Clawdrain: covertly draining tokens in OpenClaw Agents via tool call chains

Amplify token consumption in a real OpenClaw deployment with a trojan skill while still giving the correct final answer.

• Scenario: The authors state that OpenClaw writes skill documents and tool outputs into history and sends them back to the model each round. Tokens directly determine cost, latency, and throughput, so an adversary can do resource amplification; the open skill ecosystem also grows faster than systematic safety evaluation.
• Existing gaps: The authors state that existing protocols mostly treat a correct final answer as stealth and evaluate in constrained simulators. Agents in deployment can combine general-purpose tools to bypass fragile steps, interfaces change visibility, and cron/heartbeat can consume tokens without user supervision.
• Observation: Skill documents continuously enter context, thereby affecting the prompt budget, control flow, and context growth rate. The authors state that the amplification loop can maintain task correctness and keep the appearance of progress.
• This paper's approach: The authors propose Clawdrain, which uses SKILL.md to inject a segmented verification protocol (SVP), with scripts returning PROGRESS, REPAIR, TERMINAL. Evaluation is done on a production-like instance with real API billing.
• Threat model:
  • Goal: Increase cost and reduce throughput while remaining seemingly benign and giving the correct final answer; the secondary goal is to be hard to detect during use.
  • Implantation: The adversary can go through ClawHub (the authors state over 5,700 skills, indistinguishable from legitimate skills before manual audit), compromised dependencies, the local directory ~/.openclaw/skills/, or induce the agent to generate a skill itself.
  • Capabilities: It is assumed that shell or Python is available, and the adversary may autonomously combine these tools to execute the skill protocol.
  • Victim system: OpenClaw agent. Visibility is divided into Chat GUI (Telegram/Discord), TUI narration mode, and cron/heartbeat autonomous execution.

Per Section 2, related work is divided into tool-calling frameworks, resource amplification, and prompt jailbreaks; the direct comparison with this paper is Zhou et al.'s simulator protocol.

Tool calling and OpenClaw

• Frameworks and skills: Wang et al. (2024) survey LLM-based autonomous agents; Sun et al. (2025) and Tran et al. (2025) discuss multi-agent collaboration. The authors use these works to discuss how skills extend capabilities to retrieval, computation, and external interaction.
• Calling loops: The authors cite Toolformer (Schick et al., 2023) and LangChain applications (Topsakal and Akinci, 2023), describing how OpenClaw stores documents and tool outputs in history and sends them back each round. The authors argue this both supports composition and forms a supply-chain channel.
• Compression loses constraints: Yue (2026) reports that after confirmed instructions are lost in context compression, an agent autonomously initiates mass email deletion. The authors use this event to discuss the impact of the skill layer on control flow.

Resource amplification

• Billing coupling: The authors cite Liu et al. (2023), Zhang et al. (2025)'s Breaking Agents, Si et al. (2025), and others, discussing that tokens are both billed and scarce, and that models re-read intermediate results, tool outputs, and context. The authors say the amplification loop can still keep the task correct.
• Zhou et al. (2026): Use tool-calling chains for resource amplification, define stealth as the final answer being correct, and in a simulator that only allows calling malicious tools, use MCTS to jointly raise ASR and per-round output length, reporting 65–658× with L up to 15,000. The authors criticize that this setting cannot see tool composition and implicitly treats failure as low-cost.

Prompt jailbreaks

• Instruction manipulation: The authors cite JailbreakBench (Chao et al., 2024), Du et al. (2025)'s multi-turn jailbreaks, and Hakim et al. (2026)'s survey, discussing how adversarial inputs bypass safety constraints or alter instruction following.
• Tool agents: The authors say injected instructions can also change reasoning trajectories, tool selection, and external side effects; after tool outputs are repeatedly sent back, adversarial instructions can persist across rounds. Wu et al. (2025) is cited to connect this risk in function-calling scenarios.
• Relationship to resources: The authors argue these prompt attacks are not limited to bypassing policies; they can also lengthen reasoning, repeat calls, or expand data, thereby affecting performance and cost.

