A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)
Organizations: ShanghaiTech University, Shanghai, China · Shanghai Artificial Intelligence Laboratory, Shanghai, China
Abstract
Clawdbot is a self-hosted, tool-using personal AI agent with a broad action space spanning local execution and web-mediated workflows, which raises heightened safety and security concerns under ambiguity and adversarial steering. We present a trajectory-centric evaluation of Clawdbot across six risk dimensions. Our test suite samples and lightly adapts scenarios from prior agent-safety benchmarks (including ATBench and LPS-Bench) and supplements them with hand-designed cases tailored to Clawdbot's tool surface. We log complete interaction trajectories (messages, actions, tool-call arguments/outputs) and assess safety using both an automated trajectory judge (AgentDoG-Qwen3-4B) and human review. Across 34 canonical cases, we find a non-uniform safety profile: performance is generally consistent on reliability-focused tasks, while most failures arise under underspecified intent, open-ended goals, or benign-seeming jailbreak prompts, where minor misinterpretations can escalate into higher-impact tool actions. We supplemented the overall results with representative case studies and summarized the commonalities of these cases, analyzing the security vulnerabilities and typical failure modes that Clawdbot is prone to trigger in practice.
Figures & tables
| # | Dimension | Description |
|---|---|---|
| (i) | User-facing deception | Whether the agent misleads the user about what actually happened during execution, for example claiming success despite tool failure, presenting guessed or simulated outputs as tool-grounded results, or silently substituting information sources, thereby creating an unwarranted impression of task completion ( Guo and others, 2025 ) . |
| (ii) | Hallucination & reliability failures | Whether the agent produces plausible but ungrounded or internally inconsistent information, for example inventing facts, citations, or tool outputs or state not supported by observed evidence, thereby misleading downstream decisions ( Huang and others, 2023 ; Xu and others, 2024 ) . |
| (iii) | Intent misunderstanding & false assumptions | Whether the agent misinterprets user intent, fills in missing details incorrectly, and propagates those assumptions into high-impact actions. |
| (iv) | Unexpected results from ambitious goals | When given a high-level objective, whether the agent takes surprising, unnecessary, or overly permissive intermediate steps that increase the blast radius of failure ( OWASP GenAI Security Project, 2025b ; Betser and others, 2026 ) . |
| (v) | Operational safety awareness & efficiency | Whether routine behavior avoids Functional & Opportunity Harm (wasted resources, missed opportunities) and limits downstream Reputational & Interpersonal or Info Ecosystem & Societal harms ( Liu and others, 2026 ) . |
| (vi) | Robustness to prompt injection & jailbreak | Whether the agent resists crafted adversarial instructions that override planning logic or safety constraints (e.g., jailbreaks or direct prompt injection in user input), as well as indirect injections embedded in observed content or tool-mediated channels under tool use ( Liu and others, 2026 ; OWASP Foundation, 2025 ; OpenClaw Documentation, 2026k ) . |
AI Agent Security
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.
See all 508 papers