Scope-Gap Injection：利用 IJCAI 2026 OpenClaw 智能体安全竞赛评估器盲区的间接提示词注入攻击
Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition
AI 导读
论文提出间接提示词注入攻击方法 Scope-Gap Injection（SGI），针对多阶段 LLM 智能体安全流水线的评估器盲区。
正文 · 原文
Abstract:This paper introduces Scope-Gap Injection (SGI), an indirect prompt injection method for multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, each attack package is judged by a static skill scan (S1), an LLM-judge safety check over the task and skill definition (S2), and a live execution audit (S3). Our observations suggest a scope gap: S2 appears to inspect the task instruction and skill definition without inspecting attachment contents, while the agent reads attachments during S3. SGI keeps the visible task and skill benign, while target identifiers, bypass parameters, and authorization procedures are moved into an attachment written as a business worklist. The S2 judge therefore sees a harmless task, while the agent follows the hidden worklist and triggers the permission bypass. In OpenClaw, SGI bypassed all three stages for 5 of 19 targets. The highest-scoring single submission achieved $F = 0.385$. Across the submission campaign, attachment placement was associated with higher aggregate S2 acceptance than in-skill placement: 78% versus 23%. We close with defenses that align evaluator scope with the channels available to the agent.
| Subjects: | Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2610.34777 [cs.AI] |
| (or arXiv:2610.34777v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.34777 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Ren Mengxing [view email]
[v1]
Mon, 26 Oct 2026 03:24:52 UTC (21 KB)
来源：arXiv cs.AI · arxiv.org