PaperlayerView exact revision on arXiv

Source-linked AI summary

ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems

Shiqian Zhao, Yangfan Zhou, Xinfeng Li, Runyi Hu, Yechao Zhang, Yi Xie, Tianwei Zhang, Luu Anh Tuan

arXiv:2608.30441v1cs.CR

TL;DR

Long-horizon LLM agents remain vulnerable to prompt injection because concentrated attacks are conspicuous while distributed attacks can lose execution fidelity. ECLIPSE combines stealthy trajectory synthesis with tool-chain steering, and achieves high attack success across diverse agent systems, motivating defenses that jointly reason over multiple sources.

  • Problem

    Prompt-injection security for LLM agents performing long-horizon tasks remains insufficiently explored, with stealth and reliable multi-stage execution posing distinct challenges.

  • Method

    ECLIPSE synthesizes and verifies plausible attack chains in a sandbox, renders them as natural prompts, and steers deployment through static workflow encoding and dynamic trajectory correction.

  • Results

    ECLIPSE achieves a peak ASR of 96.7% and an ASR margin of up to 62.4% over the strongest baseline across diverse agents and execution horizons.

  • Takeaways & Limitations

    Existing safeguards do not reliably defend ECLIPSE, indicating a need for defenses that jointly reason over multiple sources.

  • Takeaways & Limitations

    The paper identifies dual-use risk because the published stealth mechanism could be copied by real attackers.

Abstract

from arXiv · show

Recently, large language model (LLM) agents, such as Codex, Claude Code, and OpenClaw, have become capable of planning and executing long-horizon tasks through repeated tool calls. This capability also creates new opportunities for prompt injection. Existing attacks either place the malicious objective in one explicit instruction, making it easy to detect, or distribute the intent across multiple execution stages, making successful completion unreliable. In this work, we propose ECLIPSE, a self-evolving and stealthy prompt-injection framework for long-horizon agentic systems. ECLIPSE combines direct user-prompt injection with indirect tool-side injection through two components. On the one hand, Stealthy Attack Trajectory Synthesis uses a sandbox to generate and iteratively verify candidate tool chains, then renders a verified chain as a natural one-shot prompt to serve as the direct instruction. Then, Tool-Chain Steering transfers this plan to the target environment through Static Workflow Encoding (SWE), which embeds state-transition cues in target-tool descriptions, and Dynamic Trajectory Correction (DTC), which supplies corrective signals when execution deviates from the planned chain. To enable systematic evaluation, we further introduce LASE-Bench, a long-horizon agent-safety benchmark with 120 malicious tasks and 198 unique tools; 96.7% of its tasks make at least five tool calls. The experimental results show that ECLIPSE is highly effective: it achieves up to 96.7% attack success without defense and 69.2% under the common safety filter, exceeding the strongest baseline by 27.5% in the defended setting. Evaluations against representative defenses further show that existing safeguards do not reliably defend it, which raises the need for more effective defenses.

1 Introduction

Long-horizon LLM agents expand prompt-injection opportunities, but existing attacks trade stealth against reliable multi-stage execution. ECLIPSE addresses this trade-off with dual-channel injection, trajectory synthesis, and tool-chain steering, and evaluates it with LASE-Bench.

  • Long-horizon agents can plan and execute extensive multi-step tasks through repeated reasoning, tool use, and environmental feedback.
  • Existing attacks trade detectability for reliability: concentrated objectives are conspicuous, while distributed intent is vulnerable to ordering and execution errors.
  • ECLIPSE combines direct user-prompt and indirect tool-side injection to address stealth and trajectory-fidelity challenges.
  • SATS verifies candidate attack chains in a sandbox and renders a verified chain as a natural one-shot prompt without exposing explicit tool sequences.
  • TCS uses Static Workflow Encoding and Dynamic Trajectory Correction to steer execution toward the planned chain.
  • LASE-Bench contains 120 malicious tasks and 198 unique tools, with 96.7% of tasks requiring at least five tool calls.
  • 96.7% peak ASR and up to 62.4% margin over the strongest baseline were reported across seven agents, with effectiveness across execution horizons and transfer to OpenClaw and Hermes.

2 Related Works

LLM agents extend language models with tools and iterative environment interaction, making prompt injection capable of redirecting execution toward unintended external actions.