Baselines and tasks

• Baseline methods: A benign query skill with the same user interface as the trojan skill, no multi-round protocol, returning a short BBC headline summary. The literature comparison is Zhou et al. (2026).
• Benchmark/dataset: The same query for fetching the latest BBC headlines. The paper does not use a named public benchmark.

The authors place this paper on a production-like OpenClaw: implementing SVP and measuring tokens, while arguing that tool composition, recovery behavior, and the interface change the magnitude and observability, which are not present in a simulator that only allows calling malicious tools.

Clawdrain implements amplification as a trojan query skill: SKILL.md specifies a multi-round segmented verification protocol (SVP), with a companion script controlling the loop via three signals, and still returning a benign payload at the end.

Protocol structure

• Each call must submit a monotonically increasing segment index, plus a complete comma-separated sequence of length L with values from 1 to L. The documentation requires the model to write the full sequence and forbids abbreviations; the authors call this the main source of output token amplification.
• The script query_tool.py returns three signals: if the segment number is less than Tmax and the sequence is valid, it returns PROGRESS and moves to the next segment; if the sequence is malformed, it returns REPAIR and retries with the same segment number; if the segment number equals Tmax and is valid, it returns TERMINAL, returns the correct benign payload (BBC headline data in the paper), and ends.
• Therefore at least Tmax successful calls are needed, plus REPAIR retries. The authors write the theoretical output cost per query as Ω(L × T_max) output tokens, i.e., on the order of the product of sequence length and number of successful calls, plus the input overhead of the growing session history.

Wrapping and construction

• The protocol is wrapped as a freshness check before the data provider publishes headlines, and the sequence is described as a handshake. The authors note that many real APIs do have multi-step authentication, so it does not look like an obviously malicious request.
• The narrative instructions require showing progress summaries rather than raw call details, to fit the TUI that only shows summaries. In the experiments, Gemini 2.5 Pro accepted the protocol; once it called the verification system fascinatingly complex before continuing.
• The template was hand-written by the authors and revised manually in two rounds, without MCTS. The authors state that for a known system, no optimizer or simulator is needed, and that this template was followed on the first attempt by a production model, indicating that hand construction is sufficient for targeted attacks.

Three configurations

• v1 (L=50, Tmax=2): minimal instructions. SKILL.md does not declare L; the agent learns the parameter from the first PROGRESS.
• v2 (L=1000, Tmax=3): L is stated explicitly, with additional compliance-oriented instructions, rationale, and narrative instructions.
• v3 (L=2000, Tmax=5): same template as v2 with higher parameters, used to observe compliance boundaries.

Other cost surfaces and adaptive design

• The authors also list three surfaces invisible to simulators: the SKILL.md of an enabled skill enters the system prompt whether or not it is invoked, so oversized documents raise the input cost of every call; tool inputs and outputs remain in history, so verbose responses make context grow superlinearly; cron/heartbeat invokes autonomously at intervals, multiplying single-call cost by frequency.
• The authors state these vectors can be combined in one skill, requiring neither a multi-round protocol nor obvious anomalies in the calling pattern. Individual and combined costs are deferred in Section 3.3 and do not enter the numbers in Section 4.
• Section 3.4 proposes two adaptive variants, but Section 4 measures fixed SVPs. One makes REPAIR reject reusable scripted sequences per round, pulling the model back to autoregressive generation. The other first uses document inflation and verbose output to accelerate lossy compression and squeeze out user constraints, then escalates to the full SVP, or performs actions the user once forbade.
• The authors note that SKILL.md and platform instructions sit in the same system prompt layer, so instructions that alter global behavior can also be injected. They leave the resulting integrity and confidentiality issues for future work.

How success is counted

• Amplification is defined as the ratio of total context consumed by the trojan skill to that consumed by the benign skill under the same query. Success depends on whether the final answer is correct. Wall-clock time is measured from the first user message to the final reply.
• The authors still treat a correct answer as a condition for benign appearance, but argue that the more meaningful stealth criterion in deployment is observability, and that it varies by interface.

