Scope-Gap Injection hides agent attack steps in attachments
Original title: Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition
It passed all three OpenClaw judging stages for 5 of 19 targets; the top score was 0.385.
A paper introduces Scope-Gap Injection, an indirect prompt-injection method for multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, submissions face a static skill scan, an LLM-judge check, and a live execution audit. The authors report the judge appears to review the task and skill definition but not attachments, which the agent reads during execution. Benign visible instructions plus a hidden worklist bypassed all three stages for 5 of 19 targets. Attachment placement had 78% aggregate judge acceptance versus 23% for in-skill placement.
Unconfirmed: The scope gap is presented as the authors' observation, not a confirmed judge specification.
- Target identifiers and bypass parameters were placed in a business worklist.
- The highest-scoring submission achieved F = 0.385.
- Authors urge evaluators to inspect every channel the agent can read.
- The claimed gap is between the S2 judge and S3 execution.
From the original article
1 min read at arxiv.orgThis paper introduces Scope-Gap Injection (SGI), an indirect prompt injection method for multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, each attack package is judged by a static skill scan (S1), an LLM-judge safety check over the task and skill definition (S2), and a live execution audit (S3).
By Weihang Niu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.