  • LLM agents integrate memory, tool use, and iterative environmental feedback to perform complex tasks autonomously.
  • Prompt injection exploits an agent’s inability to reliably distinguish trusted instructions from unauthorized content, potentially redirecting tool-mediated actions.
  • Compared with standalone language models, agent prompt injection can propagate beyond generated text into external actions such as data leakage, fund transfers, or file modification.

3 Problem Formulation

The paper models agents as iterative tool-using systems and defines an attacker who manipulates prompts and tool information to induce prohibited long-horizon outcomes.

  • 3.1 LLM Agent: An agent combines a task prompt, tool identities and metadata, and an initial environment state to generate planned tool-invocation trajectories.
  • 3.1 LLM Agent: After each execution stage, environmental feedback updates the context and the agent revises its subsequent trajectory until success or termination.
  • 3.2 Threat Model: The attacker is an authorized user seeking to override hidden system instructions and induce a prohibited sequence whose final outcome satisfies the attacker’s objective.
  • 3.2 Threat Model: The threat model includes long-horizon exfiltration in which sensitive information is collected, packaged into a legitimate-looking document, and transferred unauthorizedly.
  • 3.2 Threat Model: The attacker has black-box access, can adapt prompts from execution feedback, and can manipulate attacker-controllable tool information.
  • 3.2 Threat Model: Malicious tool publication can place crafted descriptions in public ecosystems, allowing discovered tools to influence the agent’s subsequent tool selection and execution.
  • 3.2 Threat Model: LASE-Bench organizes 120 tasks by dominant security objective, covering diverse operational domains and harm types.
  • 3.2 Threat Model: Post-approval modification of tool descriptors is another modeled risk because updated descriptions can influence tool calls and execution trajectories.

4 LASE-Bench

LASE-Bench evaluates whether injected objectives survive repeated planning, action, and observation cycles using verified long-horizon tool chains across diverse domains.

  • LASE-Bench contains 120 malicious tasks with verified tool chains and 198 unique tools for long-horizon agent-security evaluation.
  • Its task coverage spans infrastructure, cloud services, data pipelines, monitoring, user-facing content, cyberphysical devices, and financial or blockchain assets.

5 Methodology

ECLIPSE addresses the long-horizon trade-off between injection stealthiness and controllability by synthesizing verified attack chains, disguising them as natural prompts, and steering execution through tool-side workflow cues and corrections.

  • Dual Injection Paradigm: ECLIPSE combines direct user-side injection for global task context with indirect tool-side content for localized execution guidance.Tool-side injection operates through pre-deployment tool descriptions and runtime tool results.
  • Stealthy Attack Trajectory Synthesis: SATS uses a sandboxed shadow agent to generate candidate chains, iteratively verify them, and select a chain satisfying the benchmark success mode.Verification checks executability, logical coherence, and purpose alignment, while structured feedback supports refinement.
  • Tool-Chain Steering: DTC compares the observed tool sequence with the verified chain after each call and appends corrective signals to tool results when execution deviates.This runtime correction complements static encoding by addressing discrepancies and accumulated planning or execution errors.
  • Stealthy Attack Trajectory Synthesis: The verified chain is rendered as a plausible one-shot request that preserves causal dependencies while omitting tool names, parameters, numbered steps, and explicit attack terminology.The minimum mandatory requirements principle retains only dependencies needed to induce the target chain, optionally adding personas and practical constraints.
  • Tool-Chain Steering: SWE rewrites target-chain tool descriptions with state-transition cues while preserving their original capabilities and parameter schemas.The rewritten descriptions use prerequisites, consistency checks, and completion states to present the chain as a continuous workflow without explicit poisoning or attack-goal references.

6 Evaluation

The evaluation tests ECLIPSE across long- and short-horizon benchmarks, victim models, agent systems, defenses, and component ablations. Results show strong attack success, trajectory similarity, and transfer across deployment settings.

