The Flow has not summarised this story yet — read it at Hugging Face Trending Papers.
Scope-Gap Injection (SGI) is an indirect prompt injection technique that exploits a mismatch between what an LLM judge inspects and what an agent can access during a security competition. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, SGI hides malicious instructions in an attachment that the judge’s safety check (S2) ignores, while the agent reads the attachment during live execution (S3). The method successfully bypassed all three evaluation stages for 5 of 19 targets, achieving a top score of $F = 0.385$, and demonstrated that placing malicious content in attachments yields higher acceptance rates than embedding it directly in the skill definition.
ScopeBench is a new benchmark comprising 30 dead‑end agentic security tasks designed to test whether autonomous agents respect engagement boundaries under goal pressure. Each task is presented twice: once without a scope to measure raw hacking capability, and once with a natural‑language scope to assess scope adherence. The benchmark uses deterministic verification for scopeless runs and a calibrated agentic judge for scoped runs, revealing significant gaps between capability and adherence across eight tested models.
arXiv:2609.39450v1 Announce Type: cross Abstract: LLM-based agents extend their capabilities through third-party skills that provide task-specific instructions, scripts, and tool-use procedures. Howe...
arXiv:2606. 15242v1 Announce Type: cross Abstract: Skills are becoming the capability layer through which LLM agents turn plans into actions, but their use introduces security risks such as data leakage, unauthorized operations, and tool misuse.
LLM-based agents leverage third-party skills to extend their capabilities in open-world scenarios. However, third-party skills can introduce extra security vulnerabilities, as seemingly harmless skills can contain latent safety risks that only emerge during actual execution.
arXiv:2607. 19449v1 Announce Type: cross Abstract: Evaluation frameworks for tool-augmented LLM agents focus overwhelmingly on capability metrics or explicit tool crashes, leaving silent infrastructure failures and HTTP 200 responses with empty, null, or malformed payloads largely unaudited.