Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition

Summary

This paper presents Scope-Gap Injection (SGI), an indirect prompt injection method against multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, SGI hides target identifiers, bypass parameters and authorization procedures in an attachment disguised as a business worklist, so the S2 LLM-judge sees only a benign task. SGI bypassed all three evaluation stages for 5 of 19 targets, and attachment placement showed 78% aggregate S2 acceptance versus 23% for in-skill placement.

Mitigation

The paper closes with defenses that align evaluator scope with the channels available to the agent. No specific fix, patch or configuration change is detailed in the source text.

Topics

• Prompt injection and jailbreaks

Related items

• MediumIn-the-Wild Attack Abuses AI Agents' Trust in MarkdownSimilar attack · Dark Reading
• InfoThen there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System SecuritySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumMalicious downloads can trick AI coding agents into compromising themselvesSimilar attack · CSO Online
• InfoCoSA: The Conflict of Skills Attack in Real-World LLM Agent EcosystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoThe Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red TeamingSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)