ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems
2026-08-31 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors study how large language models that perform complex tasks by using many tools can be tricked with hidden malicious instructions, called prompt injections. They introduce ECLIPSE, a new method that sneaks harmful commands into both the user input and the tools the model uses, making the attack hard to detect. They also created a test set called LASE-Bench to measure how well these attacks work. Their results show that ECLIPSE can successfully hijack the model’s behavior much more often than previous methods, even when safety checks are in place. They conclude that current defenses are not enough to stop these sophisticated prompt injections.
Large Language ModelsPrompt InjectionTool UseAgentic SystemsSandboxingWorkflow EncodingSafety FiltersAttack Success RateBenchmarkingDefenses
Authors
Shiqian Zhao, Yangfan Zhou, Xinfeng Li, Runyi Hu, Yechao Zhang, Yi Xie, Tianwei Zhang, Luu Anh Tuan
Abstract
Recently, large language model (LLM) agents, such as Codex, Claude Code, and OpenClaw, have become capable of planning and executing long-horizon tasks through repeated tool calls. This capability also creates new opportunities for prompt injection. Existing attacks either place the malicious objective in one explicit instruction, making it easy to detect, or distribute the intent across multiple execution stages, making successful completion unreliable. In this work, we propose ECLIPSE, a self-evolving and stealthy prompt-injection framework for long-horizon agentic systems. ECLIPSE combines direct user-prompt injection with indirect tool-side injection through two components. On the one hand, Stealthy Attack Trajectory Synthesis uses a sandbox to generate and iteratively verify candidate tool chains, then renders a verified chain as a natural one-shot prompt to serve as the direct instruction. Then, Tool-Chain Steering transfers this plan to the target environment through Static Workflow Encoding (SWE), which embeds state-transition cues in target-tool descriptions, and Dynamic Trajectory Correction (DTC), which supplies corrective signals when execution deviates from the planned chain. To enable systematic evaluation, we further introduce LASE-Bench, a long-horizon agent-safety benchmark with 120 malicious tasks and 198 unique tools; 96.7% of its tasks make at least five tool calls. The experimental results show that ECLIPSE is highly effective: it achieves up to 96.7% attack success without defense and 69.2% under the common safety filter, exceeding the strongest baseline by 27.5% in the defended setting. Evaluations against representative defenses further show that existing safeguards do not reliably defend it, which raises the need for more effective defenses.