Revealing security threats and defense architectures for autonomous agents: an OpenClaw case study

Autonomous tool-calling agents with operating system-level permissions can turn cognitive issues like prompt injection into remote code execution, file deletion, or data exfiltration; the authors discuss this using OpenClaw as a case study.

• Scenario: The authors state that OpenClaw is a self-hosted open-source assistant that can operate browsers, shells, local files, and third-party APIs, and connects to over twenty messaging channels. The authors argue that local deployment does not equal secure execution, and the public messaging surface continuously introduces untrusted input.
• Existing practices: The authors argue that static WAFs and basic input filtering are primarily content-oriented and cannot stop instructions mixed with data, nor can they stop goals that chain legitimate tools together. Although unknown direct messages require a pairing code, the authors still state that the agent remains continuously exposed to internet input.
• Authors' categorization: The authors frame current problems as prompt injection-driven RCE, sequential tool attack chains, context forgetting, and supply chain poisoning, and argue that cognitive errors are amplified by system privileges.
• What is proposed: The authors propose a three-layer risk taxonomy covering AI cognition, software execution, and information systems; and provide a theoretical defense blueprint, FASA, and an in-progress implementation, ClawGuard. In the abstract, the authors claim the taxonomy is novel.
• Threat model:
  • Goals: The paper lists consequences including unauthorized RCE, arbitrary file deletion, sensitive data exfiltration, and malicious Skills turning devices into botnets.
  • Knowledge: The paper does not state whether attackers have access to weights, system prompts, or can only deliver external content.
  • Capabilities: Can exploit untrusted input from messaging channels, web pages, and documents; can deploy third-party Skills; and can leverage tool calls, memory writes, and Gateway authentication configurations.
  • Victim system: Self-hosted OpenClaw, including Gateway, Pi Agent Runtime, full channel integration, macOS/iOS/Android nodes, and agent-managed browsers and Skills platform. Nodes also have access to camera, screen recording, location, and system command interfaces.

The paper does not have a separate Related Work section. Below, works are grouped only according to those actually cited and discussed in the introduction and case discussion.

Tool-calling agents

• Yao et al. (2022)'s ReAct, and Patil et al. (2025): Used by the paper to mark the transition from passive conversational interfaces to planable, actionable autonomous agents.
• Wang et al. (2024), Wölfle et al. (2025): Discuss executable code actions and agent-generated tools, respectively. The authors use these works to illustrate that cognitive decision-making and tool execution can be separated, and OpenClaw adopts this runtime.
• Browser, shell, files, and APIs: The authors cite Ying et al. (2025a), Wang et al. (2024), Tao et al. (2024), and Zhang et al. (2026) to show that agents can operate these external resources. The paper does not individually criticize these works.

Content risks and traditional defenses

• Hallucination and toxic text: Bang et al. (2025)'s HalluLens, Zhang et al. (2025b), and Ying et al. (2025b;d), Xiao et al. (2025). The authors state that traditional LLMs mainly face these content-centric risks, and tool-calling agents amplify them into system-level threats.
• Static filtering: OWASP Foundation (2024)'s WAF, and basic input filtering represented by Inan et al. (2023). The authors argue that these defenses are insufficient for agents that can chain legitimate tools. The paper does not describe Llama Guard as keyword-based.
• Code and data separation: The authors use OWASP Foundation (2021)'s injection issue as a contrast, stating that in LLM agents, instructions are data, and traditional code/data separation cannot block indirect prompt injection.

Memory, compression, and tool chains

• Lewis et al. (2020)'s RAG: The authors state that OpenClaw's retrieval-augmented memory creates a persistent infection surface; after malicious preferences are written into the vector database, they may be triggered in later unrelated tasks.
• Fei et al. (2024): Discusses using semantic compression to extend the context window. The authors link this to instruction forgetting, using it to explain safety constraints being squeezed out of context.
• Wang et al. (2025), Dong et al. (2026): The former discusses cross-modal prompt injection; the authors cite the latter to name Sequential Tool Attack Chains. The paper does not criticize these two works, nor does it compare with them experimentally.

