ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems
Shiqian Zhao, Yangfan Zhou, Xinfeng Li, Runyi Hu, Yechao Zhang, Yi Xie, Tianwei Zhang, Luu Anh Tuan
cs.CR
2026-08-31
ECLIPSE sandbox-verifies a tool chain, then encodes it in a prompt and MCP descriptions. LASE-Bench: 96.7% ASR undefended, 69.2% with a filter, +27.5 vs the best baseline.
Long-horizon agents now chain five or six tool calls to finish a job. Prompt injection has to survive that many planning cycles.
A single explicit malicious instruction is easy for the agent to follow and easy for an input filter to spot. Spreading the intent across web pages, emails, or successive tool outputs hides it from any one check, but a long chain will drift if one step lands out of order. ObliInjection, WASP, and WebTrap all report that decay.
ECLIPSE tries to keep both properties at once: the user request should read like a normal work order, and the executed tool sequence should still match a chain the attacker already verified. In the threat model the person talking to the agent is the attacker, with black-box queries only. The attacker can also rewrite the natural-language descriptions of tools. Two practical paths: publish a guided tool on MCP marketplaces such as Glama or PulseMCP, or change the description after install, a Rug Pull. Glama already indexed more than 554k MCP tools.
Two stages. Build the chain in a sandbox, then keep the live agent on that chain.
Stealthy Attack Trajectory Synthesis (SATS) spins up a shadow agent whose tool calls return simulated state, never a real side effect. It retrieves task-relevant tools, proposes several candidate chains, and checks each step for tool, arguments, purpose, and expected environment change. Verification has two gates: executability (tool exists, args match the schema, state change matches the prediction) and coherence (each step sets up the next, the final state matches the success mode). Failures come back as structured feedback for up to Rmax revisions. The verified chain is never shown to the victim. A synthesizer follows a minimum-mandatory-requirements rule and turns the causal dependencies into one natural request, with no tool names, parameter names, numbered steps, or attack jargon. An optional persona and constraints such as deadlines or page limits can be added.
Tool-Chain Steering (TCS) is the deployment half. Static Workflow Encoding (SWE) rewrites each on-chain tool description as a triad of precondition, invariant, and next-state, using workflow language (prerequisites, consistency checks, completion states) without naming the global attack goal. Dynamic Trajectory Correction (DTC) compares the observed calls with the plan after every tool use. Three error types: looping on the same tool, reaching an on-chain tool but not its successor, and stalling off-chain. In each case DTC appends a residual workflow-condition signal to that round's tool result and names the next unfinished on-chain tool. The tool implementation and sandbox state stay untouched. Only the text the agent reads changes.
LASE-Bench is new: 120 malicious tasks, 198 tools, and 96.7% of tasks require at least five tool calls (mean 5.525, median 6). About 1.0% of ASSEBench's unsafe records reach that length; SHADE-Arena has none. Coverage includes 42 data-exfiltration tasks, 33 supply-chain, 16 monitoring-evasion, and 10 cloud/IAM. The tool pool has 16 server categories and more than 7,000 functions; each instance exposes the top 50 retrieved tools. Temperature 0, at most 20 agent rounds and 30 tool calls.
Undefended ASR: 96.7% on DeepSeek, 95.0% on GPT-4o, 93.3% on Claude 4.8 Opus. With an external LLM safety filter: 69.2% on DeepSeek, 27.5 points above ObliInjection's 41.7%; 62.5% on GPT-4o (ToolHijacker 59.2%); 62.4% on Claude 4.8 Opus, where the strongest baseline falls to 0.8%.
Newer closed models still leak. GPT-5.6 Luna: 85.8% undefended, 52.5% with the filter. Claude Sonnet 5: 77.5% / 60.0%. Open-source Kimi-k3-7b and QWEN-3.8-27b: 94.2% / 87.3% undefended, 37.2% / 36.9% with the filter.
On short-chain SHADE-Arena under defended DeepSeek, ECLIPSE hits 58.1% ASR versus AdaptiveAttack at 57.7%. The ASR edge is gone. Jaccard / LCS stay highest at 0.859 / 0.740.
Ablation shows where the lift comes from. Prompt-only baseline ASR is 19.2%; adding a persona dips to 17.5%; constraints raise it to 27.5%. Tool-side steering does the rest: DTC alone 37.5%, SWE alone 66.7%, both 69.2%. SWE writes the cross-step dependencies; DTC only patches deployment drift.
Native orchestration: OpenClaw 68.5% undefended / 61.7% defended; Hermes 62.3% / 55.8%. Under defense, ToolHijacker on Hermes drops from 60.0% to 23.3%.
Off-the-shelf defenses do not close the gap. DataSentinel leaves ASR at 85.8%. Tool-Guard leaves 52.5%. The trajectory monitor AgentDoG cuts ASR to 43.3%. SecAlign drives ASR to 0.8%, but the paper's defense-rate metric records 0% because model-level refusal is not counted as runtime interception; that low ASR may also mix in legitimate long-horizon tasks that alignment suppressed.
For anyone running MCP tools, the payload lives in tool descriptions and tool results, not in another jailbreak template. SWE turns tool docs into a state machine. DTC further assumes the attacker can rewrite MCP return text. If a personal assistant installs many third-party tools from a public registry, a Rug Pull can slowly twist a long workflow onto another chain.
For people building agent defenses, short-chain benchmarks understate the problem. LASE-Bench exists so a malicious objective has to survive repeated plan-act-observe cycles. Input-side detectors barely see intent that is split across channels. Trajectory monitors are a better fit and still miss 43.3%, because early calls look like ordinary setup.
A filter that only reads the user request is not enough. Prompt, tool metadata, and cross-step dependencies have to be judged together.
There is no dedicated Limitations section. The threat model is already strong: the attacker is the user, can rewrite tool descriptions, and for DTC can rewrite tool results. That is not the classic setting where a hidden sentence on a web page hijacks someone else's agent.
Every experiment runs in a sandbox; tools return simulated state, not real exfiltration. Temperature 0 and a 20-round cap are lab settings. ASR drops on newer models (Luna, Sonnet 5) and on open-source models once the filter is on. On short chains the ASR edge over AdaptiveAttack nearly vanishes.
The SecAlign 0.8% figure should be discounted: the paper notes it may mix in legitimate long-horizon tasks that alignment also killed. Prompt-only ablation sits near 20% ASR, so the headline 96.7% depends on tool-side poisoning. Those numbers do not transfer to an attacker who only controls the user prompt and cannot touch the MCP server.
The authors flag dual-use risk themselves. Injection prompts tuned against specific live agents are withheld. Code, LASE-Bench, and the tool pool are planned for release.