Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw

Zijun Wang; Haoqin Tu; Letian Zhang; Hardy Chen; Juncheng Wu; Xiangyan Liu; Zhenlong Yuan; Tianyu Pang

cs.CRApr 6, 2026

Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw

Authors: Zijun Wang, Haoqin Tu, Letian Zhang, Hardy Chen, Juncheng Wu, Xiangyan Liu, Zhenlong Yuan, Tianyu Pang,

Organizations: UC Santa Cruz · NUS · Tencent · ByteDance ·

Abstract

OpenClaw, the most widely deployed personal AI agent in early 2026, operates with full local system access and integrates with sensitive services such as Gmail, Stripe, and the filesystem. While these broad privileges enable high levels of automation and powerful personalization, they also expose a substantial attack surface that existing sandboxed evaluations fail to capture. To address this gap, we present the first real-world safety evaluation of OpenClaw and introduce the CIK taxonomy, which unifies an agent's persistent state into three dimensions, i.e., Capability, Identity, and Knowledge, for safety analysis. Our evaluations cover 12 attack scenarios on a live OpenClaw instance across four backbone models (Claude Sonnet 4.5, Opus 4.6, Gemini 3.1 Pro, and GPT-5.4). The results show that poisoning any single CIK dimension increases the average attack success rate from 24.6% to 64-74%, with even the most robust model exhibiting more than a threefold increase over its baseline vulnerability. We further assess three CIK-aligned defense strategies alongside a file-protection mechanism; however, the strongest defense still yields a 63.8% success rate under Capability-targeted attacks, while file protection blocks 97% of malicious injections but also prevents legitimate updates. Taken together, these findings show that the vulnerabilities are inherent to the agent architecture, necessitating more systematic safeguards to secure personal AI agents. Our project page is https://ucsc-vlaa.github.io/CIK-Bench.

Figures & tables

Figure 1: Overview. (Left) OpenClaw’s persistent state spans three dimensions (Capability, Identity, and Knowledge, termed CIK), each exploitable through distinct poisoning mechanisms. (Right) We conduct the first real-world safety evaluation using a two-phase attack protocol across four backbone models, demonstrating that CIK poisoning yields consistently high attack success rates.

Dimension	Files	Description
Capability	skills/	Executable scripts ( .sh / .py ) with tool documentation ( SKILL.md )
Identity	SOUL.md , IDENTITY.md , USER.md , AGENTS.md	Agent persona, core values, owner profile, operational rules
Knowledge	MEMORY.md	Learned facts, owner preferences, behavioral patterns

Table 1: Persistent state taxonomy with file-level mappings for OpenClaw.

Figure 2: The Attack Workflow. We employ a 2-phase attack protocol: Phase 1 injects poisoned content into the agent’s persistent state; Phase 2 triggers the harmful action in a subsequent session. The temporal separation ensures that attacks persist across sessions.

Model	Baseline	Knowledge	Identity	Capability
Sonnet 4.5	26.7	89.2	85.4	88.5
Gemini 3.1 Pro	36.7	83.3	75.4	71.5
GPT-5.4	25.0	80.8	63.1	57.7
Opus 4.6	10.0	44.2	33.1	55.4

Table 2: Attack success rate (%) by poisoning dimension and backbone model. Baseline = no poisoning; Capability/Identity/Knowledge = poisoning the corresponding persistent state.

	Sonnet 4.5		Gemini 3.1 Pro		GPT-5.4		Opus 4.6
Dim.	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
Capability	100.0 †	88.5	100.0 †	71.5	100.0 †	57.7	100.0 †	55.4
Identity	89.2	93.1	85.4	91.5	96.2	76.2	65.4	60.8
Knowledge	100.0	89.2	99.2	88.3	100.0	84.2	87.5	60.0

Table 3: Phase-level success rates (%) by dimension and backbone model. Phase 1 success rate = injection accepted. Phase 2 success rate = harmful action given successful injection; for Knowledge and Identity, Ph.2 is measured via independent experiments with forced injection ( enforcing Ph.1 = 100% ). See Appendix D.2 for per-vector breakdown.