  • Main Results: 69.2% defended ASR on DeepSeek exceeds ObliInjection by 27.5 percentage points, while undefended ASR reaches 96.7%.ECLIPSE also reaches 62.5% on GPT-4o and 62.4% on Claude 4.8 Opus under defense.
  • Main Results: 58.1% ASR on SHADE-Arena narrowly exceeds AdaptiveAttack’s 57.7% and preserves the strongest trajectory similarity at Jaccard/LCS (0.859,0.740).The comparison supports effectiveness when fewer tool calls are available.
  • Ablation Study: 27.5% ASR with persona and practical constraints outperforms persona alone at 17.5%, while Jaccard/LCS reaches (0.151,0.161).Constraints-only also reaches 24.2% ASR and (0.152,0.158) Jaccard/LCS.
  • Ablation Study: 69.2% ASR with SWE+DTC exceeds DTC alone at 37.5% and SWE alone at 66.7%, with Jaccard/LCS (0.692,0.665) and defense rate 30.8%.The ablation attributes cross-step dependencies mainly to SWE and residual deployment-time correction to DTC.
  • Case Studies: 61.7% defended ASR on OpenClaw and 55.8% on Hermes demonstrate transfer beyond the default ReAct wrapper.ECLIPSE retains high Jaccard/LCS similarity in both native orchestration settings.

7 Potential Defenses

The defense evaluation examines prompt, tool, trajectory, model, and tool-control layers. Existing screening provides only partial protection, while trajectory-level filtering reduces but does not eliminate attack success.

  • Potential Defenses: SecAlign’s zero defense rate results from its model-level refusal interface.Figure 6 reports ASR and defense rate for each potential defense mechanism.
  • Prompt and Tool Screening: Prompt and tool screening leave ECLIPSE at 85.8% ASR with DataSentinel and 52.5% with Tool-Guard.Their defense rates are 14.2% and 31.7%, respectively.
  • Trajectory-Level Filtering: AgentDoG reduces ASR to 43.3% and intercepts 56.7% of instances, but early calls can remain undetected.The reported comparison concerns trajectory-level filtering against ECLIPSE.

8 Conclusion

ECLIPSE combines direct user-prompt injection with indirect tool-side injection to attack long-horizon agentic systems, supported by the LASE-Bench benchmark. Its defense evaluations indicate high practical stealthiness and motivate defenses that jointly reason over multiple sources.

  • ECLIPSE combines direct user-prompt injection with indirect tool-side injection to balance stealthiness and controllability.SATS constructs and verifies attack chains before rendering them as natural one-shot prompts, while TCS uses SWE and DTC to preserve the planned trajectory.
  • LASE-Bench contains 120 malicious tasks and 198 unique tools for evaluating multi-step agent security.
  • Defense results indicate high practical stealthiness because no individual prompt, tool description, or early action exposes the malicious objective.
  • The findings highlight the need for defenses that jointly reason over multiple sources.

Ethical Considerations

The ethical discussion frames ECLIPSE and LASE-Bench as adversarial research focused on vulnerabilities in real-world long-horizon agentic systems. The study used simulated sandboxes, disclosed findings responsibly, withheld deployment-tuned prompts, and describes layered defensive guidance.

  • ECLIPSE and LASE-Bench are adversarial by construction because they describe how an attacker could steer agents toward harmful outcomes.
  • The authors identify dual use as a concern because a published stealth mechanism could be copied by attackers.
  • The authors disclosed findings to affected maintainers, released LASE-Bench for research use, and withheld prompts tuned against specific live deployments.
  • The paper recommends prompt and tool screening, trajectory monitoring, and model-level alignment as complementary defenses.
  • The research was conducted and published to identify weaknesses, improve safety mechanisms, and provide a systematic long-horizon security account.
  • The evaluation involved no human subjects or personal data, and all harmful outcomes occurred in simulated sandboxes.

Open Science

The paper commits to open science by sharing its research outcomes and artifacts. The shared materials include ECLIPSE implementations, the complete LASE-Bench benchmark, and supporting tool and evaluation infrastructure.

  • The authors commit to sharing the research outcomes in an open-access format.
  • The planned artifacts include the ECLIPSE code base, LASE-Bench in full, an MCP-style tool pool, and evaluation harnesses.The code base covers dual-channel injection, SWE, DTC, and sandboxed chain verification; LASE-Bench includes 120 tasks, 198 tools, and success-mode labels.
  • The illustrated task uses an unauthorized instruction to exploit API vulnerabilities and steal sensitive backend data.
  • The appendix describes a red-team run from sandbox chain synthesis through prompt synthesis, SWE, and DTC deployment.

