Your Agent, Their Assets: A Real-World Security Analysis of OpenClaw

Core problem: the persistent evolving state of personal AI agents (memory, identity configuration, executable skills) can be poisoned by attackers, causing real-world harm, but existing safety evaluations cannot cover this attack surface.

• Scenario and importance: OpenClaw has full system access on the local machine, is connected to Gmail, Stripe, and the file system, and continuously evolves through persistent state; the authors state that by early 2026 there were more than 220,000 deployed instances (citing HackMag, 2026).
• Gaps in existing work: the authors state that prior work targets only a single dimension (memory poisoning, configuration backdoors, malicious skills, etc.) and evaluates in sandboxed or simulated environments, without simultaneously evaluating all three dimensions on an online system connected to real external services.
• Core observation: persistent files are both the source of evolution capability and the attack surface—poisoned content is loaded in future sessions and reshapes agent behavior.
• Paper contributions: proposes the CIK taxonomy (Capability, Identity, Knowledge) to uniformly characterize persistent state, and conducts a safety evaluation on a real OpenClaw instance across 12 impact scenarios and four backbone models, additionally evaluating three dimension-aligned defenses and one file protection mechanism.
• Threat model:
  • Goal: make the agent execute harmful actions in subsequent sessions (data exfiltration, irreversible operations).
  • Knowledge/capability: the attacker can inject content into persistent state—via prompts that make the agent rewrite memory/identity files, or by installing skills carrying hidden payloads.
  • Protocol: two stages, Phase 1 injection and Phase 2 triggering in a subsequent session (except for in-session injection).
  • Victim system: an OpenClaw instance running real Gmail, Stripe, and file system integrations.

Persistent state attacks (single-dimension studies)

• Knowledge poisoning: AgentPoison (Chen et al., 2024) and PoisonedRAG (Zou et al., 2024) target retrieval-augmented knowledge bases; MINJA (Dong et al., 2025) demonstrates query-only memory injection; Zombie Agents (Yang et al., 2026) achieve persistent control through self-reinforcing memory injection.
• Capability attacks: SkillJect (Jia et al., 2026) automates skill injection against coding agents; Agent Skills in the Wild (Liu et al., 2026) surveys skill vulnerabilities at scale; MCPTox (Wang et al., 2025) evaluates MCP server tool poisoning; ToxicSkills (Snyk, 2026) and ClawHavoc (Koi Security, 2026) document real malicious skills on ClawHub.
• Identity attacks: AIShellJack (Liu et al., 2025) and Pillar's rule-file backdoor (Pillar Security, 2025) demonstrate attacks via coding agent (Cursor, Copilot) configuration files.

Agent safety evaluation benchmarks

• InjecAgent (Zhan et al., 2024), AgentDojo (Debenedetti et al., 2024), ASB (Zhang et al., 2025), AgentHarm (Andriushchenko et al., 2025), OpenAgentSafety (Vijayvargiya et al., 2026). The paper notes that these benchmarks run in sandboxed or simulated environments, where attacks have no real consequences.

Related mechanisms and perspectives

• Prompt injection: indirect prompt injection by Greshake et al. (2023), injection via web content and tool outputs (Zhan et al., 2024; Debenedetti et al., 2024), multi-turn injection (Russinovich et al., 2025). The authors state that this paper's contribution is not a new injection technique, but a systematic study of how persistent state reshapes behavior across sessions after successful injection.
• Agent evolution risks: Misevolve (Shao et al., 2026) and ATP (Han et al., 2025) treat dangerous behavior as an unintended byproduct of evolution; this paper focuses on adversarial exploitation of the same evolution mechanism.

Positioning: the authors state three differences from prior work—proposing the unified CIK classification framework, systematically evaluating all three dimensions within a single agent system, and evaluating in an online deployment connected to real external services rather than a simulated environment. The paper sets no comparison baseline methods; the defense comparisons are the authors' own three CIK alignment defenses and file protection.

Overall approach: first formalize OpenClaw's persistent evolving state as the CIK taxonomy, then, on an online instance connected to real services, systematically measure the attack success rate after poisoning each dimension using a two-stage attack protocol, and evaluate dimension-aligned defenses.

CIK Taxonomy and File Mapping

• Capability (what it can do): the skills/ directory, containing executable scripts (.sh/.py) and skill documentation SKILL.md; the key property is that executable code runs directly on the host without LLM inspection.
• Identity (who it is, how it acts): SOUL.md, IDENTITY.md, USER.md, AGENTS.md, storing persona, values, user profile, and operating rules.
• Knowledge (what it knows): MEMORY.md long-term memory, plus session context (Table 1).

Lifecycle and Attack Surface

• At the start of each session, all persistent files are loaded into the LLM context along with the user prompt; the agent reasons, then acts, and autonomously updates persistent files.
• The authors state that this self-modification loop is both the source of evolution capability and the attack surface: poisoned state is loaded in future sessions and reshapes behavior.

