ECLIPSE Self-Evolving Stealthy Prompt Injection Against Long-Horizon Agents
First seen Sep 1, 2026 · Updated Sep 1, 2026
Researchers propose ECLIPSE, a framework that combines direct and indirect prompt injection to hijack long-horizon LLM agents (e.g., Codex, Claude Code) into executing multi-step malicious tool chains while evading detection. This is academic red-teaming research with a benchmark (LASE-Bench), not an observed in-the-wild exploit, but it demonstrates high attack success rates (up to 96.7%, 69.2% under defenses) against realistic multi-tool agent workflows.
Technical Analysis
ECLIPSE synthesizes a verified malicious tool-call chain in a sandbox, then compresses it into a single natural-sounding direct prompt injection to reduce detectability compared to explicit single-instruction attacks. It reinforces this via indirect tool-side injection: Static Workflow Encoding embeds state-transition cues into tool descriptions/metadata, and Dynamic Trajectory Correction injects corrective signals mid-execution if the agent's actual tool-call sequence drifts from the planned malicious trajectory. This lets the attacker maintain control over a long sequence of tool invocations (avg. 5+ calls) without needing an obvious single malicious instruction, crossing from prompt-level influence into sustained multi-tool execution control and bypassing common safety filters designed for single-shot injection detection.
Affected Systems
Codex, Claude Code, OpenClaw
Detection Signatures
- Tool descriptions containing embedded state-transition or workflow-sequencing language inconsistent with the tool's stated function
- Anomalous mid-task corrective instructions appearing in tool outputs or intermediate agent context not originating from the user
- Single natural-language prompts that map to unusually long, precise multi-tool execution plans (5+ calls) without user elaboration
- Deviation-then-realignment patterns in agent tool-call logs suggesting external steering signals
- Unexpected consistency in tool invocation order across sessions despite varying user phrasing
Remediation Steps
- 1
Harden tool description integrity
Validate and sanitize tool/function descriptions and metadata at registration time; monitor for embedded instructional or state-transition language not related to tool functionality.
- 2
Monitor long-horizon execution trajectories
Implement anomaly detection over multi-step tool-call sequences rather than single-instruction filters, flagging trajectories that match known malicious chain patterns.
- 3
Isolate and constrain corrective signal channels
Prevent tool outputs or intermediate results from injecting new directive instructions into the planner's context without explicit trust boundaries.
- 4
Apply least-privilege tool access
Limit the set of tools/capabilities available per task/session to reduce the blast radius of a successfully hijacked long-horizon plan.
- 5
Adopt benchmark-driven red teaming
Use LASE-Bench or similar long-horizon agent safety benchmarks to continuously test agent defenses against multi-step stealthy injection.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.