ClawLess: A Security Model of AI Agents

Hongyi Lu; Nian Liu; Shuai Wang; Fengwei Zhang

cs.CRApr 7, 2026

ClawLess: A Security Model of AI Agents

Authors: Hongyi Lu, Nian Liu, Shuai Wang, Fengwei Zhang

Organizations: Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology, China · Department of Computer Science and Engineering, Southern University of Science and Technology · Department of Computer Science and Engineering, Hong Kong University of Science and Technology · Department of Computer Science and Engineering, Southern University of Science and Technology, China ·

Abstract

Autonomous AI agents powered by Large Language Models can reason, plan, and execute complex tasks, but their ability to autonomously retrieve information and run code introduces significant security risks. Existing approaches attempt to regulate agent behavior through training or prompting, which does not offer fundamental security guarantees. We present ClawLess, a security framework that enforces formally verified policies on AI agents under a worst-case threat model where the agent itself may be adversarial. ClawLess formalizes a fine-grained security model over system entities, trust scopes, and permissions to express dynamic policies that adapt to agents' runtime behavior. These policies are translated into concrete security rules and enforced through a user-space kernel augmented with BPF-based syscall interception. This approach bridges the formal security model with practical enforcement, ensuring security regardless of the agent's internal design.

Figures & tables

Type	Example	HW	Indep. Kernel	Compatibility 1 1 footnotemark: 1	Interoperability 2 2 footnotemark: 2	Deployability 3 3 footnotemark: 3	Security
Standard Container	Docker	No	No	High	High	High	Low
User-space Kernel	gVisor	No	Nested	High	High	High	High
Virtualization	Kata Container	VM	VM	High	Medium	Low	High
Confidential Container	CoCo	TEE	VM	Low	Low	Low	Highest

Table 1. Comparison between secure containers.

Figure 1. Architectures of secure containers.

Figure 3. Overview of ClawLess .

	File	Directory	Process	Socket	Device
Read	Read	List	IPC primitives	Receive	Device dependent
Write	Write	Create Delete	IPC primitives	Send
Append	Append	Create only	/	/
NoExec	No Exec.	/	No Fork	/
Visible	View/reference the entity

Table 5

	Read	Write	Append	NoExec	Visible
File	read/mmap/sendfile/…	write/mmap/sendfile/…	lseek/open/…	execve	stat
Directory	getdents	mkdir/rmdir/creat/…	mkdir/creat/…	/
Socket	recvfrom/recvmsg/…	sendto/sendmsg/…	/	/
Device	ioctl/iopc/…			/
Process	semget/semop/semctl/…			clone/fork	proc fs

Table 2. Mapping from ClawLess ’s security model to system calls.

Figure 4. Syscall interception.

Figure 5. Handler for syscall read .

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

A Systematic Security Evaluation of OpenClaw and Its Variants
Apr 3, 2026Yuhang Wang, Haichang Gao, Zhenxing Niu +4AI Agent Security LLM Agent Security
Xidian University · Data Science & Artificial Intelligence Research Institute, China Unicom
AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents
Apr 27, 2026Yixiang Zhang, Xinhao Deng, Jiaqing Wu +3AI Agent Security LLM Agent Security
Provably Secure Agent Guardrail
May 28, 2026Benlong Wu, Weiming Zhang, Kejiang Chen +2LLM Guardrails AI Agent Security
University of Science and Technology of China

Apr 3, 2026J/K move · Enter open · S save

A Systematic Security Evaluation of OpenClaw and Its Variants

Yuhang Wang, Haichang Gao, Zhenxing Niu, Zhaoxiang Liu+3

Xidian University · Data Science & Artificial Intelligence Research Institute, China Unicom

AI Agent Security LLM Agent Security AI Agent Security Benchmarks

Open paper AskPDF arXiv

Tool-augmented AI agents substantially extend the practical capabilities of large language models, but they also introduce security risks that cannot be identified through model-only evaluation. In this paper, we present a systematic security assessment of six representative OpenClaw-series agent frameworks, namely OpenClaw, AutoClaw, QClaw, KimiClaw, MaxClaw, and ArkClaw, under multiple backbone models. To support this study, we construct a benchmark of 205 test cases covering representative attack behaviors across the full agent execution lifecycle, enabling unified evaluation of risk exposure at both the framework and model levels. Our results show that all evaluated agents exhibit substantial security vulnerabilities, and that agentized systems are significantly riskier than their underlying models used in isolation. In particular, reconnaissance and discovery behaviors emerge as the most common weaknesses, while different frameworks expose distinct high-risk profiles, including credential leakage, lateral movement, privilege escalation, and resource development. These findings indicate that the security of modern agent systems is shaped not only by the safety properties of the backbone model, but also by the coupling among model capability, tool use, multi-step planning, and runtime orchestration. We further show that once an agent is granted execution capability and persistent runtime context, weaknesses arising in early stages can be amplified into concrete system-level failures. Overall, our study highlights the need to move beyond prompt-level safeguards toward lifecycle-wide security governance for intelligent agent frameworks.

Abstract

AI Agent Security

Explore similar work

A Systematic Security Evaluation of OpenClaw and Its Variants

AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents

Provably Secure Agent Guardrail