Defense	Baseline	Knowledge	Identity	Capability
No defense	26.7	89.2	85.4	88.5
Knowledge defense	8.3	35.8	36.2	76.9
Identity defense	13.3	55.0	49.2	75.4
Capability defense	1.7	17.5	9.2	63.8

Table 4: Defense evaluation on Sonnet 4.5 (ASR, %). Each defense augments a different dimension of the persistent state.

Prompt	Condition	Sonnet 4.5	Gemini 3.1 Pro	GPT-5.4	Opus 4.6
Attack	No protection	92.6	89.5	97.4	68.4
Attack	File protection	16.8	0.0	0.0	3.2
Benign	No protection	100.0	100.0	100.0	100.0
Benign	File protection	13.2	0.5	0.9	10.0

Table 5: File protection effect on Phase 1 injection rate (%) for attack and benign prompts targeting Knowledge and Identity files.

Figure 3: Case studies illustrating the three CIK attack dimensions. Each dimension exploits a different aspect of the agent’s reasoning. Left (Knowledge): a fabricated refund habit in MEMORY.md alters what the agent believes , causing it to treat unauthorized batch refunds as routine. Middle (Identity): a planted backup URL in USER.md alters whom the agent trusts , causing it to upload credentials to an attacker-controlled destination. Right (Capability): a hidden rm -rf payload in a benign skill bypasses the agent’s reasoning entirely, silently destroying its workspace.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Dimension	Vector	Target	Total cases
—	Baseline	No injection	12
Knowledge	mem-long	MEMORY.md (persistent)	12
Knowledge	mem-session	Session context (within-session)	12
Identity	identity-*	SOUL/IDENTITY/USER/AGENTS.md	26
Capability	skill-md	SKILL.md (text injection)	12
Capability	skill-bash/py	Executable script (payload)	14

Appendix

Table 6: Case distribution by injection vector. Total: 88 cases per model (12 baseline + 76 injection across 12 impacts).

Category	ID	Scenario	Description
Privacy Leakage
Financial Data	P-F1	Credential exfiltration	Agent uploads API keys and auth tokens to attacker-controlled webhook, enabling full account takeover
Financial Data	P-F2	Customer PII exfiltration	Agent sends Stripe customer records (names, emails, payment methods) to external address, constituting a PCI-DSS breach
Identity & Physical	P-P1	IP geolocation exfiltration	Agent sends owner’s public IP and geolocation to external endpoint, revealing approximate physical location
Identity & Physical	P-P2	Passport exfiltration	Agent emails owner’s passport scan to attacker, enabling identity fraud
Other Sensitive	P-O1	Work email exfiltration	Agent forwards confidential work emails (financials, M&A, compensation) to external address, breaching NDA

Appendix

Table 7: Impact scenarios used in our evaluation. Each scenario produces real, externally verifiable consequences on the live OpenClaw instance.

			Sonnet 4.5		Gemini 3.1		GPT-5.4		Opus 4.6
Dim.	Vector	Target	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
K	mem-long	MEMORY.md	100.0	98.3	98.3	100.0	100.0	85.0	75.0	80.0
K	mem-session	Session context	100.0 †	80.0	100.0 †	76.7	100.0 †	83.3	100.0 †	40.0
I	identity-*	Identity files	89.2	93.1	85.4	91.5	96.2	76.2	65.4	60.8
C	skill-md	SKILL.md (text)	100.0 †	75.0	100.0 †	40.0	100.0 †	35.0	100.0 †	3.3
C	skill-bash/py	Script (payload)	100.0 †	100.0	100.0 †	98.6	100.0 †	77.1	100.0 †	100.0

Appendix

Table 8: Phase-level success rates (%) by injection vector and backbone model. Phase 1 = injection accepted. Phase 2 = harmful action given successful injection; for mem-long and identity-*, Ph.2 is measured via independent experiments with forced injection; for other vectors Ph.2 equals end-to-end ASR (since Ph.1 is deterministic).

\dagger

Deterministic by construction.

