Scope-gap injection tricks ai safety judges by hiding harmful instructions
Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition
Artificial IntelligenceCryptography and Security
Summary
Some AI systems check the safety of their tasks by looking at written instructions before running them. The authors found a way to sneak dangerous commands into hidden attachments that the safety check misses but the AI uses later. This trick, called Scope-Gap Injection, fooled all safety checks in a competition for several targets. The paper suggests ways to fix this by making safety checks look at all inputs the AI can see.
What this means in practice
- •For security teams: Identify and mitigate risks of hidden instructions sent to AI agents that evade multi-stage safety checks.
- •For ai system architects: Design AI safety evaluations that analyze all data channels the agent uses, including attachments, to close blind spots.
Authors
Weihang Niu, Mengxing Ren, Che Qu
Abstract
This paper introduces Scope-Gap Injection (SGI), an indirect prompt injection method for multi-stage LLM-agent safety pipelines. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, each attack package is judged by a static skill scan (S1), an LLM-judge safety check over the task and skill definition (S2), and a live execution audit (S3). Our observations suggest a scope gap: S2 appears to inspect the task instruction and skill definition without inspecting attachment contents, while the agent reads attachments during S3. SGI keeps the visible task and skill benign, while target identifiers, bypass parameters, and authorization procedures are moved into an attachment written as a business worklist. The S2 judge therefore sees a harmless task, while the agent follows the hidden worklist and triggers the permission bypass. In OpenClaw, SGI bypassed all three stages for 5 of 19 targets. The highest-scoring single submission achieved $F = 0.385$. Across the submission campaign, attachment placement was associated with higher aggregate S2 acceptance than in-skill placement: 78% versus 23%. We close with defenses that align evaluator scope with the channels available to the agent.