Two-Stage Attack Protocol

• Phase 1 (injection): introduce poisoned content into persistent state; for Knowledge/Identity, use prompts to make the agent rewrite persistent files; for Capability, install a carrier skill carrying a hidden payload.
• Phase 2 (trigger): in a subsequent session, use follow-up prompts to activate the poisoned state and induce harmful actions; except for session-context injection, the two stages occur in different sessions to test persistence.
• Case design: all manually designed by security researchers with OpenClaw red-teaming experience, with injected content appearing plausible in the agent's operating context; a benign prompt control group with the same structural distribution was also designed for the evolution–security trade-off experiment.

Evaluation Design

• Impact scenarios: 12 scenarios, divided into two major categories and six subcategories (Table 7): privacy leakage (financial, identity/physical, other sensitive data) and high-risk irreversible operations (financial loss, social consequences, data security).
• Conditions: each scenario is tested under 4 conditions—no-poisoning baseline + independent poisoning of each of the three dimensions; 88 test cases per model in total (12 baseline + 76 injection, Table 6).
• Environment: a single OpenClaw instance running on a Mac Mini, connected to real Gmail, Stripe, and the file system; an automated testing framework handles workspace backup, prompt delivery via Telegram, response capture, and result verification.

Success Determination

• ASR is defined as the proportion of test cases in which the harmful action was successfully executed, verified by external evidence (e.g., email received at the target address, Stripe API confirming a refund, file system confirming deletion; per-scenario criteria in Appendix C).
• Success is strictly defined as reckless execution without confirmation; any behavior that halts autonomous execution (refusal, requesting confirmation, requesting clarification, asking for missing information) counts as a successful defense. All metrics are the mean of 5 independent runs; standard deviations are in Appendix H.

Experimental Setup

• Models tested: Claude Sonnet 4.5, Claude Opus 4.6, Gemini 3.1 Pro, GPT-5.4, all deployed on the same real OpenClaw instance (Mac Mini, connected to Gmail, Stripe, and the file system).
• Scenarios and test cases: 12 impact scenarios × 4 conditions, 88 test cases per model (12 baseline + 76 injection, Table 6).
• Metrics: ASR (proportion of harmful actions executed, verified by external evidence); Phase 1 injection success rate, Phase 2 trigger success rate (conditioned on successful injection, forcing Ph.1 = 100%).
• Repetitions: all metrics are the mean of 5 independent runs; standard deviations are in Appendix H (Table 11–16).
• Defense evaluation: three CIK alignment defenses (Knowledge/Identity/Capability) tested on Sonnet 4.5; file protection tested on four models, targeting only Knowledge and Identity files.
• Evaluation method: success determination is based on external evidence (email delivery, Stripe API confirmation, file system state); the paper does not report using LLM judging.

Main Results

ASR (%) by poisoning dimension and backbone model (according to Table 2):

Swipe horizontally to read the table

Model	Baseline	Knowledge	Identity	Capability
Sonnet 4.5	26.7	89.2	85.4	88.5
Gemini 3.1 Pro	36.7	83.3	75.4	71.5
GPT-5.4	25.0	80.8	63.1	57.7
Opus 4.6	10.0	44.2	33.1	55.4

• The authors state that baseline ASR is 10.0%–36.7%, and that native safety alignment can only mitigate, not prevent; after poisoning, ASR rises for all models across all dimensions.
• The authors state that this trend is consistent across the four models, indicating that susceptibility stems from a structural property of the agent architecture rather than a defect of a single model; even the strongest, Opus 4.6, rises from 10.0% to 44.2% average ASR.
• Abstract figures: poisoning any single dimension raises average ASR from 24.6% to 64–74% (Knowledge 74.4%, Capability 68.3%, Identity 64.3%).

Stage-Level Breakdown (Table 3, Table 8)

• Phase 1: Knowledge injection success rate 87.5%–100% (the authors state that agents rarely refuse memory updates); Identity 65.4%–96.2%; Capability is 100% because installing a skill itself constitutes injection.
• Phase 2 by vector: skill-bash/py is 100%, 98.6%, 100% on Sonnet, Gemini, Opus, and 77.1% on GPT-5.4 (the authors state that it occasionally reads and refuses suspicious scripts); skill-md drops from 75.0% on Sonnet to 3.3% on Opus.
• Authors' interpretation: context-mediated attacks (Knowledge, Identity, skill-md) can be partially resisted by stronger models, while code-execution attacks (skill-bash/py) completely bypass model reasoning on most architectures.

Defense Evaluation (Table 4, Sonnet 4.5)

• Capability defense (GuardianClaw safety skill): baseline ASR drops to 1.7%, Knowledge/Identity attacks drop to 17.5%/9.2%, but Capability attacks remain at 63.8%; the authors state the reason is that executable payloads bypass the LLM reasoning loop.
• Identity defense (AGENTS.md plus safety principles): baseline drops to 13.3%, attack ASR averages 59.9%; Knowledge defense (MEMORY.md plus safety facts): baseline drops from 26.7% to 8.3%, attack ASR averages 49.6%.
• Authors' interpretation: action-level intervention (verifying intent before execution) is superior to context-level intervention (appending safety information), but no single defense eliminates poisoning risk across all dimensions.

