ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems

arXiv:2608.30441 · cs.CR · Submitted 2026-08-31 · Read on arXiv

cs.CR

Submitted: 2026-08-31

Updated: 2026-09-06

Terminology

• Benchmark — 26× in this paper · explained in 2 episodes
• Trace — 16× in this paper · explained in 2 episodes
• Dynamic Trajectory Correction — 13× in this paper
• Static Workflow Encoding — 13× in this paper
• Verification — 10× in this paper · explained in 2 episodes
• Steering — 9× in this paper · explained in 2 episodes
• Benchmarking — 8× in this paper · explained in 3 episodes
• Agentic System — 7× in this paper · explained in 2 episodes
• Fidelity — 6× in this paper · explained in 2 episodes
• Alignment — 5× in this paper · explained in 1 episode
• Verifier — 5× in this paper · explained in 2 episodes
• Ablation — 4× in this paper · explained in 1 episode
• Ablation study — 4× in this paper · explained in 1 episode
• Foundation Model — 3× in this paper · explained in 3 episodes
• Foundation Models — 3× in this paper · explained in 7 episodes
• Stealthy Attack Trajectory Synthesis — 3× in this paper
• Tool-Chain Steering — 3× in this paper
• Agent Skills — 2× in this paper · explained in 1 episode
• Consistency — 2× in this paper · explained in 3 episodes
• Large Language Model (LLM) — 2× in this paper · explained in 3 episodes
• Model Context Protocol (MCP) — 2× in this paper · explained in 8 episodes
• Residual Error Compensation — 2× in this paper
• Transferability — 2× in this paper · explained in 4 episodes
• Adam — 1× in this paper · explained in 2 episodes
• Adaptation — 1× in this paper · explained in 1 episode
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• Chain-of-Thought Prompting — 1× in this paper · explained in 2 episodes
• Cosine Similarity — 1× in this paper · explained in 3 episodes
• Embeddings — 1× in this paper · explained in 2 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes
• Robustness — 1× in this paper · explained in 5 episodes
• Transformer — 1× in this paper · explained in 2 episodes

Sources

• SecAlign: Defending Against Prompt Injection with Preference Optimization
• Are AI-assisted Development Tools Immune to Prompt Injection?
• SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents
• AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks
• MemGPT: Towards LLMs as Operating Systems
• MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP
• Ignore Previous Prompt: Attack Techniques For Language Models
• AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security
• Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
• WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation
• Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections
• Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
• Prompt Injection Attack to Tool Selection in LLM Agents
• Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning
• LLaMA: Open and Efficient Foundation Language Models
• AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs
• Voyager: An Open-Ended Embodied Agent with Large Language Models
• When Skills Lie: Hidden-Comment Injection in LLM Agents
• ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data
• Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs