Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition

Scope-Gap Injection (SGI) is an indirect prompt injection technique that exploits a mismatch between what an LLM judge inspects and what an agent can access during a security competition. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, SGI hides malicious instructions in an attachment that the judge’s safety check (S2) ignores, while the agent reads the attachment during live execution (S3). The method successfully bypassed all three evaluation stages for 5 of 19 targets, achieving a top score of $F = 0.385$, and demonstrated that placing malicious content in attachments yields higher acceptance rates than embedding it directly in the skill definition.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

• llms
• agents
• safety