Reported incidents on OpenClaw

• Chandonnet (2026): The public incident the authors recount is the agent deleting the entire inbox, which they interpret as context compression squeezing out earlier safety constraints. Grant (2026) is used in the introduction to refer to autonomous failures caused by cognitive limitations.
• NIST (2026)'s CVE-2026-25253 (ClawJacked): The authors map this to Gateway URL manipulation leading to token exfiltration and RCE. Bors (2026) is used in the main text to support the claim that the assumption "local execution equals secure execution" does not hold; the citation title mentions bypassing OpenClaw's security sandbox, and the paper does not explain the relationship between the two statements.
• Supply chain and secrets: Baran (2026) and Meller (2026) are used to describe ClawHub Skills poisoning; Oliveira et al. (2026) corresponds to credential theft in the introduction; Beurer-Kellner et al. (2026) corresponds to confidentiality breaches due to plaintext storage. The paper does not restate the package counts or leak counts from these report titles in the main text.

The paper does not set up experimental baselines, nor does it compare methods on a benchmark. The authors position this paper as: shifting the discussion from passive patching to proactive architecture-level defense, using a three-layer taxonomy to organize phenomena on OpenClaw, and using FASA to cover the lifecycle from perception to system execution.

The authors first use a Tri-layered Risk Taxonomy to categorize phenomena on OpenClaw into three dimensions, then propose a Full-lifecycle Agent Security Architecture (FASA). The authors claim it advocates zero-trust agent execution, dynamic intent verification, cross-layer reasoning-action correlation, and continuous evolution. FASA is written as a theoretical blueprint, not a fully tested detector; the paper does not provide thresholds, decision models, iteration counts, or quantitative success criteria.

Three-layer classification

• AI and cognitive security: Indirect prompt injection, instruction forgetting due to context compression, and soft backdoors written into vector databases through multi-turn conversations. When giving examples, the authors treat hidden text on web pages and malicious preferences as mechanisms; the original sentences are not repeated here.
• Software and execution security: The authors state that agents run directly with the host user's disk permissions, lacking strict containerization or sandboxing; adversaries can chain multiple individually legitimate tools into exfiltration workflows; third-party Skills on ClawHub lack pre-deployment static auditing or signature verification.
• Information and system security: The Gateway by default exempts the loopback address 127.0.0.1 from strict authentication, which the authors map to CVE-2026-25253; intermediate reasoning and API keys are often stored in unencrypted local Markdown or SQLite.
• Comparison table: Table 1 maps each of the above theoretical risk elements to observed OpenClaw vulnerabilities. The caption of Figure 3 states that the figure maps theoretical vulnerabilities to observed exploits; the provided text contains no readable numerical values within the figure.

Perception and isolation

• Multidimensional input sanitization: External data such as web pages and user documents should not directly enter the LLM prompt context. The isolation layer removes executable content and then extracts structured text to reduce indirect prompt injection in complex media. The paper does not specify the parser.
• Skills admission: Semantic analysis of tool descriptions is performed before integration to detect prompt induction, and static analysis of plugin code is performed to identify potentially unsafe system-level operations. The paper does not specify which analyzer is used.
• Ephemeral execution sandbox: Tool calls are assumed to occur in an isolated environment. Lightweight ephemeral containers enforce least privilege and restrict network egress to reduce accidental exfiltration or unauthorized system access. The paper does not specify the container runtime name.

Decision and control

• Contextual instruction guardrails: Instead of static keyword filtering, it checks whether the current action still falls within pre-defined capability boundaries. The authors give an example: a calendar management agent reading system configuration files should be flagged as anomalous.
• Behavioral intent analysis: For sequential tool attack chains, plans are decomposed at the trajectory level. Complex plans are broken into atomic actions, and then it is determined whether the combination of individually benign operations constitutes a malicious workflow. The paper does not specify the classifier or score thresholds.
• Inter-agent protocol checking: Multi-agent channels are monitored to prevent malicious instructions, indirect prompt injection, or memory pollution from spreading between agents. The paper does not state whether the OpenClaw case itself was tested in a multi-agent deployment.

Execution and response

• Reasoning-action correlation: The semantic intent inferred from reasoning traces is compared with actual system behavior. Inconsistencies trigger security interventions. The authors give an example: reasoning says summarizing files while simultaneously initiating a network connection.
• System telemetry and automated response: Kernel-level telemetry continuously monitors file I/O, process creation, and network activity, and compares them against predefined behavioral baselines. When violations are detected, automated responses include process termination or container isolation. The paper does not specify how baselines are built or alert thresholds.

