Research
SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 20 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
SEAL demonstrates why defenders should evaluate whether poisoned tool descriptions or external content can repeatedly steer agent tool selection across multi-round workflows, rather than testing only single interactions.
SEAL is a research method for persistent tool poisoning that optimizes triggers to elicit attack-relevant reasoning prefixes, then aggregates them into a universal trigger across agent contexts and execution rounds. Experiments across seven multi-round scenarios and multiple models report attack effectiveness, cross-model transferability, and resistance to tested defenses.