SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger

Summary

SEAL is a two-stage method for persistent tool poisoning against LLM agents, where malicious instructions in tool descriptions or external resources manipulate tool selection. The authors show that existing tool poisoning attacks, which assume a single interaction round, degrade sharply in multi-round agentic settings because agents do not consistently surface attack-relevant reasoning as planning context evolves. SEAL combines Prefix-Eliciting Trigger Optimization (PETO) with Local-to-Universal Trigger Aggregation (L2U) to build a universal trigger, and experiments across seven multi-round scenarios and several models show its effectiveness, transferability and resistance to potential defenses.

Related items

• HighCVE-2026-77926: Aix-DB remote code execution through ChatBI common agent execute toolSimilar attack · NVD/CVE Database
• CriticalCVE-2026-75128: Langchain-Chatchat unauthenticated shell command executionSimilar attack · NVD/CVE Database
• HighCVE-2026-109443: JoySafeter remote code execution via unsandboxed execute tool in CopilotSimilar attack · NVD/CVE Database
• HighCVE-2026-109440: LangAlpha indirect prompt injection through agent-retrieved web contentSimilar attack · NVD/CVE Database
• HighCVE-2026-107366: IBM Langflow OSS message endpoints lack ownership verificationSimilar attack · NVD/CVE Database