{"data":{"id":"9ad6f934-04dc-41dd-87a3-deaa59f8e542","title":"SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger","summary":"SEAL is a two-stage method for persistent tool poisoning against LLM agents, where malicious instructions in tool descriptions or external resources manipulate tool selection. The authors show that existing tool poisoning attacks, which assume a single interaction round, degrade sharply in multi-round agentic settings because agents do not consistently surface attack-relevant reasoning as planning context evolves. SEAL combines Prefix-Eliciting Trigger Optimization (PETO) with Local-to-Universal Trigger Aggregation (L2U) to build a universal trigger, and experiments across seven multi-round scenarios and several models show its effectiveness, transferability and resistance to potential defenses.","solution":"N/A -- no mitigation discussed in source.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2610.25372v1","publishedAt":"2026-10-18T16:23:17.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["prompt_injection","other"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-18T16:23:17.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":"preprint","atlasIds":["AML.T0051"]}}