The BaseResearcharXiv

Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition

According to the abstract, the authors describe an indirect prompt-injection method that hides bypass instructions in an attachment, so an LLM safety judge sees a harmless task while the agent follows the hidden list. They report results from an IJCAI 2026 agent-security competition and propose defenses.

Open the source ↗

Why it matters

The same thing, for different readers.

For researchers

Niu, Ren and Qu suggest that LLM-judge safety checks miss content in attachments the agent later reads, so evaluators should cover every channel the agent can use.

How the finding was reached

In our words, from the source. Weigh the finding by how it was made.

What was done
Attack packages submitted to the IJCAI 2026 OpenClaw Agent Security Attack Competition, judged by a static scan, an LLM judge and a live execution audit.
What it found
The method bypassed all three stages for 5 of 19 targets; best single submission scored F = 0.385; attachment placement had 78% aggregate judge acceptance versus 23% for in-skill placement.
What it does not show
The authors call the scope gap an observation; this entry rests on the abstract excerpt only.
Status
A preprint: not yet peer reviewed

The record

Questions
Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
People
Weihang Niu (Wrote it) · Mengxing Ren (Wrote it) · Che Qu (Wrote it)
What we read
We have read only the description the publisher gives. No quotations until someone reads the source itself.
Found by
The Radar, run of October 27, 2026, via arxiv-ai-safety-query (tier 1: the source’s own channel or an official record)
Cite this
arXiv, “Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition”, October 26, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-26-scope-gap-injection-openclaw
Our notesLight lane: written from title, author and excerpt only; nothing fetched. Excerpt was cut off.