Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw

Zijun Wang; Haoqin Tu; Letian Zhang; Hardy Chen; Juncheng Wu; Xiangyan Liu; Zhenlong Yuan; Tianyu Pang

cs.CRApr 6, 2026

Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw

Authors: Zijun Wang, Haoqin Tu, Letian Zhang, Hardy Chen, Juncheng Wu, Xiangyan Liu, Zhenlong Yuan, Tianyu Pang,

Organizations: UC Santa Cruz · NUS · Tencent · ByteDance ·

Abstract

OpenClaw, the most widely deployed personal AI agent in early 2026, operates with full local system access and integrates with sensitive services such as Gmail, Stripe, and the filesystem. While these broad privileges enable high levels of automation and powerful personalization, they also expose a substantial attack surface that existing sandboxed evaluations fail to capture. To address this gap, we present the first real-world safety evaluation of OpenClaw and introduce the CIK taxonomy, which unifies an agent's persistent state into three dimensions, i.e., Capability, Identity, and Knowledge, for safety analysis. Our evaluations cover 12 attack scenarios on a live OpenClaw instance across four backbone models (Claude Sonnet 4.5, Opus 4.6, Gemini 3.1 Pro, and GPT-5.4). The results show that poisoning any single CIK dimension increases the average attack success rate from 24.6% to 64-74%, with even the most robust model exhibiting more than a threefold increase over its baseline vulnerability. We further assess three CIK-aligned defense strategies alongside a file-protection mechanism; however, the strongest defense still yields a 63.8% success rate under Capability-targeted attacks, while file protection blocks 97% of malicious injections but also prevents legitimate updates. Taken together, these findings show that the vulnerabilities are inherent to the agent architecture, necessitating more systematic safeguards to secure personal AI agents. Our project page is https://ucsc-vlaa.github.io/CIK-Bench.

Figures & tables

Figure 1: Overview. (Left) OpenClaw’s persistent state spans three dimensions (Capability, Identity, and Knowledge, termed CIK), each exploitable through distinct poisoning mechanisms. (Right) We conduct the first real-world safety evaluation using a two-phase attack protocol across four backbone models, demonstrating that CIK poisoning yields consistently high attack success rates.

Dimension	Files	Description
Capability	skills/	Executable scripts ( .sh / .py ) with tool documentation ( SKILL.md )
Identity	SOUL.md , IDENTITY.md , USER.md , AGENTS.md	Agent persona, core values, owner profile, operational rules
Knowledge	MEMORY.md	Learned facts, owner preferences, behavioral patterns

Table 1: Persistent state taxonomy with file-level mappings for OpenClaw.

Figure 2: The Attack Workflow. We employ a 2-phase attack protocol: Phase 1 injects poisoned content into the agent’s persistent state; Phase 2 triggers the harmful action in a subsequent session. The temporal separation ensures that attacks persist across sessions.

Model	Baseline	Knowledge	Identity	Capability
Sonnet 4.5	26.7	89.2	85.4	88.5
Gemini 3.1 Pro	36.7	83.3	75.4	71.5
GPT-5.4	25.0	80.8	63.1	57.7
Opus 4.6	10.0	44.2	33.1	55.4

Table 2: Attack success rate (%) by poisoning dimension and backbone model. Baseline = no poisoning; Capability/Identity/Knowledge = poisoning the corresponding persistent state.

	Sonnet 4.5		Gemini 3.1 Pro		GPT-5.4		Opus 4.6
Dim.	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
Capability	100.0 †	88.5	100.0 †	71.5	100.0 †	57.7	100.0 †	55.4
Identity	89.2	93.1	85.4	91.5	96.2	76.2	65.4	60.8
Knowledge	100.0	89.2	99.2	88.3	100.0	84.2	87.5	60.0

Table 3: Phase-level success rates (%) by dimension and backbone model. Phase 1 success rate = injection accepted. Phase 2 success rate = harmful action given successful injection; for Knowledge and Identity, Ph.2 is measured via independent experiments with forced injection ( enforcing Ph.1 = 100% ). See Appendix D.2 for per-vector breakdown.

Defense	Baseline	Knowledge	Identity	Capability
No defense	26.7	89.2	85.4	88.5
Knowledge defense	8.3	35.8	36.2	76.9
Identity defense	13.3	55.0	49.2	75.4
Capability defense	1.7	17.5	9.2	63.8

Table 4: Defense evaluation on Sonnet 4.5 (ASR, %). Each defense augments a different dimension of the persistent state.