Governance evolution and ClawGuard

• Threat intelligence: Runtime logs and anomaly alerts are correlated with external vulnerability intelligence to update behavioral baselines and access control policies. The paper does not specify the names of intelligence sources.
• Adaptive adversarial simulation: Automated red teaming is performed in a controlled environment using adversarial prompts and poisoned tools. The authors state that successful attack patterns are incorporated into training data used to improve detection and mitigation. The paper does not specify the models used for training, data scale, or whether this step has been executed.
• ClawGuard: The authors state that the team is building a proof-of-concept platform for this ecosystem according to these designs. An early prototype already includes major security modules; the authors also state that implementing FASA remains an ongoing challenge, with the goal of transforming OpenClaw from a high-risk experimental tool into a system that can operate according to this architecture. The paper does not present the prototype as having completed evaluation.

Experimental Setup

• No controlled experimental protocol: The paper has no Experiments section and does not report the tested models, number of dataset items, baselines, attack success rates, evaluation models, thresholds, sample sizes, or number of repetitions.
• Case subject: Section 2 describes OpenClaw, including a local-first WebSocket Gateway, a Pi Agent Runtime running over RPC, more than twenty communication channels, macOS/iOS/Android nodes, browsers controlled via CDP, and a third-party Skills platform.
• Material sources: Section 3 and Table 1 are mappings of public incidents, vulnerability identifiers, and ecosystem reporting, not reproduction experiments presented in the paper.
• Defense section: Section 4 describes the engineering scope of the four FASA layers and ClawGuard, without reporting interception rates, false rejections, latency, or adaptive attack test results.
• Figures: Figures 1–5 have only captions in the provided text; the main text does not list values within the figures, so no curves or bar heights are restated here.

Main Results

The paper's main result is a qualitative mapping, not scores. The table below is condensed from Table 1 and contains no numbers not given in the paper.

| Dimension | Mapping in Table 1 | | AI and cognition | Instruction forgetting leads to inbox deletion; indirect prompt injection triggers local data exfiltration; malicious rules written into the vector store | | Software and execution | Lacks strict sandboxing, runs with host user privileges; exfiltrates SSH private keys via shell/HTTP tools; unaudited malicious Skills on ClawHub | | Information and systems | CVE-2026-25253: Gateway URL manipulation leads to token theft and RCE; keys and intermediate reasoning stored in plaintext |

• The authors state that securing such a framework cannot rely only on patching single points or fine-tuning the LLM, because cognitive errors and system privileges are intertwined and require multi-layer defense. This is the design rationale at the end of Section 3, not an evaluation conclusion.
• In the Conclusion, the authors state that content-centric measures cannot address prompt injection, sequential tool-chain hijacking, and supply-chain contamination. The paper does not give success rates for each of these three categories.
• The authors present FASA as a blueprint targeting the three layers of risk above. Table 1 contains no interception results for FASA or ClawGuard, so whether the defense is effective cannot be read from that table.

Cognitive Layer Cases

• What was tested: The authors compile two types of cognitive failure rather than running models. One is indirect prompt injection that feeds hidden text from web pages into the context and then exfiltrates local data through legitimate tools (Section 3.1, McCauley et al., 2026). The other is memory poisoning: multi-turn dialogue writes malicious preferences into the vector store, forming a soft backdoor that can be triggered in later tasks (Lewis et al., 2020; Ying et al., 2025c; Penligent Team, 2026).
• Results: The paper does not provide success rates, sample counts, or reviewer agreement for these cases.
• Authors' interpretation: The authors explain the inbox clearing reported by Chandonnet (2026) as context compression triggered when processing a large volume of email, causing the earlier no-deletion constraint to be pushed out of context. This is the authors' causal narrative; the paper contains no reproduction record.

Execution Layer and Supply Chain

• What was tested: Section 3.2 discusses host privileges, sequential tool chains, and ClawHub. Table 1 describes multi-step chains exfiltrating SSH private keys via conventional shell and HTTP tools to bypass single-endpoint filtering.
• Results: The paper does not report the number of steps in the chain, number of queries, or success ratio. On the supply-chain side, the authors state that attackers have uploaded plugins containing hidden prompt injections or malware that turn devices into botnets after installation, and that there is no strict static audit or signature verification before deployment.
• Authors' interpretation: The authors consider "local execution is safe" a design flaw and cite Bors (2026). The main text says there is a lack of strict sandboxing; the cited title says sandbox bypass. The paper does not explain this discrepancy.

