cs.CRMar 10, 2026

Execution Is the New Attack Surface: Survivability-Aware Agentic Crypto Trading with OpenClaw-Style Local Executors

Authors: Ailiya Borjigin, Igor Stadnyk, Ben Bilski, Serhii Hovorov, Sofiia Pidturkina

Organizations: True Trading

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

OpenClaw-style agent stacks turn language into privileged execution: LLM intents flow through tool interception, policy gates, and a local executor. In parallel, skill marketplaces such as skills.sh make capability acquisition as easy as installing skills and CLIs, creating a growing capability supply chain. Together, these trends shift the dominant safety failure mode from "wrong answers" to execution-induced loss, where untrusted prompts, compromised skills, or narrative manipulation can trigger real trades and irreversible side effects. We propose Survivability-Aware Execution (SAE), an execution-layer survivability standard for OpenClaw-style systems and skill-enabled agents. SAE sits as middleware between a strategy engine (LLM or non-LLM) and the exchange executor. It defines an explicit execution contract (ExecutionRequest, ExecutionContext, ExecutionDecision) and enforces non-bypassable last-mile invariants: projection-based exposure budgets, cooldown and order-rate limits, slippage bounds, staged execution, and tool/venue allowlists. To make delegated execution testable under supply-chain risk, we operationalize the Delegation Gap (DG) via a logged Intended Policy Spec that enables deterministic out-of-scope labeling and reproducible DG metrics. On an offline replay using official Binance USD-M BTCUSDT/ETHUSDT perpetual data (15m; 2025-09-01--2025-12-01, incl. funding), SAE improves survivability: MDD drops from 0.4643 to 0.0319 (Full; 93.1%), |CVaR_0.99| shrinks from 4.025e-3 to ~1.02e-4 (~97.5%), and DG loss proxy falls from 0.647 to 0.019 (~97.0%). AttackSuccess decreases from 1.00 to 0.728 with zero FalseBlock in this run. Block bootstrap, paired Wilcoxon, and two-proportion tests confirm the shifts. SAE reframes agentic trading safety for the OpenClaw+skills era: treat upstream intent and skills as untrusted, and enforce survivability where actions become side effects.

Figures & tables

Figure 1: SAE sits between strategy and executor as a non-bypassable execution layer. The top boxes show a concrete before/after example: an aggressive request is transformed into a constrained executable decision. The internal modules combine regime, trader-state, and trust signals into a policy decision, which is then enforced at the execution boundary.
ComponentHyperparameterDefault
Trader-stateTrade window size NN200
Trader-stateCalibrationisotonic
Trader-stateThresholds (τLIMIT,τBLOCK)(\tau_{\textsf{LIMIT}},\tau_{\textsf{BLOCK}})(0.50, 0.70)
RegimeRealized-vol window (bars) WσW_{\sigma}60
RegimeRegime thresholds (τσ,1,τσ,2)(\tau_{\sigma,1},\tau_{\sigma,2})(1.0, 2.0)
FundingExtreme funding threshold τf\tau_{f}0.01
Table 1: Default SAE hyperparameters (editable in config; tuned via constrained auto-optimization in binance mode).
Threat classSAE mitigations (non-bypassable)
Prompt injection / untrusted instructions(M1) intended-spec allowlists + hard OOS rules; (M3) projection into F(Bt)\mathcal{F}(B_{t}) ; (M4) cooldown/rate limits; (M6) audit.
Skill / plugin supply chain [ 5 ](M2) trust-state tightening ( pprovp^{\mathrm{prov}} ); (M1) tool/venue allowlists; (M3) projection; (M6) audit for provenance.
Narrative contagion in agent networks [ 25 ](M2) narrative/injection flags (optional) + tightening; (M4) temporal invariants; (M1) state-dependent reduce-only modes.
Execution-layer stress (escalation, flooding, slippage abuse)(M3) budget projection; (M4) cooldown/rate caps; (M5) slippage bounds + staging; (M6) traceable enforcement.
Table 2: Threats and SAE mitigation coverage (execution-centric invariants).
VariantMDDCVaR 0.95CVaR 0.99Liq.ASFBLat. (ms)DG rDG ℓ
NoSAE0.4643−1.363×10−3-1.363\times 10^{-3}−4.025×10−3-4.025\times 10^{-3}01.00000.00000.001350.058890.64712
StaticOMS0.1184−2.34×10−4-2.34\times 10^{-4}−5.62×10−4-5.62\times 10^{-4}00.88470.01120.001940.051600.11890
Budget0.03251−5.10×10−5-5.10\times 10^{-5}−1.01×10−4-1.01\times 10^{-4}00.76000.00000.002510.042220.02132
Budget+Cool0.03627−5.90×10−5-5.90\times 10^{-5}−1.03×10−4-1.03\times 10^{-4}00.75880.00000.003210.043330.02553
Full0.03190−4.80×10−5-4.80\times 10^{-5}−1.02×10−4-1.02\times 10^{-4}00.72810.00000.010290.047000.01916
Table 3: Binance replay (BTCUSDT, ETHUSDT; 15m; 2025-09-01–2025-12-01). Metrics aggregated over symbols. StaticOMS denotes a conventional fixed-rule risk layer (fixed leverage cap, stop-loss, rate limit, and position-size limit) without regime detection or trust-state conditioning.
Figure 2: SAE-focused zoom of normalized equity curves (Budget / Budget+Cooldown / Full) on Binance replay. The three SAE variants have close nominal trajectories in this window, motivating tail-risk and robustness metrics as primary endpoints.
Figure 3: Drawdown curves on Binance replay (BTCUSDT+ETHUSDT; 15m; 2025-09-01–2025-12-01). SAE variants sharply reduce maximum drawdown relative to NoSAE .
StatisticNoSAEFull
Mean return 95% block-bootstrap CI[−9.85, −5.01]×10−5[-9.85,\,-5.01]\times 10^{-5}[−2.27, −1.71]×10−5[-2.27,\,-1.71]\times 10^{-5}
Wilcoxon signed-rank ( pp )0.01130.0113
Two-proportion test on AttackSuccess ( pp )1.76×10−81.76\times 10^{-8}
Table 4: Significance summary on Binance replay (NoSAE vs Full).
More in this topic