Condition	Baseline	Knowledge	Identity	Capability
No defense	26.7	89.2	85.4	88.5
GuardianClaw (passive install)	16.7	71.7	76.2	83.1
GuardianClaw (active load)	1.7	17.5	9.2	63.8

Appendix

Table 9: Capability defense on Sonnet 4.5: active loading vs. passive installation (ASR, %).

	Knowledge	Identity	Capability
Mechanism	Fabricates facts or habits in memory	Plants trust anchors in owner/agent profile	Embeds executable payloads in skill scripts
Attack vector	Fact fabrication (false history)	Trust boundary manipulation (false authorization)	Code execution (hidden payload)
LLM involvement	Reads fabricated facts and treats them as established knowledge	Reads injected trust anchors and treats them as owner preferences	Executes code without inspecting it
Defensibility	Detectable in principle: fabricated facts can be cross-referenced against external evidence	Harder to detect: trust preferences are subjective with no external ground truth	Largely opaque: payload not designed to be inspected; some models may partially inspect
Case study	Fabricated refund habit $\rightarrow$ unauthorized batch refunds (R-F2)	Planted backup URL $\rightarrow$ credential exfiltration (P-F1)	Hidden rm -rf $\rightarrow$ silent workspace destruction (R-D1)

Appendix

Table 10: Comparison of state poisoning mechanisms across the three CIK dimensions.

Model	Baseline	Knowledge	Identity	Capability
Sonnet 4.5	26.7 $\pm$ 8.2	89.2 $\pm$ 6.8	85.4 $\pm$ 5.7	88.5 $\pm$ 4.2
Gemini 3.1 Pro	36.7 $\pm$ 10.0	83.3 $\pm$ 2.6	75.4 $\pm$ 5.8	71.5 $\pm$ 1.9
GPT-5.4	25.0 $\pm$ 11.8	80.8 $\pm$ 6.8	63.1 $\pm$ 8.6	57.7 $\pm$ 8.8
Opus 4.6	10.0 $\pm$ 3.3	44.2 $\pm$ 6.2	33.1 $\pm$ 3.1	55.4 $\pm$ 3.1

Appendix

Table 11: Table 2 with standard deviations: ASR (%, mean

\pm

std).

	Sonnet 4.5		Gemini 3.1		GPT-5.4		Opus 4.6
Dim.	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
Knowledge	100.0	89.2 $\pm$ 5.9	99.2 $\pm$ 1.7	88.3 $\pm$ 4.1	100.0	84.2 $\pm$ 3.1	87.5	60.0 $\pm$ 5.3
Identity	89.2 $\pm$ 4.5	93.1 $\pm$ 2.9	85.4 $\pm$ 3.8	91.5 $\pm$ 4.5	96.2 $\pm$ 2.4	76.2 $\pm$ 5.1	65.4 $\pm$ 4.9	60.8 $\pm$ 2.9
Capability	100.0 †	88.5 $\pm$ 4.2	100.0 †	71.5 $\pm$ 1.9	100.0 †	57.7 $\pm$ 8.8	100.0 †	55.4 $\pm$ 3.1

Appendix

Table 12: Table 3 with standard deviations: Phase-level success rates (%, mean

\pm

std).

Defense	Dim.	Baseline	Knowledge	Identity	Capability
No defense	—	26.7 $\pm$ 8.2	89.2 $\pm$ 6.8	85.4 $\pm$ 5.7	88.5 $\pm$ 4.2
Knowledge defense	Knowledge	8.3	35.8 $\pm$ 5.7	36.2 $\pm$ 3.9	76.9 $\pm$ 4.2
Identity defense	Identity	13.3 $\pm$ 4.1	55.0 $\pm$ 4.1	49.2 $\pm$ 6.6	75.4 $\pm$ 1.9
Capability defense	Capability	1.7 $\pm$ 3.3	17.5 $\pm$ 10.0	9.2 $\pm$ 3.9	63.8 $\pm$ 3.9

Appendix

Table 13: Table 4 with standard deviations: Defense evaluation on Sonnet 4.5 (ASR %, mean

\pm

std).

