highAgent ThreatPrompt Injection

ECLIPSE Self-Evolving Stealthy Prompt Injection Against Long-Horizon Agents

First seen Sep 1, 2026 · Updated Sep 1, 2026

prompt-injectionlong-horizon-agentstool-chain-hijackstealthy-attackresearchbenchmarkagentic-aiLLM-agentsASI01 · Goal HijackingAML.T0051AML.T0054Surface: PlannerPropagation: Single Hop

Researchers propose ECLIPSE, a framework that combines direct and indirect prompt injection to hijack long-horizon LLM agents (e.g., Codex, Claude Code) into executing multi-step malicious tool chains while evading detection. This is academic red-teaming research with a benchmark (LASE-Bench), not an observed in-the-wild exploit, but it demonstrates high attack success rates (up to 96.7%, 69.2% under defenses) against realistic multi-tool agent workflows.

Technical Analysis

ECLIPSE synthesizes a verified malicious tool-call chain in a sandbox, then compresses it into a single natural-sounding direct prompt injection to reduce detectability compared to explicit single-instruction attacks. It reinforces this via indirect tool-side injection: Static Workflow Encoding embeds state-transition cues into tool descriptions/metadata, and Dynamic Trajectory Correction injects corrective signals mid-execution if the agent's actual tool-call sequence drifts from the planned malicious trajectory. This lets the attacker maintain control over a long sequence of tool invocations (avg. 5+ calls) without needing an obvious single malicious instruction, crossing from prompt-level influence into sustained multi-tool execution control and bypassing common safety filters designed for single-shot injection detection.

Affected Systems

Codex, Claude Code, OpenClaw

Detection Signatures

  • Tool descriptions containing embedded state-transition or workflow-sequencing language inconsistent with the tool's stated function
  • Anomalous mid-task corrective instructions appearing in tool outputs or intermediate agent context not originating from the user
  • Single natural-language prompts that map to unusually long, precise multi-tool execution plans (5+ calls) without user elaboration
  • Deviation-then-realignment patterns in agent tool-call logs suggesting external steering signals
  • Unexpected consistency in tool invocation order across sessions despite varying user phrasing

Remediation Steps

  1. 1

    Harden tool description integrity

    Validate and sanitize tool/function descriptions and metadata at registration time; monitor for embedded instructional or state-transition language not related to tool functionality.

  2. 2

    Monitor long-horizon execution trajectories

    Implement anomaly detection over multi-step tool-call sequences rather than single-instruction filters, flagging trajectories that match known malicious chain patterns.

  3. 3

    Isolate and constrain corrective signal channels

    Prevent tool outputs or intermediate results from injecting new directive instructions into the planner's context without explicit trust boundaries.

  4. 4

    Apply least-privilege tool access

    Limit the set of tools/capabilities available per task/session to reduce the blast radius of a successfully hijacked long-horizon plan.

  5. 5

    Adopt benchmark-driven red teaming

    Use LASE-Bench or similar long-horizon agent safety benchmarks to continuously test agent defenses against multi-step stealthy injection.

Industries Most Exposed

software developmenttechnologycloud servicesenterprise automationany sector deploying autonomous coding/agentic assistants

Sources

Respond to this threat

Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.