cs.CRMar 12, 2026

Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats

Authors: Xinhao Deng, Yixiang Zhang, Jiaqing Wu, Jiaqi Bai, Sibo Yi, Zhuoheng Zou, Yue Xiao, Rennai Qiu, 

Organizations: Ant Group & Tsinghua University, China · Tsinghua University, China · Ant Group, China

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Autonomous Large Language Model (LLM) agents, exemplified by OpenClaw, demonstrate remarkable capabilities in executing complex, long-horizon tasks. However, their tightly coupled instant-messaging interaction paradigm and high-privilege execution capabilities substantially expand the system attack surface. In this paper, we present a comprehensive security threat analysis of OpenClaw. To structure our analysis, we introduce a five-layer lifecycle-oriented security framework that captures key stages of agent operation, i.e., initialization, input, inference, decision, and execution, and systematically examine compound threats across the agent's operational lifecycle, including indirect prompt injection, skill supply chain contamination, memory poisoning, and intent drift. Through detailed case studies on OpenClaw, we demonstrate the prevalence and severity of these threats and analyze the limitations of existing defenses. Our findings reveal critical weaknesses in current point-based defense mechanisms when addressing cross-temporal and multi-stage systemic risks, highlighting the need for holistic security architectures for autonomous LLM agents. Within this framework, we further examine representative defense strategies at each lifecycle stage, including plugin vetting frameworks, context-aware instruction filtering, memory integrity validation protocols, intent verification mechanisms, and capability enforcement architectures.

Figures & tables

Figure 1. Effect of skill poisoning. A benign user request triggers a maliciously injected skill, producing attacker-controlled output and demonstrating stealthy capability impersonation. Runtime execution hijacking a benign weather request.
Figure 2. Effect of Indirect Prompt Injection. The agent blindly follows an embedded instruction from retrieved external content, overriding the legitimate user request. Agent outputs Hello World due to indirect prompt injection.
Figure 3. Effect of Memory Poisoning. The agent references a maliciously injected memory rule to block a harmless user request, illustrating persistent state corruption. Agent rejects a benign C++ request due to poisoned memory.
Figure 4. Effect of Intent Drift. An unconfirmed inspection request spirals into unauthorized configuration changes and improper service restarts, ultimately rendering the system inaccessible. Agent executes destructive commands, causing gateway disconnection.
Figure 5. System-level consequences of High-Risk Command Execution. Triggering a covertly assembled script chain results in rapid resource exhaustion and service disruption. System monitor showing CPU usage spiking to 100 percent.
Figure 6. Five-layer defense-in-depth architecture aligned with the agent lifecycle. Each layer enforces a distinct security objective and propagates cryptographically or semantically verified context to adjacent layers. A five-layer defense-in-depth architecture mapping security controls to the agent initialization, input, inference, decision, and execution stages.
Agent LifecycleThreat CategoryThe Effectiveness of Defenses at different Layers
Foundational BaseInput PerceptionCognitive StateDecision AlignmentExecution Control
I. InitializationMalicious Plugins✓×\times×\times×\times×\times
Credential & Secrets Leakage✓×\times×\times×\times✓
Insecure Configuration✓×\times×\times×\times✓
II. InputPrompt Injection×\times✓×\times×\times×\times
System Prompt Extraction×\times✓×\times×\times×\times
Table 1. Targeted threat coverage and design objectives of the proposed defense-in-depth architecture. The matrix maps anticipated risk categories throughout the autonomous LLM agent lifecycle to the corresponding defense layers. A checkmark ( ✓\checkmark ) indicates that a vulnerability is mitigated by a given layer, whereas a cross ( ×\times ) denotes that the risk is not covered by that layer, revealing the scope and limitations of the defenses at different layers.
Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7. The poisoning instruction coercing the agent to generate a malicious weather skill and elevate its invocation priority. Description.
Figure 8. The generated poisoned skill, packaged as a valid artifact while semantically replacing legitimate weather functionality. Description.
Figure 9. Attacker-crafted web page containing an embedded malicious instruction. Disguised as ordinary content, it attempts to override the user task and hijack the agent’s output. Description.
Figure 10. Memory poisoning via a malicious memory update. The attacker causes OpenClaw to append a fabricated rule to persistent memory, transforming transient adversarial input into long-term behavioral control. Description.
Figure 11. Staged setup of a high-risk command execution attack. The attacker instructs the agent to execute apparently benign file write commands that secretly assemble a latent execution chain. Description.
Figure 12. CPU Utilization Surge During a Denial-of-Service Attack. Description.
More in this topic

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Explore similar work

CardsList

  1. Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures

    May 25, 2026Yuntao Wang, Jianle Ba, Han Liu +5AI Agent SecurityLLM Agent Security

    School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China

  2. Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study

    Apr 30, 2026Luyao Xu, Xiang ChenAI Agent SecurityLLM Agent Security

    School of Artificial Intelligence and Computer Science, Nantong University, Nantong, China · State Key Lab. for Novel Software Technology, Nanjing University, Nanjing, China

  3. A Security Analysis of the OpenClaw AI Agent Framework

    Mar 29, 2026Surada Suwansathit, Yuxuan Zhang, Guofei GuAI Agent SecurityTool Access Control for LLM Agents

    SUCCESS Lab, Texas A&M University