows its technique id, mode, standards mapping, description, and the exact command to run it (swap the provider and target as needed).
​
Memory Injection
critical
memory-injection · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Injects fabricated memories or prior conversation history to make the model believe it already agreed to produce harmful contentRun it:
ai-blackteam run -p anthropic -a memory-injection -t "your target prompt"
​
System Prompt Override
critical
system-prompt-override · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Attempts to replace or nullify the system prompt mid-conversation using injected meta-instructionsRun it:
ai-blackteam run -p anthropic -a system-prompt-override -t "your target prompt"
​
Attention Diversion
high
attention-diversion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Buries harmful requests inside long distracting content to divert model attention from safety-relevant portionsRun it:
ai-blackteam run -p anthropic -a attention-diversion -t "your target prompt"
​
Context Fragmentation
high
context-fragmentation · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Spreads a harmful request across multiple messages so no single turn triggers safety filters, then synthesizes the fragmentsRun it:
ai-blackteam run -p anthropic -a context-fragmentation -t "your target prompt"
​
Context Poisoning
high
context-poisoning · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Poisons the conversation context with misleading facts, false authority claims, or fabricated precedents before making the harmful requestRun it:
ai-blackteam run -p anthropic -a context-poisoning -t "your target prompt"
​
Context Window Overflow
high
context-window-overflow · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Floods the context window with benign filler text to push safety instructions out of the model’s effective attention spanRun it:
ai-blackteam run -p anthropic -a context-window-overflow -t "your target prompt"
​
Conversation Hijacking
high
conversation-hijacking · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Hijacks an ongoing benign conversation by injecting a new harmful objective and claiming it is the real purpose of the sessionRun it:
ai-blackteam run -p anthropic -a conversation-hijacking -t "your target prompt"
​
False Consensus
high
false-consensus · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Claims prior agreement to harmful actions across conversation turns, using social pressure and fabricated consensus to override model judgmentRun it:
ai-blackteam run -p anthropic -a false-consensus -t "your target prompt"
​
History Rewriting
high
history-rewriting · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Claims previous turns said something different than they did, attempting to rewrite conversation history to shift model behaviorRun it:
ai-blackteam run -p anthropic -a history-rewriting -t "your target prompt"
​
Instruction Layering
high
instruction-layering · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Stacks contradictory instructions at different priority levels to create ambiguity that the model resolves in favor of the attackerRun it:
ai-blackteam run -p anthropic -a instruction-layering -t "your target prompt"
​
Persona Persistence
high
persona-persistence · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Establishes a permissive persona early in conversation then exploits it across turns to extract harmful contentRun it:
ai-blackteam run -p anthropic -a persona-persistence -t "your target prompt"
​
Semantic Drift
high
semantic-drift · multi-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Gradually shifts the meaning of key terms across conversation turns until harmful content falls under a redefined benign labelRun it:
ai-blackteam run -p anthropic -a semantic-drift -t "your target prompt"
​
State Confusion
high
state-confusion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Confuses the model about its current conversation state by presenting contradictory or ambiguous context signalsRun it:
ai-blackteam run -p anthropic -a state-confusion -t "your target prompt"
​
Temporal Confusion
medium
temporal-confusion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Confuses the model about time and sequence of events to make it believe restrictions were introduced later or have expiredRun it:
ai-blackteam run -p anthropic -a temporal-confusion -t "your target prompt"
​
Token Budget Exhaustion
medium
token-budget-exhaustion · single-turn · OWASP: LLM01 · MITRE: AML.T0054, AML.T0068Exhausts the model’s output token budget with benign content before the harmful request, hoping reduced budget degrades safety checkingRun it:
ai-blackteam run -p anthropic -a token-budget-exhaustion -t "your target prompt"