{"data":{"id":"751d96d8-ffed-4e8e-874e-f34ccd563696","title":"Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition","summary":"This paper presents Scope-Gap Injection (SGI), an indirect prompt injection method against multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, SGI hides target identifiers, bypass parameters and authorization procedures in an attachment disguised as a business worklist, so the S2 LLM-judge sees only a benign task. SGI bypassed all three evaluation stages for 5 of 19 targets, and attachment placement showed 78% aggregate S2 acceptance versus 23% for in-skill placement.","solution":"The paper closes with defenses that align evaluator scope with the channels available to the agent. No specific fix, patch or configuration change is detailed in the source text.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2610.34777v1","publishedAt":"2026-10-26T03:24:52.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-26T03:24:52.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":"preprint","atlasIds":["AML.T0051"]}}