System Layer Cases

• What was tested: Section 3.3 discusses authentication configuration and state storage. The authors write that the Gateway does not strictly authenticate 127.0.0.1 by default and map CVE-2026-25253 to URL manipulation that leaks authentication tokens, leading to arbitrary RCE.
• Results: The paper gives the vulnerability identifier but does not report the number of affected deployments, the number of token leaks, or whether the authors' reproduction succeeded. The plaintext storage item likewise has no counts.
• Authors' interpretation: The authors state that when a host is compromised, or an agent is induced to read its own memory directory, unencrypted Markdown/SQLite causes a confidentiality breach (Beurer-Kellner et al., 2026). The main text does not use the counts in that cited title.

Other Ablations and Analyses

• The paper does not report ablations, parameter sweeps, human evaluation, or reviewer agreement.
• Section 4.5: The authors state that an early ClawGuard prototype already includes the main security modules; the paper does not report test numbers for these modules.
• Section 2.1: The authors write that by late February 2026 the repository had more than 200,000 GitHub stars. This is adoption, not a security experiment metric.

Limitations and future directions noted by the authors

The paper has no Limitations, Discussion, Future Work, or a limitations list in the appendix, and does not specifically discuss limitations.

• Engineering implementation: In the Conclusion, the authors state that through ongoing ClawGuard engineering, they will turn layered isolation, dynamic intent verification, and cross-layer reasoning-action correlation into practical mechanisms. The authors write this using "aim" and "ongoing," without presenting it as a completed evaluation.

Experimental coverage

• The analysis target is the OpenClaw ecosystem: architecture in Section 2, threat mapping in Section 3 and Table 1.
• Table 1 covers three taxonomy dimensions and provides mappings for instruction forgetting, indirect prompt injection, soft backdoors, sandboxing, multi-step toolchains, ClawHub poisoning, CVE-2026-25253, and plaintext secrets.
• FASA is described in Section 4 as four layers: perception and isolation, decision and control, execution and response, and governance and evolution. The paper does not report evaluation metrics for these layers.
• Section 4.5 states that the ClawGuard early prototype includes the main security modules and describes implementing FASA as an ongoing challenge. The paper does not report the prototype's query counts, repetitions, or interception numbers.
• Named incidents in the paper include Chandonnet (2026)'s inbox deletion and NIST (2026)'s CVE-2026-25253. The paper does not report a reproduction protocol or sample size on the authors' side.

This is a threat mapping and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.

• Problem: The authors argue that once a model can execute shell commands, modify files, open a browser, and call APIs, prompt injection no longer only changes responses but can become remote code execution, data deletion, or exfiltration. Local self-hosting and private pairing codes do not remove the public input surface.
• Taxonomy: A three-layer taxonomy places the problems at the cognitive, software execution, and information system levels. The cognitive layer includes injection, context compression, and memory poisoning; the execution layer includes host-level privileges, toolchains, and the Skills supply chain; the system layer includes the Gateway's authentication exemption for 127.0.0.1, as well as plaintext key storage and intermediate reasoning. See Table 1 for the mapping.
• Blueprint: FASA has four layers. External inputs are sanitized first, tools are placed in least-privilege ephemeral sandboxes, and Skills undergo description and code review before integration. The planning stage checks capability boundaries and considers action sequences as a whole. Execution is checked against reasoning traces and real system calls, with isolation triggered by file, process, and network telemetry. Afterwards, external intelligence and controlled red teaming update the policy. The paper does not provide decision thresholds.
• Materials: The support comes from public incident mapping, not from model experiments in the paper. The authors interpret the inbox deletion as compression squeezing out safety constraints, and map CVE-2026-25253 to RCE after token exfiltration. The paper has no success rates, sample sizes, or defense evaluation numbers.
• Engineering status: The authors state that an early prototype of ClawGuard already includes the main security modules, while describing full implementation as ongoing work.
• Authors' conclusion: The authors argue that content filtering alone is insufficient and that zero-trust execution, dynamic intent verification, and cross-layer reasoning-action correlation are needed to move such agents from high-risk experimental tools toward this architecture.