Prompt	Condition	Sonnet 4.5	Gemini 3.1 Pro	GPT-5.4	Opus 4.6
Attack	No protection	92.6	89.5	97.4	68.4
Attack	File protection	16.8	0.0	0.0	3.2
Benign	No protection	100.0	100.0	100.0	100.0
Benign	File protection	13.2	0.5	0.9	10.0

Table 5: File protection effect on Phase 1 injection rate (%) for attack and benign prompts targeting Knowledge and Identity files.

Figure 3: Case studies illustrating the three CIK attack dimensions. Each dimension exploits a different aspect of the agent’s reasoning. Left (Knowledge): a fabricated refund habit in MEMORY.md alters what the agent believes , causing it to treat unauthorized batch refunds as routine. Middle (Identity): a planted backup URL in USER.md alters whom the agent trusts , causing it to upload credentials to an attacker-controlled destination. Right (Capability): a hidden rm -rf payload in a benign skill bypasses the agent’s reasoning entirely, silently destroying its workspace.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Dimension	Vector	Target	Total cases
—	Baseline	No injection	12
Knowledge	mem-long	MEMORY.md (persistent)	12
Knowledge	mem-session	Session context (within-session)	12
Identity	identity-*	SOUL/IDENTITY/USER/AGENTS.md	26
Capability	skill-md	SKILL.md (text injection)	12
Capability	skill-bash/py	Executable script (payload)	14

Appendix

Table 6: Case distribution by injection vector. Total: 88 cases per model (12 baseline + 76 injection across 12 impacts).

Category	ID	Scenario	Description
Privacy Leakage
Financial Data	P-F1	Credential exfiltration	Agent uploads API keys and auth tokens to attacker-controlled webhook, enabling full account takeover
Financial Data	P-F2	Customer PII exfiltration	Agent sends Stripe customer records (names, emails, payment methods) to external address, constituting a PCI-DSS breach
Identity & Physical	P-P1	IP geolocation exfiltration	Agent sends owner’s public IP and geolocation to external endpoint, revealing approximate physical location
Identity & Physical	P-P2	Passport exfiltration	Agent emails owner’s passport scan to attacker, enabling identity fraud
Other Sensitive	P-O1	Work email exfiltration	Agent forwards confidential work emails (financials, M&A, compensation) to external address, breaching NDA

Appendix

Table 7: Impact scenarios used in our evaluation. Each scenario produces real, externally verifiable consequences on the live OpenClaw instance.

			Sonnet 4.5		Gemini 3.1		GPT-5.4		Opus 4.6
Dim.	Vector	Target	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
K	mem-long	MEMORY.md	100.0	98.3	98.3	100.0	100.0	85.0	75.0	80.0
K	mem-session	Session context	100.0 †	80.0	100.0 †	76.7	100.0 †	83.3	100.0 †	40.0
I	identity-*	Identity files	89.2	93.1	85.4	91.5	96.2	76.2	65.4	60.8
C	skill-md	SKILL.md (text)	100.0 †	75.0	100.0 †	40.0	100.0 †	35.0	100.0 †	3.3
C	skill-bash/py	Script (payload)	100.0 †	100.0	100.0 †	98.6	100.0 †	77.1	100.0 †	100.0

Appendix

Table 8: Phase-level success rates (%) by injection vector and backbone model. Phase 1 = injection accepted. Phase 2 = harmful action given successful injection; for mem-long and identity-*, Ph.2 is measured via independent experiments with forced injection; for other vectors Ph.2 equals end-to-end ASR (since Ph.1 is deterministic).

\dagger

Deterministic by construction.

Condition	Baseline	Knowledge	Identity	Capability
No defense	26.7	89.2	85.4	88.5
GuardianClaw (passive install)	16.7	71.7	76.2	83.1
GuardianClaw (active load)	1.7	17.5	9.2	63.8

Appendix

Table 9: Capability defense on Sonnet 4.5: active loading vs. passive installation (ASR, %).

	Knowledge	Identity	Capability
Mechanism	Fabricates facts or habits in memory	Plants trust anchors in owner/agent profile	Embeds executable payloads in skill scripts
Attack vector	Fact fabrication (false history)	Trust boundary manipulation (false authorization)	Code execution (hidden payload)
LLM involvement	Reads fabricated facts and treats them as established knowledge	Reads injected trust anchors and treats them as owner preferences	Executes code without inspecting it
Defensibility	Detectable in principle: fabricated facts can be cross-referenced against external evidence	Harder to detect: trust preferences are subjective with no external ground truth	Largely opaque: payload not designed to be inspected; some models may partially inspect
Case study	Fabricated refund habit $\rightarrow$ unauthorized batch refunds (R-F2)	Planted backup URL $\rightarrow$ credential exfiltration (P-F1)	Hidden rm -rf $\rightarrow$ silent workspace destruction (R-D1)

Appendix

Table 10: Comparison of state poisoning mechanisms across the three CIK dimensions.

Model	Baseline	Knowledge	Identity	Capability
Sonnet 4.5	26.7 $\pm$ 8.2	89.2 $\pm$ 6.8	85.4 $\pm$ 5.7	88.5 $\pm$ 4.2
Gemini 3.1 Pro	36.7 $\pm$ 10.0	83.3 $\pm$ 2.6	75.4 $\pm$ 5.8	71.5 $\pm$ 1.9
GPT-5.4	25.0 $\pm$ 11.8	80.8 $\pm$ 6.8	63.1 $\pm$ 8.6	57.7 $\pm$ 8.8
Opus 4.6	10.0 $\pm$ 3.3	44.2 $\pm$ 6.2	33.1 $\pm$ 3.1	55.4 $\pm$ 3.1

Appendix

Table 11: Table 2 with standard deviations: ASR (%, mean

\pm

std).

	Sonnet 4.5		Gemini 3.1		GPT-5.4		Opus 4.6
Dim.	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
Knowledge	100.0	89.2 $\pm$ 5.9	99.2 $\pm$ 1.7	88.3 $\pm$ 4.1	100.0	84.2 $\pm$ 3.1	87.5	60.0 $\pm$ 5.3
Identity	89.2 $\pm$ 4.5	93.1 $\pm$ 2.9	85.4 $\pm$ 3.8	91.5 $\pm$ 4.5	96.2 $\pm$ 2.4	76.2 $\pm$ 5.1	65.4 $\pm$ 4.9	60.8 $\pm$ 2.9
Capability	100.0 †	88.5 $\pm$ 4.2	100.0 †	71.5 $\pm$ 1.9	100.0 †	57.7 $\pm$ 8.8	100.0 †	55.4 $\pm$ 3.1

Appendix

Table 12: Table 3 with standard deviations: Phase-level success rates (%, mean

\pm

std).

Defense	Dim.	Baseline	Knowledge	Identity	Capability
No defense	—	26.7 $\pm$ 8.2	89.2 $\pm$ 6.8	85.4 $\pm$ 5.7	88.5 $\pm$ 4.2
Knowledge defense	Knowledge	8.3	35.8 $\pm$ 5.7	36.2 $\pm$ 3.9	76.9 $\pm$ 4.2
Identity defense	Identity	13.3 $\pm$ 4.1	55.0 $\pm$ 4.1	49.2 $\pm$ 6.6	75.4 $\pm$ 1.9
Capability defense	Capability	1.7 $\pm$ 3.3	17.5 $\pm$ 10.0	9.2 $\pm$ 3.9	63.8 $\pm$ 3.9

Appendix

Table 13: Table 4 with standard deviations: Defense evaluation on Sonnet 4.5 (ASR %, mean

\pm

std).

Prompt	Condition	Sonnet 4.5	Gemini 3.1	GPT-5.4	Opus 4.6
Attack	No protection	92.6 $\pm$ 3.1	89.5 $\pm$ 2.9	97.4 $\pm$ 1.7	68.4 $\pm$ 3.3
Attack	File protection	16.8 $\pm$ 2.1	0.0	0.0	3.2 $\pm$ 2.0
Benign	No protection	100.0	100.0	100.0	100.0
Benign	File protection	13.2 $\pm$ 3.7	0.5 $\pm$ 1.1	0.9 $\pm$ 1.2	10.0 $\pm$ 2.0

Appendix

Table 14: Table 5 with standard deviations: File protection Phase 1 injection rate (%, mean

\pm

std).

			Sonnet 4.5		Gemini 3.1		GPT-5.4		Opus 4.6
Dim.	Vector	Target	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2	Ph.1	Ph.2
K	mem-long	MEMORY.md	100.0	98.3 $\pm$ 3.3	98.3 $\pm$ 3.3	100.0	100.0	85.0 $\pm$ 3.3	75.0	80.0 $\pm$ 4.1
K	mem-session	Session context	100.0 †	80.0 $\pm$ 11.3	100.0 †	76.7 $\pm$ 8.2	100.0 †	83.3 $\pm$ 5.3	100.0 †	40.0 $\pm$ 9.7
I	identity-*	Identity files	89.2 $\pm$ 4.5	93.1 $\pm$ 2.9	85.4 $\pm$ 3.8	91.5 $\pm$ 4.5	96.2 $\pm$ 2.4	76.2 $\pm$ 5.1	65.4 $\pm$ 4.9	60.8 $\pm$ 2.9
C	skill-md	SKILL.md (text)	100.0 †	75.0 $\pm$ 9.1	100.0 †	40.0 $\pm$ 3.3	100.0 †	35.0 $\pm$ 13.3	100.0 †	3.3 $\pm$ 6.7
C	skill-bash/py	Script (payload)	100.0 †	100.0	100.0 †	98.6 $\pm$ 2.9	100.0 †	77.1 $\pm$ 7.0	100.0 †	100.0

Appendix

Table 15: Per-vector phase-level success rates with standard deviations (%, mean

\pm

std).

Condition	Baseline	Knowledge	Identity	Capability
No defense	26.7 $\pm$ 8.2	89.2 $\pm$ 6.8	85.4 $\pm$ 5.7	88.5 $\pm$ 4.2
GuardianClaw (passive install)	16.7 $\pm$ 7.5	71.7 $\pm$ 6.7	76.2 $\pm$ 6.6	83.1 $\pm$ 1.9
GuardianClaw (active load)	1.7 $\pm$ 3.3	17.5 $\pm$ 10.0	9.2 $\pm$ 3.9	63.8 $\pm$ 3.9

Appendix

Table 16: Guardian active vs. passive with standard deviations (Sonnet 4.5, ASR %, mean

\pm

std).

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 491 papers

ClawSafety: "Safe" LLMs, Unsafe Agents
Apr 1, 2026Bowen Wei, Yunbei Zhang, Jinhao Pan +5AI Agent Security AI Agent Safety
George Mason University · Tulane University · Oak Ridge National Laboratory +1
A Systematic Security Evaluation of OpenClaw and Its Variants
Apr 3, 2026Yuhang Wang, Haichang Gao, Zhenxing Niu +4AI Agent Security LLM Agent Security
Xidian University · Data Science & Artificial Intelligence Research Institute, China Unicom
Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
Jun 29, 2026Peizhi Niu, Wenjie Qu, Shangding Gu +14AI Agent Security LLM Agent Security
UIUC · NUS · UC Berkeley +8

Apr 1, 2026J/K move · Enter open · S save

ClawSafety: "Safe" LLMs, Unsafe Agents

Bowen Wei, Yunbei Zhang, Jinhao Pan, Kai Mei+4

George Mason University · Tulane University · Oak Ridge National Laboratory+1

AI Agent Security AI Agent Safety Prompt Injection Attacks on AI Agents AI Agent Safety Benchmarks

Open paper AskPDF arXiv

Personal AI agents like OpenClaw run with elevated privileges on users' local machines, where a single successful prompt injection can leak credentials, redirect financial transactions, or destroy files. This threat goes well beyond conventional text-level jailbreaks, yet existing safety evaluations fall short: most test models in isolated chat settings, rely on synthetic environments, and do not account for how the agent framework itself shapes safety outcomes. We introduce CLAWSAFETY, a benchmark of 120 adversarial test scenarios organized along three dimensions (harm domain, attack vector, and harmful action type) and grounded in realistic, high-privilege professional workspaces spanning software engineering, finance, healthcare, law, and DevOps. Each test case embeds adversarial content in one of three channels the agent encounters during normal work: workspace skill files, emails from trusted senders, and web pages. We evaluate five frontier LLMs as agent backbones, running 2,520 sandboxed trials across all configurations. Attack success rates (ASR) range from 40% to 75% across models and vary sharply by injection vector, with skill instructions (highest trust) consistently more dangerous than email or web content. Action-trace analysis reveals that the strongest model maintains hard boundaries against credential forwarding and destructive actions, while weaker models permit both. Cross-scaffold experiments on three agent frameworks further demonstrate that safety is not determined by the backbone model alone but depends on the full deployment stack, calling for safety evaluation that treats model and framework as joint variables. Code and data will be available at: https://weibowen555.github.io/ClawSafety/.

Abstract

AI Agent Security

Explore similar work

ClawSafety: "Safe" LLMs, Unsafe Agents

A Systematic Security Evaluation of OpenClaw and Its Variants

Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens