cs.CRMar 12, 2026

Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats

Authors: Xinhao Deng, Yixiang Zhang, Jiaqing Wu, Jiaqi Bai, Sibo Yi, Zhuoheng Zou, Yue Xiao, Rennai Qiu, 

Organizations: Ant Group & Tsinghua University, China · Tsinghua University, China · Ant Group, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Autonomous Large Language Model (LLM) agents, exemplified by OpenClaw, demonstrate remarkable capabilities in executing complex, long-horizon tasks. However, their tightly coupled instant-messaging interaction paradigm and high-privilege execution capabilities substantially expand the system attack surface. In this paper, we present a comprehensive security threat analysis of OpenClaw. To structure our analysis, we introduce a five-layer lifecycle-oriented security framework that captures key stages of agent operation, i.e., initialization, input, inference, decision, and execution, and systematically examine compound threats across the agent's operational lifecycle, including indirect prompt injection, skill supply chain contamination, memory poisoning, and intent drift. Through detailed case studies on OpenClaw, we demonstrate the prevalence and severity of these threats and analyze the limitations of existing defenses. Our findings reveal critical weaknesses in current point-based defense mechanisms when addressing cross-temporal and multi-stage systemic risks, highlighting the need for holistic security architectures for autonomous LLM agents. Within this framework, we further examine representative defense strategies at each lifecycle stage, including plugin vetting frameworks, context-aware instruction filtering, memory integrity validation protocols, intent verification mechanisms, and capability enforcement architectures.

Figures & tables

Figure 1. Effect of skill poisoning. A benign user request triggers a maliciously injected skill, producing attacker-controlled output and demonstrating stealthy capability impersonation. Runtime execution hijacking a benign weather request.
Figure 2. Effect of Indirect Prompt Injection. The agent blindly follows an embedded instruction from retrieved external content, overriding the legitimate user request. Agent outputs Hello World due to indirect prompt injection.
Figure 3. Effect of Memory Poisoning. The agent references a maliciously injected memory rule to block a harmless user request, illustrating persistent state corruption. Agent rejects a benign C++ request due to poisoned memory.
Figure 4. Effect of Intent Drift. An unconfirmed inspection request spirals into unauthorized configuration changes and improper service restarts, ultimately rendering the system inaccessible. Agent executes destructive commands, causing gateway disconnection.
Figure 5. System-level consequences of High-Risk Command Execution. Triggering a covertly assembled script chain results in rapid resource exhaustion and service disruption. System monitor showing CPU usage spiking to 100 percent.
Figure 6. Five-layer defense-in-depth architecture aligned with the agent lifecycle. Each layer enforces a distinct security objective and propagates cryptographically or semantically verified context to adjacent layers. A five-layer defense-in-depth architecture mapping security controls to the agent initialization, input, inference, decision, and execution stages.
Agent LifecycleThreat CategoryThe Effectiveness of Defenses at different Layers
Foundational BaseInput PerceptionCognitive StateDecision AlignmentExecution Control
I. InitializationMalicious Plugins✓×\times×\times×\times×\times
Credential & Secrets Leakage✓×\times×\times×\times✓
Insecure Configuration✓×\times×\times×\times✓
II. InputPrompt Injection×\times✓×\times×\times×\times
System Prompt Extraction×\times✓×\times×\times×\times
Table 1. Targeted threat coverage and design objectives of the proposed defense-in-depth architecture. The matrix maps anticipated risk categories throughout the autonomous LLM agent lifecycle to the corresponding defense layers. A checkmark ( ✓\checkmark ) indicates that a vulnerability is mitigated by a given layer, whereas a cross ( ×\times ) denotes that the risk is not covered by that layer, revealing the scope and limitations of the defenses at different layers.
Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7. The poisoning instruction coercing the agent to generate a malicious weather skill and elevate its invocation priority. Description.
Figure 8. The generated poisoned skill, packaged as a valid artifact while semantically replacing legitimate weather functionality. Description.
Figure 9. Attacker-crafted web page containing an embedded malicious instruction. Disguised as ordinary content, it attempts to override the user task and hijack the agent’s output. Description.
Figure 10. Memory poisoning via a malicious memory update. The attacker causes OpenClaw to append a fabricated rule to persistent memory, transforming transient adversarial input into long-term behavioral control. Description.
Figure 11. Staged setup of a high-risk command execution attack. The attacker instructs the agent to execute apparently benign file write commands that secretly assemble a latent execution chain. Description.
Figure 12. CPU Utilization Surge During a Denial-of-Service Attack. Description.
More in this topic