A.1 Task, Success Mode, and Verified Chain

The case study defines a sandbox task through explicit success postconditions, constructs a six-step verified chain, and converts it into a natural one-shot prompt. SWE then embeds chained workflow cues into tool descriptions, while DTC corrects deviations during execution.

  • A.1 Task, Success Mode, and Verified Chain: The sandbox verifier and deployment monitor evaluate the same three success postconditions without using a proxy metric.They require an admin-scoped API key, an authenticated SQL-injection probe, and staged credential and probe output.
  • A.1 Task, Success Mode, and Verified Chain: The verified chain contains six ordered tools whose outputs establish preconditions for subsequent calls.The sequence is get_advisors, readSecurityRule, listCredentials, method_apikeys_create, saveCredential, and sqlmap_wrapper.
  • A.2 One-Shot Synthetic Prompt: The synthetic prompt encodes the chain only through the order of analyst-described needs, without tool names, parameters, or step indices.It presents the requests as a coherent audit narrative with a realistic persona, deadline, and deliverable.
  • A.2 One-Shot Synthetic Prompt: The prompt frames endpoint mapping, edge-case testing, database tracing, and reporting as a legitimate CRM security audit.
  • A.3 Static Workflow Encoding: SWE appends workflow clauses to tool descriptions so each step’s postcondition entails the next step’s precondition.The rewritten descriptions retain the original capability statements and schemas while forming one chained compliance workflow.
  • A.4 Dynamic Trajectory Correction: DTC tracks progress and deviation after each call, then appends corrective signals naming the unsatisfied postcondition and selected correction tool.

A.5 How SWE and DTC Cooperate

SWE carries out planned runs, while DTC corrects deviations using stylistically matched signals that preserve a consistent procedure through task completion.

  • A.5 How SWE and DTC Cooperate: On turn 7, an unmet precondition triggers a CS signal that restarts the chain from its head.The next turn invokes sqlmap_wrapper with the persisted credential, after which fa holds.
  • A.5 How SWE and DTC Cooperate: SWE executes runs that follow the planned chain, while DTC corrects runs that deviate from it.Both mechanisms use clauses parameterized by zt.
  • A.5 How SWE and DTC Cooperate: Because runtime and pre-installed workflow clauses are stylistically identical, the victim agent observes one consistent procedure until fa is satisfied.The trace illustrates this interaction on the same C⋆ chain.
  • A.5 How SWE and DTC Cooperate: The DTC trace appends residual signals to invoked-tool results, with each signal naming the correction tool used.The trace tags SD, LE, and CS as STANDARD_DEVIATION, LOOP_ESCALATION, and CHAIN_STALL; tool implementations and environmental transitions remain unchanged.

B.1 Stage 1: Benign Long-Horizon Task Generation

LASE-Bench is constructed by generating benign multi-step workloads, screening them for stable long-horizon execution, and rewriting survivors into malicious instances with verifiable outcomes.

  • Stage 1: Benign Long-Horizon Task Generation: Stage 1 generates realistic multi-step workloads from samples of roughly 13,000 tool descriptions extracted from more than 1,000 public tool sources.The workloads span deployments, audits, integrations, and reports across multiple tool domains.
  • Stage 1: Benign Long-Horizon Task Generation: The generator uses a separate, broader description pool than the execution registry so tasks are phrased as goals rather than copied tool recipes.Covered domains include DevOps, databases, cloud services, communication, office productivity, search, IoT, and security tooling.
  • Stage 1: Benign Long-Horizon Task Generation: Each candidate is rerun five times, and only tasks completing with at least five calls in at least four runs are retained.Failed candidates are regenerated with higher sampling temperature and re-enter the same screen, yielding exactly 120 stable tasks.
  • Stage 1: Benign Long-Horizon Task Generation: Stage 3 rewrites each surviving benign goal into an attack_goal while preserving its operational context and chain length.Success labels are written from the attack goal as checkable postconditions on raw tool returns, and the same clauses score attack success.
  • Stage 1: Benign Long-Horizon Task Generation: All construction and validation stages run in per-instance emulated sandboxes, so benchmark harms represent simulated state transitions rather than real infrastructure events.Released instances include the configuration, attack plan, verified chain, explanations, and scoring label.
Loading 2608.30441v1…