Evolution–Security Trade-off (Table 5)

• What was measured: the Phase 1 injection rate of file protection (requiring user approval before modifying Knowledge/Identity files) for attack prompts and benign update prompts.
• Results: average attack injection rate drops from 87.0% to 5.0%; but the legitimate update rate drops from 100% to below 13.2% (0.5%–13.2% across models).
• Authors' interpretation: current models cannot distinguish malicious injection from legitimate updates; file protection comes at the cost of roughly a 93% drop in legitimate updates, constituting an evolution–security trade-off.

Other Ablations and Analyses

• GuardianClaw passive installation vs active loading (Table 9, Sonnet 4.5): passive installation attack ASR averages 77.0%; active loading gives baseline 1.7%, Knowledge/Identity 17.5%/9.2%, Capability 63.8%.
• mem-long Phase 2 averages 90.8%; mem-session drops to 40.0% on Opus (Table 8).
• Identity Phase 1 is 65.4% on Opus and 96.2% on GPT-5.4 (Table 8).
• Appendix E notes that the safety skill must be actively loaded at the start of the session, otherwise the agent will not invoke it spontaneously.

Limitations and future directions noted by the authors

• Limited coverage: The evaluation covers only a single agent platform (OpenClaw), four backbone models, and 12 manually designed impact scenarios (Conclusion, Limitations and Future Work).
• Dimensions tested independently: Each CIK dimension is evaluated independently; cross-dimension attack chains (e.g., poisoning Knowledge to strengthen Identity attacks) may amplify effects, and the authors state that the current results may be a lower bound (ibid.).
• Future directions: Automated attack generation, more platforms, evaluation in production mode, longitudinal user studies (ibid.).
• Insufficient defense layer: Existing defenses operate at the prompt level; the authors state that Capability attacks show that architecture-level defenses (code signing, sandboxed execution, runtime monitoring) are needed for robust protection (ibid.; Appendix F also mentions mandatory human approval of script invocations).

Scope of the experiments

• The models tested are Claude Sonnet 4.5, Claude Opus 4.6, Gemini 3.1 Pro, and GPT-5.4, 4 in total, all deployed on the same OpenClaw instance (Section 3.1).
• 88 cases per model (12 baseline + 76 injection), with all metrics being the mean of 5 independent runs (Section 3.1, Appendix A, Appendix H).
• In the defense evaluation, the three CIK alignment defenses were tested only on Sonnet 4.5; file protection was tested on all four models and applies only to Knowledge and Identity files, and the authors explicitly state that Capability injection operates outside file modification and requires separate protection (Section 3.3).
• All attack cases were manually designed by security researchers; the paper does not report automated attack generation (Section 3.1).
• Experiments were conducted on the researchers' own instances, researcher-controlled accounts and email addresses, with Stripe in test mode and no real financial transactions (Ethics Statement).

A real-world evaluation paper on the security of personal AI agents' persistent state. The authors propose the CIK taxonomy, unifying an agent's persistent evolving state into three dimensions: Capability (executable skills), Identity (identity and behavior configuration), and Knowledge (long-term memory), and provide a file-level mapping for OpenClaw.

• Problem: Agents like OpenClaw have full local access and connect to real services such as Gmail and Stripe; their self-evolving persistent state constitutes an attack surface; the authors state that existing evaluations study only a single dimension in sandboxes and cannot cover this.
• Method: On an online OpenClaw instance connected to real Gmail, Stripe, and the file system, using a two-phase protocol (injecting poisoned state, triggering in a later session), they evaluate 12 impact scenarios × 4 backbone models, with 88 cases per model and the mean of 5 runs.
• Main results: The no-poisoning baseline ASR is 10.0%–36.7%; after poisoning it rises across the board, with Knowledge poisoning highest at an average of 74.4%, and Sonnet 4.5 reaching 89.2% under Knowledge poisoning; even the most robust, Opus 4.6, rises to an average of 44.2% (Table 2).
• Phase breakdown: Executable script payloads (skill-bash/py) reach 98.6%–100% in Phase 2 on Sonnet, Gemini, and Opus, which the authors say bypasses model reasoning; text-based skill-md is only 3.3% on Opus (Table 8).
• Defenses: None of the three CIK alignment defenses is thorough; under the strongest, GuardianClaw, Capability attacks still have 63.8% ASR; file protection reduces the attack injection rate from 87.0% to 5.0%, but the legitimate update rate also falls below 13.2% (Tables 4, 5).
• Authors' conclusion: The vulnerability is structural rather than a problem of a single model; persistent files are both a source of evolving capability and an attack surface, and distinguishing legitimate updates from injection remains an open problem, requiring CIK-aware security architectures and architecture-level defenses.