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Explore similar work

CardsList
May 25, 2026

Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures

The rapid evolution of large language model (LLM)-driven autonomous agents has given rise to OpenClaw, a new class of open-source agent frameworks that operate as continuously running, skill-augmented systems with persistent memory, multi-channel interaction, and high degrees of autonomy. Such capabilities enable OpenClaw agents to autonomously execute complex, multi-step tasks and interact seamlessly with external applications, but simultaneously introduce a substantially enlarged attack surface. In particular, the combination of high-privilege operations and persistent memory exposes OpenClaw agents to various emerging threats, including skill poisoning, cognitive manipulation, multi-agent cascading failures, and supply-chain vulnerabilities. In this survey, we present a comprehensive study of the security landscape of OpenClaw agents. We first examine the general architecture and key characteristics that distinguish OpenClaw agents from traditional AI agent systems. We categorize existing security and privacy threats into a layered framework and analyze how vulnerabilities arise during agent reasoning, action execution, and external interaction. Representative defense mechanisms are also reviewed to draw the current defense landscape. Finally, several unresolved issues related to the reliability and trustworthiness of OpenClaw ecosystems are discussed.

Yuntao Wang, Jianle Ba, Han Liu +5

School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China

AI Agent SecurityLLM Agent SecurityMulti-Agent System Security
AskPDF
Apr 30, 2026

Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study

Autonomous agent frameworks built upon large language models (LLMs) are evolving into complex, tool-integrated, and continuously operating systems, introducing security risks beyond traditional prompt-level vulnerabilities. As this paradigm is still at an early stage of development, a timely and systematic understanding of its security implications is increasingly important. Although a growing body of work has examined different attack surfaces and defense problems in agent systems, existing studies remain scattered across individual aspects of agent security, and there is still a lack of a layered review on this topic. To address this gap, this survey presents a layered review of security risks and defense strategies in autonomous agent frameworks, with OpenClaw as a case study. We organize the analysis into four security-relevant layers: the context and instruction layer, the tool and action layer, the state and persistence layer, and the ecosystem and automation layer. For each layer, we summarize its functional role, representative security risks, and corresponding defense strategies. Based on this layered analysis, we further identify that threats in autonomous agent frameworks may propagate across layers, from manipulated inputs to unsafe actions, persistent state contamination, and broader ecosystem-level impact. Finally, we highlight potential key challenges, including research imbalance across layers, the lack of long-horizon evaluation, and weak ecosystem trust models, and outline future directions toward more systematic and integrated defenses.

Luyao Xu, Xiang Chen

School of Artificial Intelligence and Computer Science, Nantong University, Nantong, China · State Key Lab. for Novel Software Technology, Nanjing University, Nanjing, China

AI Agent SecurityLLM Agent Security
AskPDF
Mar 29, 2026

A Security Analysis of the OpenClaw AI Agent Framework

AI agent frameworks connecting large language model (LLM) reasoning to host execution surfaces -- shell, filesystem, containers, and messaging -- introduce security challenges structurally distinct from conventional software. We present a systematic taxonomy of 470 advisories filed against OpenClaw, an open-source AI agent runtime, organized by architectural layer and trust-violation type. Vulnerabilities cluster along two orthogonal axes: (1) the system axis, reflecting the architectural layer (exec policy, gateway, channel, sandbox, browser, plugin, agent/prompt); and (2) the attack axis, reflecting adversarial techniques (identity spoofing, policy bypass, cross-layer composition, prompt injection, supply-chain escalation). Patch-differential evidence yields three principal findings. First, three Moderate- or High-severity advisories in the Gateway and Node-Host subsystems compose into a complete unauthenticated remote code execution (RCE) path -- spanning delivery, exploitation, and command-and-control -- from an LLM tool call to the host process. Second, the exec allowlist, the primary command-filtering mechanism, relies on a closed-world assumption that command identity is recoverable via lexical parsing. This is invalidated by shell line continuation, busybox multiplexing, and GNU option abbreviation. Third, a malicious skill distributed via the plugin channel executed a two-stage dropper within the LLM context, bypassing the exec pipeline and demonstrating that the skill distribution surface lacks runtime policy enforcement. The dominant structural weakness is per-layer trust enforcement rather than unified policy boundaries, making cross-layer attacks resilient to local remediation.

Surada Suwansathit, Yuxuan Zhang, Guofei Gu

SUCCESS Lab, Texas A&M University

AI Agent SecurityTool Access Control for LLM AgentsAgent Skill Security Auditing
AskPDF