Scope-Gap Injection and the OpenClaw agent-security lesson
A simple evidence-led deep dive into a new IJCAI 2026 agent-security paper
The short version Researchers found a likely blind spot in a layered AI-agent safety system: one safety checker appears to have reviewed the task and skill instructions, while the executing agent could also read attachments. By placing the dangerous instructions inside an ordinary-looking attachment, the researchers sometimes passed the safety gates and still induced unauthorized actions in a sandboxed competition environment. The lesson is not that "attachments defeat AI safety". The lesson is that a safety system must account for every channel an agent can actually read and every action it can actually take.
1. What happened?
On 26 October 2026, Weihang Niu, Mengxing Ren and Che Qu submitted a paper called "Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition." The paper is also listed among accepted papers for the IJCAI 2026 AI-Safety Workshop.
The work studies a controlled security competition, not a breach of a real company. Participants were deliberately asked to find ways to make an autonomous AI agent carry out unauthorized actions inside simulated smart-home, e-commerce and enterprise-office services. The purpose was red-team research: find the weakness before a real attacker does.
The authors call their method Scope-Gap Injection, or SGI. The name describes the central problem: the scope of what the safety evaluator appears to inspect is narrower than the scope of what the agent itself can later consume during execution.
2. The competition had three gates
OpenClaw's challenge used a funnel-style evaluation. An attack only scored if it made it through the safety layers and then actually produced the forbidden action in the simulated environment.
S1 - Static scan | S2 - Safety judge | S3 - Live execution |
|---|---|---|
Looks for suspicious material and patterns. | An LLM judge decides whether the submitted task appears unsafe. | The agent runs with the full package against mock services; the trajectory is audited. |
The official public challenge page describes S1 as a static analysis of the submitted skill file and S2 as a safety evaluation of the task instruction. The paper gives a somewhat richer description: it says S1 inspected the skill plus attachments, while its working model is that S2 saw the task and skill but not the attachment contents. Because the authors did not have access to the complete backend judge input, the exact internal scope of S2 was inferred rather than directly verified. That uncertainty matters.
3. The scope gap, in ordinary English
Imagine a company has a security desk. Before an employee receives a work package, the desk reads the cover sheet and the job description. Both look harmless, so the package is approved. But once the employee starts working, they also open an attachment that the security desk never meaningfully reviewed. That attachment contains extra instructions telling them to access material they should not access.
That is the architectural shape of SGI. The safety decision and the agent's runtime reality were not based on exactly the same information.
What the safety judge appears to see | What the executing agent can see |
|---|---|
Task instruction Skill definition Looks routine and benign. | Task instruction Skill definition Attachment/worklist The extra file can influence tool use. |
4. How the researchers packaged the attack
The paper describes a three-part package. The direct task was a routine office-style request. The skill definition was written as a generic assistant workflow. The target-specific instructions were placed in an attachment that resembled an internal worklist or compliance ledger.
The task looked like normal workplace administration.
The skill told the agent to read and process a worklist.
The attachment carried the target-specific operational information.
The attachment was written in ordinary business language rather than obvious attack language.
Important safety note This article intentionally does not reproduce the paper's executable bypass procedure, target identifiers, endpoint mappings or authorization steps. The paper itself includes a sanitized example with operational details removed. For our purposes, the architecture is the important part: untrusted instructions were moved into a channel the agent could use but the semantic safety gate apparently did not fully inspect.
5. What actually succeeded?
The competition contained 19 official attack targets. The researchers' highest-scoring returned submission contained seven selected target directories. Five passed all three stages in that return: document reading, document export, smart-home device control, access to layoff information and finance export. Two others were rejected at S2.
The resulting competition score was 0.385. This does not mean the method succeeded on 38.5 percent of real-world systems. It is a competition scoring formula that rewards both coverage and precision.
The paper's most striking comparison concerns where the attack-specific material was placed. Across the authors' submission campaign, S2 accepted 6 of 26 observed in-skill cases (23 percent) and 18 of 23 observed in-attachment SGI cases (78 percent). That is a large difference, but it needs careful interpretation.
Target in best submission | Passed S2? | Reached successful S3? |
|---|---|---|
Document read | Yes | Yes |
Document export | Yes | Yes |
Smart-home control | Yes | Yes |
Layoff-data read | Yes | Yes |
Finance export | Yes | Yes |
6. Why 78% is not a universal exploit rate
This is where the paper is commendably cautious. The placement comparison was not a clean randomized laboratory experiment. It was assembled from repeated competition submissions made while the researchers were iteratively improving their attack. Some identical submissions even received different S2 verdicts in different rounds.
The counts include repeated online verdicts rather than independent matched trials.
The researchers could not see all hidden S2 settings or decoding parameters.