Prompt	Condition	Sonnet 4.5	Gemini 3.1	GPT-5.4	Opus 4.6
Attack	No protection	92.6 $\pm$ 3.1	89.5 $\pm$ 2.9	97.4 $\pm$ 1.7	68.4 $\pm$ 3.3
Attack	File protection	16.8 $\pm$ 2.1	0.0	0.0	3.2 $\pm$ 2.0
Benign	No protection	100.0	100.0	100.0	100.0
Benign	File protection	13.2 $\pm$ 3.7	0.5 $\pm$ 1.1	0.9 $\pm$ 1.2	10.0 $\pm$ 2.0

Appendix

Table 14: Table 5 with standard deviations: File protection Phase 1 injection rate (%, mean

\pm

std).

			Sonnet 4.5		Gemini 3.1		GPT-5.4		Opus 4.6
Dim.	Vector	Target	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
K	mem-long	MEMORY.md	100.0	98.3 $\pm$ 3.3	98.3 $\pm$ 3.3	100.0	100.0	85.0 $\pm$ 3.3	75.0	80.0 $\pm$ 4.1
K	mem-session	Session context	100.0 †	80.0 $\pm$ 11.3	100.0 †	76.7 $\pm$ 8.2	100.0 †	83.3 $\pm$ 5.3	100.0 †	40.0 $\pm$ 9.7
I	identity-*	Identity files	89.2 $\pm$ 4.5	93.1 $\pm$ 2.9	85.4 $\pm$ 3.8	91.5 $\pm$ 4.5	96.2 $\pm$ 2.4	76.2 $\pm$ 5.1	65.4 $\pm$ 4.9	60.8 $\pm$ 2.9
C	skill-md	SKILL.md (text)	100.0 †	75.0 $\pm$ 9.1	100.0 †	40.0 $\pm$ 3.3	100.0 †	35.0 $\pm$ 13.3	100.0 †	3.3 $\pm$ 6.7
C	skill-bash/py	Script (payload)	100.0 †	100.0	100.0 †	98.6 $\pm$ 2.9	100.0 †	77.1 $\pm$ 7.0	100.0 †	100.0

Appendix

Table 15: Per-vector phase-level success rates with standard deviations (%, mean

\pm

std).

Condition	Baseline	Knowledge	Identity	Capability
No defense	26.7 $\pm$ 8.2	89.2 $\pm$ 6.8	85.4 $\pm$ 5.7	88.5 $\pm$ 4.2
GuardianClaw (passive install)	16.7 $\pm$ 7.5	71.7 $\pm$ 6.7	76.2 $\pm$ 6.6	83.1 $\pm$ 1.9
GuardianClaw (active load)	1.7 $\pm$ 3.3	17.5 $\pm$ 10.0	9.2 $\pm$ 3.9	63.8 $\pm$ 3.9

Appendix

Table 16: Guardian active vs. passive with standard deviations (Sonnet 4.5, ASR %, mean

\pm

std).

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 491 papers

Apr 1, 2026

ClawSafety: "Safe" LLMs, Unsafe Agents

Personal AI agents like OpenClaw run with elevated privileges on users' local machines, where a single successful prompt injection can leak credentials, redirect financial transactions, or destroy files. This threat goes well beyond conventional text-level jailbreaks, yet existing safety evaluations fall short: most test models in isolated chat settings, rely on synthetic environments, and do not account for how the agent framework itself shapes safety outcomes. We introduce CLAWSAFETY, a benchmark of 120 adversarial test scenarios organized along three dimensions (harm domain, attack vector, and harmful action type) and grounded in realistic, high-privilege professional workspaces spanning software engineering, finance, healthcare, law, and DevOps. Each test case embeds adversarial content in one of three channels the agent encounters during normal work: workspace skill files, emails from trusted senders, and web pages. We evaluate five frontier LLMs as agent backbones, running 2,520 sandboxed trials across all configurations. Attack success rates (ASR) range from 40% to 75% across models and vary sharply by injection vector, with skill instructions (highest trust) consistently more dangerous than email or web content. Action-trace analysis reveals that the strongest model maintains hard boundaries against credential forwarding and destructive actions, while weaker models permit both. Cross-scaffold experiments on three agent frameworks further demonstrate that safety is not determined by the backbone model alone but depends on the full deployment stack, calling for safety evaluation that treats model and framework as joint variables. Code and data will be available at: https://weibowen555.github.io/ClawSafety/.