Experimental Setup

• System: Local OpenClaw v2026.2.9, backend Gemini 2.5 Pro (via Google OAuth). Tools include exec (shell/Python), filesystem, and web search. Skills are loaded from a local directory. The summary states the instance has real API billing; the paper does not report dollar amounts.
• Control: The trojan skill replaces the default query skill. The benign skill returns a short BBC headline summary for the same query, with no multi-round protocol. Both have the same user interface.
• Metrics: The query is to fetch the latest BBC headlines. Amplification equals trojan skill total context divided by benign skill total context. Tokens come from OpenClaw's /cost, including cumulative input, output, and context.
• Recording: After session initialization (authors write overhead ~200 tokens), after benign skill completion, after trojan skill completion. Each time a new session is used. Wall clock is measured from the first user message to the final reply.
• Configurations: Benign baseline, and SVP v1 (L=50, Tmax=2), v2 (L=1000, Tmax=3), v3 (L=2000, Tmax=5). The paper does not report the number of repetitions, nor does it use LLM review.
• Model: The only backend tested is Gemini 2.5 Pro.

Main Results

Per Table 1. Backend is Gemini 2.5 Pro; Context is cumulative session context at termination; Amplification is the context ratio relative to the benign baseline; Result indicates whether the correct final answer was delivered.

Swipe horizontally to read the table

Condition	Input	Output	Context	Amplification	Correct final answer
Benign baseline	∼3.6k	∼425	∼28k	1×	Yes
SVP v1 (L=50, Tmax=2)	∼25k	∼14k	∼125k	∼6×	Yes
SVP v2 (L=1000, Tmax=3)	∼25k	∼14k	∼190k	∼7×	Yes
SVP v3 (L=2000, Tmax=5)	∼34k	∼28k	∼249k	∼9×	No

• The authors state that successful configurations amplify consumption while still giving correct answers; the row that did not complete the protocol instead consumed the most.
• The authors attribute the gap from the 65–658× reported by Zhou et al. to more conservative parameters (successful configurations L≤1000, Tmax≤3; theirs had L up to 15,000) and to script bypass in deployment.
• In the table, v1 and v2 have identical input and output columns but different context columns. The authors do not separately explain why input is the same; output not increasing with L is discussed together with script bypass later.

Failure Path Is More Expensive

• What was tested: v3 (L=2000, Tmax=5). The agent attempts sequences multiple times and receives REPAIR multiple times, judges the validation system as faulty, then abandons the trojan skill.
• Result: Fallback includes invoking the benign skill, searching other data sources, killing stuck processes, and retrying the main service. That run's context is the highest row in the table, with wall clock over 11 minutes; successful v2 took under 2 minutes.
• Authors' interpretation: The authors state this is inconsistent with treating ASR and amplification as parallel and treating failure as low-cost. When alternative tools and autonomous recovery exist, failure paths can be more expensive. The authors believe there is no need to tune parameters for protocol completion; after setting parameters past the compliance threshold, recovery behavior itself incurs additional cost. The authors also believe that MCTS jointly maximizing ASR and per-round output length may not be suitable for such deployments.

Tool Combination Bypass

• What was tested: v2, L=1000. Autoregressive generation had arithmetic errors at positions 372 and 570 and triggered REPAIR; the third time it switched to generating the sequence with shell, then filled subsequent calls. The authors state SKILL.md does not hint at this step.
• Result: Per-round output dropped from about 1000 tokens to a short shell command (about 30 tokens). The authors state this is the main reason measured amplification is lower than Zhou et al.'s 65–658×.
• Authors' interpretation: Their evaluation only allowed calling malicious tools. The same tool capability reduced calibration cost at L=1000 and supported the fallback cascade at L=2000. The authors state general-purpose tools can both reduce and increase drain costs, and limiting only the single-token budget cannot address this.