AI Agent Safety

AI agent safety studies how to prevent and detect harmful actions by autonomous systems that use tools, memory, and multi-step plans.

See all 323 papers

Explore similar work

CardsList
Aug 6, 2026

ChainClaw: A Layered Agent Framework for Reliable On-Chain Execution

General-purpose large language model agents have achieved strong performance on tool-augmented tasks, yet they rely on assumptions break down in blockchain environments. On-chain execution is stateful, adversarial, and economically irreversible, exposing three fundamental gaps: Reactivity, Irreversibility, and Observability. We propose ChainClaw, a blockchain-native agent framework built on OpenClaw, that addresses all three gaps through a layered architecture comprising an event-driven orchestration layer, a simulation-based safety intelligence layer, and an on-chain monitoring runtime layer, unified by a cross-layer memory subsystem. ChainClaw closes the Reactivity gap via event ingestion and simulation feedback, the Irreversibility gap via a pre-execution safety pipeline with transaction simulation and action guard, and the Observability gap via an on-chain read adapter and transaction monitor. We evaluate ChainClaw on a purpose-built benchmark covering seven tasks across four categories and five dimensions. ChainClaw consistently outperforms representative baselines on both safety and task completion.

Jiacheng Wei, Zhaoxin Fan, Xin Wen +5

Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing, Beihang University, Beijing, China · School of Artificial Intelligence, Beihang University, Beijing, China · Zhongguancun Laboratory, Beihang University, Beijing, China +1

LLM Agent OrchestrationAI Agent MonitoringLLM Agent Reliability
AskPDF
Jun 8, 2026

SecureClaw: Clawing Back Control of LLM Agents

Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final output check can intervene. Existing defenses usually protect one boundary, either the planner/runtime or the point where external actions are executed, and therefore do not by themselves secure both surfaces. We present SecureClaw, a dual-boundary architecture that enforces authorization in a trusted executor and keeps raw protected data outside the LLM runtime. Sensitive reads pass through a trusted gateway that replaces raw values with reference IDs. In the evaluated deployment, the gateway also provides short planning summaries that deliberately release selected information, a process called declassification. Writes that change external state follow a PREVIEW→\rightarrowCOMMIT protocol in which only a trusted executor may execute the exact request authorized by policy. The runtime can still plan over summaries and reference IDs, but cannot directly resolve the IDs into secrets or perform side effects. Across the AgentDojo, AgentLeak, and Agent Security Bench (ASB) benchmarks, SecureClaw is the only defense we evaluate in a common harness that simultaneously retains usable task utility and achieves 0% attack success rate (ASR) on ASB, 0.64% ASR on AgentDojo, and 3.23% overall leak on AgentLeak's attacked parity lane, which measures final-output and internal-relay leakage. Code is available at https://github.com/ponyyuhan/SecureClaw.

Yuhan Ma, Stefan Schmid

TU Berlin

Data LeakageLLM Agent SecurityPrivacy Leakage in Language ModelsTool Access Control for LLM AgentsPrivacy Protection for LLM Agents
AskPDF
Apr 1, 2026

ClawSafety: "Safe" LLMs, Unsafe Agents

Personal AI agents like OpenClaw run with elevated privileges on users' local machines, where a single successful prompt injection can leak credentials, redirect financial transactions, or destroy files. This threat goes well beyond conventional text-level jailbreaks, yet existing safety evaluations fall short: most test models in isolated chat settings, rely on synthetic environments, and do not account for how the agent framework itself shapes safety outcomes. We introduce CLAWSAFETY, a benchmark of 120 adversarial test scenarios organized along three dimensions (harm domain, attack vector, and harmful action type) and grounded in realistic, high-privilege professional workspaces spanning software engineering, finance, healthcare, law, and DevOps. Each test case embeds adversarial content in one of three channels the agent encounters during normal work: workspace skill files, emails from trusted senders, and web pages. We evaluate five frontier LLMs as agent backbones, running 2,520 sandboxed trials across all configurations. Attack success rates (ASR) range from 40% to 75% across models and vary sharply by injection vector, with skill instructions (highest trust) consistently more dangerous than email or web content. Action-trace analysis reveals that the strongest model maintains hard boundaries against credential forwarding and destructive actions, while weaker models permit both. Cross-scaffold experiments on three agent frameworks further demonstrate that safety is not determined by the backbone model alone but depends on the full deployment stack, calling for safety evaluation that treats model and framework as joint variables. Code and data will be available at: https://weibowen555.github.io/ClawSafety/.

Bowen Wei, Yunbei Zhang, Jinhao Pan +5

George Mason University · Tulane University · Oak Ridge National Laboratory +1

AI Agent SecurityAI Agent SafetyPrompt Injection Attacks on AI AgentsAI Agent Safety Benchmarks
AskPDF