Some targets behaved very differently from others.
All six e-commerce targets failed S2 in the authors' campaign.
The paper did not test SGI against other agent frameworks.
So the correct reading is: the campaign provides evidence consistent with a scope-gap explanation in this competition pipeline. It does not establish that hiding instructions in an attachment will bypass 78 percent of agent safety systems.
7. This is a form of indirect prompt injection
OWASP defines indirect prompt injection as malicious instructions embedded in external material that an AI later retrieves or processes - such as a webpage, document, email, database record or API response. The attacker does not need to type the instruction directly into the chatbot. The content reaches the model through another channel.
SGI is a particularly useful example because the problem is not just that the model can be influenced by a file. The larger failure is architectural: one component makes a safety decision without faithfully representing all of the information another component will later allow to influence actions.
The deeper lesson A safety guard is only as complete as the world it can see. If the agent can read a file, retrieve a RAG chunk, receive a tool result, inspect an email, browse a webpage or inherit memory that the guard did not evaluate, the system has created a possible trust gap.
8. Why this matters outside a competition
The authors do not claim that SGI has been demonstrated against production systems. Their transfer argument is architectural. They say a similar weakness could exist elsewhere when three conditions line up: the agent can read a channel the evaluator omits or reduces; that content can influence tool selection or arguments; and later authorization does not independently bind the action to the approved intent.
Those conditions are plausible in modern agent systems because agents increasingly combine many information sources: user messages, files, RAG retrieval, browser pages, emails, API responses, tool outputs and persistent memory. OWASP and MITRE now treat indirect prompt injection as a major agent-security risk for essentially this reason.
The important point is not "never let an AI read attachments." The point is that untrusted content should remain untrusted even after the agent has read it. Reading data should not automatically grant that data the authority to tell the agent what to do.
9. What defenses does the paper recommend?
The authors explicitly reject the simplistic answer of copying every attachment wholesale into one giant safety-model prompt. That creates cost, latency and parsing problems and can still fail on images, archives, encrypted files or proprietary formats.
Enumerate every artifact the agent can read and record its origin and type.
Hash reviewed artifacts so they cannot be silently changed after approval.
Apply cheap pattern/provenance checks broadly, and deeper semantic review to risky or action-relevant content.
Quarantine unsupported, encrypted or parser-failing formats, or reduce the agent's privileges when handling them.
Bind the safety decision to the exact artifacts that were reviewed.
Use independent least-privilege authorization at the moment a high-impact tool call is attempted.
Use human approval or capability reduction when evidence is ambiguous instead of assuming the model will resolve the ambiguity safely.
This last point is crucial. A guard model is not a substitute for permissions. Even if a malicious instruction reaches the agent, the underlying service should still ask: Who is requesting this? What exact resource? What action? What recipient? What authority? What purpose?
10. A broader OpenClaw pattern
Scope-Gap Injection is not the only 2026 paper examining this family of weaknesses. The IJCAI AI-Safety Workshop accepted several OpenClaw-related papers on work-order camouflage, multi-channel workflow framing, authorization context and prompt-engineering bypasses. A separate paper, "When Approval Becomes Execution," found another kind of gap: an agent could sometimes follow an apparently normal approval workflow and obtain a token that backend services treated as sufficient authorization even though the broader business context had not been bound tightly enough.
These are different attacks, but they point toward the same systems lesson: agent safety cannot live only inside the language model. It has to exist across information channels, tool interfaces, credentials, permissions, audit logs and runtime checks.
11. Bottom line
Scope-Gap Injection does not show that agent safety is hopeless. It shows why safety must be designed as a system rather than as a single filter.
A checker can be excellent at judging the information it receives and still fail if the agent later receives something else. That is the elegant - and slightly alarming - lesson of this paper. The evidence suggests the checker was not shown the whole package.
Sources and evidence status
Primary evidence:
Niu, Ren & Qu - Scope-Gap Injection, arXiv:2610.34777v1 (submitted 26 October 2026) - link
Full experimental HTML version of the Scope-Gap Injection paper - link
IJCAI 2026 - OpenClaw Security Attack and Defense Challenge, official track page - link
IJCAI 2026 AI-Safety Workshop - accepted papers - link
IJCAI 2026 competitions overview - link
OWASP GenAI Security Project - Prompt Injection - link
MITRE ATT&CK T1698 - Indirect Prompt Injection - link
Shi & Mou - When Approval Becomes Execution, arXiv:2610.23077 - link
Evidence status: The central SGI result comes from one controlled competition pipeline. The authors infer the S2 scope from documentation and observed verdicts because the full backend judge input was not available to them. No real systems, users or data were attacked, and the paper does not establish an exploit rate for other agent frameworks. These limits are part of the finding, not footnotes to ignore.