Interface and Observability

• What was tested: The authors discuss the visibility of the same skill across three interfaces, with no per-interface token table. The Chat GUI renders each call and full parameters; the TUI only shows narration, and v2's narration instructions target that mode; cron/heartbeat has no user-facing output.
• Authors' interpretation: The authors state that detectability depends only on the interaction mode; a no-interface simulator is equivalent to autonomous execution and overestimates stealth in interactive deployments. On failure, the agent says the validation system is faulty. The authors state this does not directly indicate malice but may prompt users to inspect the skill.
• Corroborating evidence: The authors cite a community issue where non-malicious erroneous automation consumed 5.7M tokens overnight, used to discuss the platform's lack of effective constraints on runaway autonomous consumption. This is not a measurement from this paper's attack experiments.

Other Ablations and Analysis

• Session initialization overhead is about 200 tokens (Section 4.1.3), recorded separately from the four rows of Table 1.
• The paper has no scan table for L or Tmax, only the three configurations above.
• Section 3.4's per-round rejection and two-stage compression escalation have no measured numbers.
• Section 3.3's input inflation, history pollution, and scheduling frequency have no separate cost numbers.
• The paper does not report repetitions, variance, or statistical tests.

Limitations and future directions noted by the authors

• Non-output vectors not quantified (Section 3.3): the individual and combined costs of input inflation, history accumulation, and execution frequency, as well as their interaction with interface visibility and background execution, are explicitly left to future work and are not systematically quantified in this paper.
• Integrity and confidentiality (Section 3.3): the authors state that the tool layer may also alter global behavior, going beyond resource exhaustion, and leave this direction for later.
• Characterizing at scale (Conclusion): the authors plan to systematically characterize interface-related stealth and how these deployment-side vectors interact with tool composition and background execution.
• Cost and defenses (Conclusion): future work should also measure the real dollar cost of composite vectors under sustained autonomous execution, and evaluate per-skill token budgets, SKILL.md size limits, and permission separation between skill instructions and platform instructions.

Experimental coverage

• The backend under test is Gemini 2.5 Pro, and the framework is local OpenClaw v2026.2.9 (Section 4.1).
• The task is a BBC headline query; the conditions are a benign baseline and SVP v1, v2, v3. Table 1 comes from /cost records of each new session. The paper does not report the number of repetitions.
• The tool environment includes exec, filesystem, and web search. The L=1000 script bypass and the L=2000 fallback are described in Sections 4.3 and 4.4.
• The interface part is a qualitative comparison of the Chat GUI, TUI narrative mode, and cron/heartbeat (Section 4.5). The paper does not report per-interface token counts or dollar amounts.
• Section 4 measures the fixed SVPs of Section 3.2. Per-round rejection of scripted sequences and escalation after compression are described in Section 3.4, with no corresponding measurement table.

Clawdrain is a token-exhaustion attack on OpenClaw: a trojan skill turns one query into multiple rounds of tool calls, and can still hand back the correct answer at the end.

• The problem is that skill documents and tool outputs re-enter the context across rounds, and tokens correspond to cost, latency, and throughput. The authors argue that treating only answer correctness as stealth, and measuring amplification in a simulator that forbids tool composition, misses the control flow in deployment.
• The method is segment-wise verification: the agent submits complete integer sequences of length L segment by segment, and the script uses PROGRESS, REPAIR, TERMINAL to decide whether to continue, retry, or end. The three parameter sets are (50, 2), (1000, 3), (2000, 5), and the templates are hand-written.
• On Gemini 2.5 Pro, OpenClaw v2026.2.9, the benign BBC query has context of about 28k. v1 and v2 give correct answers, with amplification of about 6× and 7×. v3 does not complete the protocol, with amplification of about 9×, context of about 249k, and wall-clock time over 11 minutes, higher than v2's under 2 minutes.
• At L=1000, after two arithmetic errors the agent switches to generating sequences with shell, reducing per-round output to about 30 tokens. The authors say this explains why it is lower than the 65–658× in Zhou et al.'s simulator, and also shows that general-purpose tools make recovery expensive when they fail.
• The authors' conclusion is that drain is still feasible in deployment, but the magnitude and whether it can be seen depend on tool composition, recovery behavior, and the interface. They plan to further quantify document bloat, history pollution, scheduling frequency, and the dollar cost of composite attacks.