Bowen Wei, Yunbei Zhang, Jinhao Pan +5

George Mason University · Tulane University · Oak Ridge National Laboratory +1

AI Agent Security AI Agent Safety Prompt Injection Attacks on AI Agents AI Agent Safety Benchmarks

Ask PDF

Apr 3, 2026

A Systematic Security Evaluation of OpenClaw and Its Variants

Tool-augmented AI agents substantially extend the practical capabilities of large language models, but they also introduce security risks that cannot be identified through model-only evaluation. In this paper, we present a systematic security assessment of six representative OpenClaw-series agent frameworks, namely OpenClaw, AutoClaw, QClaw, KimiClaw, MaxClaw, and ArkClaw, under multiple backbone models. To support this study, we construct a benchmark of 205 test cases covering representative attack behaviors across the full agent execution lifecycle, enabling unified evaluation of risk exposure at both the framework and model levels. Our results show that all evaluated agents exhibit substantial security vulnerabilities, and that agentized systems are significantly riskier than their underlying models used in isolation. In particular, reconnaissance and discovery behaviors emerge as the most common weaknesses, while different frameworks expose distinct high-risk profiles, including credential leakage, lateral movement, privilege escalation, and resource development. These findings indicate that the security of modern agent systems is shaped not only by the safety properties of the backbone model, but also by the coupling among model capability, tool use, multi-step planning, and runtime orchestration. We further show that once an agent is granted execution capability and persistent runtime context, weaknesses arising in early stages can be amplified into concrete system-level failures. Overall, our study highlights the need to move beyond prompt-level safeguards toward lifecycle-wide security governance for intelligent agent frameworks.

Yuhang Wang, Haichang Gao, Zhenxing Niu +4

Xidian University · Data Science & Artificial Intelligence Research Institute, China Unicom

AI Agent Security LLM Agent Security AI Agent Security Benchmarks

Ask PDF

Jun 29, 2026

Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens

Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services. They take on system-level responsibilities -- installing packages, maintaining state, scheduling subtasks, and mediating I/O -- making security failures far more severe than in other agents. Yet existing benchmarks focus on model responses and tool calls, leaving cross-component failure modes largely unmeasured. We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role, whose Skills resemble user-installed applications, and whose Plugins resemble loadable extensions with runtime privileges. Each component has a classical counterpart whose protection mechanisms -- refined over decades of cybersecurity research -- are absent on the agent side. From this perspective, we develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces (Skill Supply-Chain Integrity, Persistent State Exploitation, Cross-Boundary Data Flow, and Indirect Prompt Injection), executed in containerized replicas of real agent platforms with canary-marked credentials and evaluated via automated taint tracking across nine output channels. We evaluate three platforms (OpenClaw, NemoClaw, SeClaw) and five frontier LLMs. The highest attack success rate reaches 70%; malicious Plugins succeed in 100% of cases regardless of the LLM. SeClaw cuts GPT-5.4's attack success rate from 70% to 22%, partly through utility-security tradeoffs rather than active defenses, while Claude-Opus-4.6 already sits near a 22% floor on every platform. These results expose the inadequacy of current defenses and suggest directions for future hardening. Code and data: https://github.com/sunblaze-ucb/SafeClawArena.

Peizhi Niu, Wenjie Qu, Shangding Gu +14

UIUC · NUS · UC Berkeley +8

AI Agent Security LLM Agent Security AI Agent Security Benchmarks Indirect Prompt Injection Agent Skill Security Auditing

Ask PDF

Abstract

AI Agent Security

Explore similar work

ClawSafety: "Safe" LLMs, Unsafe Agents

A Systematic Security Evaluation of OpenClaw and Its Variants

Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens