Foundations for Investigations of Agentic AI Systems from the Forensic Analysis of OpenClaw

Jan Gruber; Jan-Niclas Hilgert

cs.CRApr 7, 2026

Foundations for Investigations of Agentic AI Systems from the Forensic Analysis of OpenClaw

Authors: Jan Gruber, Jan-Niclas Hilgert

Organizations: KASTEL Security Research Labs, Karlsruhe Institute of Technology, Am Fasanengarten 5, 76131 Karlsruhe, Germany · Fraunhofer Institute for Communication, Information Processing and Ergonomics FKIE, Zanderstr. 5, 53177, Bonn, Germany

Abstract

Agentic AI systems are increasingly deployed as personal assistants and virtual employees, and are likely to become a common object of digital investigations and incident response. Yet little is known about how their internal state and actions can be reconstructed during forensic analysis, and systematic forensic approaches remain largely unexplored. We present the first empirical forensic study of a personal AI assistant, with OpenClaw as a case study. We examine its technical design via static code analysis and apply differential forensic analysis to identify recoverable traces across stages of the agent interaction loop. We classify and correlate these traces, structuring the examination around representative investigative questions. We propose a five-plane agent artifact taxonomy that captures recurring investigative patterns; its structural completeness is assessed by cross-mapping against published artifact inventories of two related AI systems. To aid investigations, we release an open-source artifact-extraction tool with a machine-readable schema. Finally, we highlight a foundational challenge: LLM-mediated execution adds both an abstraction layer and substantial nondeterminism to trace generation. Because tool selection and state transitions are co-determined by the model, the execution environment, and the evolving context, identical inputs need not yield identical traces.

Figures & tables

Figure 1. High-level Architecture of OpenClaw. Block diagram with three columns. Left: external services (Telegram, Slack, local OS and APIs, home automation) exchange commands and events with the agent. Center: the OpenClaw agent, consisting of a Gateway for input and output, an execution loop with planning, action, and skills/tool use, and a short-term memory that retrieves from and stores to a local long-term memory for retrieval-augmented generation, built on a vector store, JSONL, and Markdown files as persistent knowledge base. Right: a remote LLM accessed via API receives prompts from and returns completions to the Gateway.

Figure 2. Data generation workflow. Actions

\sigma_{i}

transition the system states

q_{i}

, enabling differential analysis

\delta_{i}

to isolate artifacts. State-machine diagram laid out in three rows: fourteen states, q0 to q13, are connected by solid arrows labeled with actions sigma-1 to sigma-13. Each state is annotated with the action that produced it, such as baseline creation, installing OpenClaw, onboarding, bootstrapping the TUI, sending text, voice, image, and Gmail messages, adding a Google calendar event, remembering a fact, spawning a subagent, and deleting data. Dashed arcs labeled delta-i connect consecutive states, indicating the differential comparison of the corresponding disk images.

Table 1. Overview of OpenClaw artifact locations and their forensic relevance. Phase columns indicate relevance to: Char. = Agent Characterization, Know. = Knowledge Reconstruction, Inter. = Interaction Tracing, Act. = Action Reconstruction. Relevance levels: = primary evidence, = secondary evidence, blank = not relevant.

Figure 3. Agent Artifact Taxonomy for forensic analysis of agentic AI systems. The taxonomy organizes agent-related evidence into five planes, each corresponding to a distinct aspect of the agent’s architecture. Session transcripts are cross-cutting and contribute direct or indirect evidence to multiple planes. Representative OpenClaw artifacts are listed as examples. Tree diagram: the root node, Agent Artifact Taxonomy, branches into five planes. Reasoning and Cognition (the brain) covers model identity and parameters as well as reasoning traces, exemplified by thinking blocks in session transcripts. Identity and Configuration (the DNA) covers core configuration, persona and system prompt, capability manifests, and credentials and permissions, exemplified by openclaw.json, SOUL.md, and auth-profiles.json. Knowledge and Recall (the memory) covers episodic memory, long-term memory, user profile, and semantic index, exemplified by daily memory files, MEMORY.md, USER.md, and the memory SQLite database. Communication and I/O (the ears and mouth) covers channel configuration, companion devices, messages and dialogue, and exchanged media. Actions and Effects (the hands) covers tool invocations, scheduled tasks, subagent delegation, and runtime logs, exemplified by toolCall records, cron jobs, subagent runs, and log files. A note marks session transcripts as cross-cutting evidence contributing to multiple planes.

Taxonomy Plane	OpenClaw (this work)	AutoGen ( Walker et al. (2024) )	ChatGPT Mobile ( Dragonas et al. (2024) )
Reasoning & Cognition	thinking blocks and model_change events in session JSONL; reasoning traces with no analog in traditional software	No reasoning traces recovered or investigated; transient LLM response fragments in volatile memory but recovery inconsistent across tasks; no chain-of-thought, planning step, or inference parameter artifacts	No local reasoning traces (all inference possibly server-side); GPT model version recorded in conversation metadata but contains no chain-of-thought or inference parameters
Identity & Configuration	openclaw.json , persona files ( SOUL.md , IDENTITY.md ), provider credentials in auth-profiles.json	Agent definitions, system prompt, model configuration ( llm_config ), and code execution settings ( work_dir ) in Python source scripts; pyautogen installation footprint in site-packages ; API credentials not recovered	App preferences (BPLIST on iOS, Protobuf on Android), account/user/device/workspace identifiers, subscription plan, custom instructions, authentication tokens
Knowledge & Recall	memory.sqlite with vector embeddings, curated MEMORY.md , daily memory logs, USER.md	Conversational context session-scoped and volatile only (not persisted to disk); logging deprecated since v0.2; no persistent memory, no user profiles, no semantic indices	Conversation SQLite database (Android) and JSON files (iOS); cloud-synced chat history; no persistent agent memory; no local semantic index
Communication & I/O	Multi-channel transcripts (Telegram, WhatsApp), media/inbound/ attachments, channel config in openclaw.json	TLS-encrypted PCAP traces of API connections to OpenAI endpoints; inter-agent dialogue (UserProxyAgent $\leftrightarrow$ AssistantAgent) not persistently logged; message content encrypted under TLS 1.3 (decryption not attempted)	Chat messages in local database and JSON; voice recordings ( .m4a ); text-to-speech narrations; uploaded images and files; cloud export archive
Actions & Effects	toolCall / toolResult pairs in session JSONL, cron/jobs.json and cron/runs/ logs, subagents/runs.json	No structured tool invocation logs or agent delegation records recovered; runtime logging deprecated since v0.2	Minimal: DALL-E image generation among tested actions but no dedicated artifact beyond conversation record; no local tool execution, no scheduled tasks, no autonomous actions

Table 2. Literature-based cross-system mapping of the Agent Artifact Taxonomy. ChatGPT mobile is a cloud-native LLM chat interface without agent capabilities per Section 2.1 ; it is included as an architectural contrast to illustrate the taxonomy’s discriminative scope.

Agentic AI

Agentic artificial intelligence studies systems that plan, use tools, learn from feedback, and act toward goals with varying degrees of autonomy.

See all 212 papers

Clawed and Dangerous: Can We Trust Open Agentic Systems?
Mar 27, 2026Shiping Chen, Qin Wang, Guangsheng Yu +2LLM Agent Security AI Agent Governance
CSIRO Data61 · University of Technology Sydney
A Systematic Security Evaluation of OpenClaw and Its Variants
Apr 3, 2026Yuhang Wang, Haichang Gao, Zhenxing Niu +4AI Agent Security LLM Agent Security
Xidian University · Data Science & Artificial Intelligence Research Institute, China Unicom
Observability for Delegated Execution in Agentic AI Systems
Jun 8, 2026Abhinav Mishra, Kumar SharadAI Agent Auditing AI Agent Monitoring
Splunk, Cisco Inc

Mar 27, 2026J/K move · Enter open · S save

Clawed and Dangerous: Can We Trust Open Agentic Systems?

Shiping Chen, Qin Wang, Guangsheng Yu, Xu Wang+1

CSIRO Data61 · University of Technology Sydney

LLM Agent Security AI Agent Governance AI Agent Auditing AI Agent Security Benchmarks

Open paper AskPDF arXiv

Open agentic systems combine LLM-based planning with external capabilities, persistent memory, and privileged execution. They are used in coding assistants, browser copilots, and enterprise automation. OpenClaw is a visible instance of this broader class. Without much attention yet, their security challenge is fundamentally different from that of traditional software that relies on predictable execution and well-defined control flow. In open agentic systems, everything is ''probabilistic'': plans are generated at runtime, key decisions may be shaped by untrusted natural-language inputs and tool outputs, execution unfolds in uncertain environments, and actions are taken under authority delegated by human users. The central challenge is therefore not merely robustness against individual attacks, but the governance of agentic behavior under persistent uncertainty. This paper systematizes the area through a software engineering lens. We introduce a six-dimensional analytical taxonomy and synthesize 50 papers spanning attacks, benchmarks, defenses, audits, and adjacent engineering foundations. From this synthesis, we derive a reference doctrine for secure-by-construction agent platforms, together with an evaluation scorecard for assessing platform security posture. Our review shows that the literature is relatively mature in attack characterization and benchmark construction, but remains weak in deployment controls, operational governance, persistent-memory integrity, and capability revocation. These gaps define a concrete engineering agenda for building agent ecosystems that are governable, auditable, and resilient under compromise.

Abstract

Agentic AI

Explore similar work

Clawed and Dangerous: Can We Trust Open Agentic Systems?

A Systematic Security Evaluation of OpenClaw and Its Variants

Observability for Delegated Execution in Agentic AI Systems