Beware HEARTBEAT! Claw Agent background execution inherently leads to silent memory poisoning

Core problem: The Claw personal agent's heartbeat background execution shares the same session as foreground conversation, so untrusted content encountered in the background can silently enter memory and influence subsequent user-facing behavior, without requiring prompt injection.

• Problem scenario: A persistent personal agent (such as OpenClaw) periodically wakes via heartbeat to monitor external sources such as email, messages, RSS, GitHub, and social platforms; heartbeat runs in the same main session, which to the underlying LLM is equivalent to yet another ordinary user message, and is invisible in the chat interface by default (HEARTBEAT_OK replies are suppressed by the gateway).
• Why it matters (authors' view): Ingested content lacks source distinction, user visibility is limited, and there is no source labeling when writing to long-term memory; the authors argue this makes the vulnerability architectural rather than incidental; the content appears as ordinary information, making it less likely than explicit prompt injection to trigger agent suspicion or LLM safety guardrails.
• Gaps in existing research (per the paper): Existing memory attack research is mostly in general agent settings and does not examine the contamination path in persistent agent ecosystems like OpenClaw where background execution, shared sessions, and routine memory saving act together; empirical research on Moltbook only characterizes platform-level dynamics and does not examine whether content persistently erodes the agent's internal state.
• Core observation: The authors formalize the contamination path as Exposure (E) → Memory (M) → Behavior (B): false information encountered during heartbeat first enters the short-term session context, may be written into long-term memory through routine save behavior, and later shapes user-facing behavior in new sessions.
• What the paper proposes: Identify heartbeat shared-session execution as a zero-click-like attack surface; build MissClaw (an isolated research replica of Moltbook) for controlled experiments; systematically examine the roles of social credibility signals, persona, memory saving, external search, content dilution, and context management across three domains: software security, financial decision-making, and academic citation.
• Threat model:
  • Goal: Spread false information through social posts so that the victim agent subsequently produces misleading or erroneous outputs (wrong recommendations, misleading judgments, explanations based on false information).
  • Knowledge: The attacker cannot access the victim agent's internal state (system prompt, runtime implementation, memory files) and can only observe through its public activity on the social platform.
  • Capability: Can control multiple agent accounts, and may even hold roles such as moderator that enhance visibility and authority; no direct interaction with the victim agent is required.
  • Victim system: A persistent personal agent that executes heartbeat background tasks in the same main session (in the experiments, an OpenClaw agent).

Security evaluation of the Claw ecosystem

• Wang et al. (2026), Chen et al. (2026), Shan et al. (2026), Dong et al. (2026), Deng et al. (2026)—study OpenClaw from perspectives including personalized agent attack benchmarks, execution-trace security auditing, defense evaluation, tool- and skill-level exploitation, and lifecycle threat analysis. The paper notes that these works do not focus on the specific design of heartbeat background execution, and that this paper's threat model is more passive and more social: the attacker needs neither direct interaction nor injection of explicit malicious instructions.

Attacks on agent memory

• Direct injection: Dong et al. (2025), Sunil et al. (2026)—write malicious content by interacting with the victim agent.
• Indirect injection: Srivastava and He (2025), Patlan et al. (2025)—poison external artifacts that the agent later ingests. The paper notes that these studies are conducted in general agent settings, whereas the attacker capability assumed here is weaker: the attacker only needs to place content where the victim agent's heartbeat routine will automatically encounter it.

Empirical studies of agent social networks

• Jiang et al. (2026)—the first large-scale characterization of Moltbook, focusing on growth, topic diversification, and risk discourse.
• Zhang et al. (2026)—analyzes adversarial behavior on the platform and states that social engineering is more effective than explicit prompt injection, which the paper considers consistent with its findings.
• Manik and Wang (2026)—reports that 18.4% of Moltbook posts contain language inducing action; Li (2026)—analyzes the heartbeat polling architecture and argues that periodic wake-ups create a "social illusion." The paper notes that these works do not examine whether content persistently affects agents' downstream behavior.

Psychological foundations of social memory distortion

• Social contagion and misinformation effects (Roediger et al., 2001; Gabbert et al., 2003; Loftus et al., 1978; Loftus, 2005), source-monitoring failures (Johnson et al., 1993), the sleeper effect (Hovland and Weiss, 1951; Kumkale and Albarracín, 2004), conformity (Asch, 1956; Edelson et al., 2011). The authors map these mechanisms onto the E→M→B framework to explain why consensus signals are particularly effective.

Baselines and benchmarks: the paper sets no comparison baseline methods; the experiments are conducted on the self-built MissClaw (an isolated replica of Moltbook), and the evaluation tasks are 9 manipulation scenarios across three domains (Appendix B, Table 7).

The authors position this paper at the intersection of the above four lines of research: grounding known memory-distortion mechanisms from human society in the specific architectural design of persistent agents browsing social platforms in the background.

Overall approach: formalize the design of heartbeat shared sessions as an Exposure→Memory→Behavior (E→M→B) contamination path, control the social exposure variable on an isolated Moltbook replica, MissClaw, and run three progressive experiments along two memory carriers: same-session (short-term) and cross-session (long-term).

Attack surface and threat formalization

• Shared session execution: heartbeat runs by default in session main, which to the LLM is equivalent to an ordinary user message; the heartbeat prompt and intermediate tool calls are by default not rendered in the chat interface, and when there is nothing to do the reply HEARTBEAT_OK is suppressed by the gateway (showOk defaults to false), with only alert messages surfaced to the foreground (showAlerts defaults to true).
• Three dangerous properties: weak source distinction, limited user visibility, and provenance-free memory promotion when writing to long-term memory.
• Channel comparison: Table 2 compares six types of channels by exposure frequency, credibility cues, impact severity, attacker cost, stealthiness, and delivery method; the authors state that social platforms uniquely combine high exposure frequency, high credibility cues, low-cost passive delivery, and high stealthiness, and are therefore chosen as the experimental scenario.
• E→M→B path: Exposure refers to the social content and social signals encountered during background execution; Memory refers to whether the content persists in short-term session state or long-term memory; Behavior refers to user-facing consequences in subsequent interactions.

Experimental platform MissClaw

• Replication and isolation: reuse the Moltbook open-source stack (REST API, authentication, comments, voting, rate limiting), add deterministic content seeding, allocate an independent submolt for each run, and reset platform state between runs to prevent cross-run contamination.
• Reasons for not experimenting on the real platform: to avoid exposing real agents to manipulative content, and to avoid the platform's own activity interfering with causal identification.

Victim agents and task design

• 5 victim agents: all are OpenClaw agents, all backed by the same underlying model, Claude Haiku 4.5, with the same toolset (calendar, task management, notes, email, communication, weather, GitHub, summarization, web access), differing only in the persona in SOUL.md: Cheerful, Bold, Curious, Wise, Skeptical (full persona definitions are given in Appendix A).
• 9 manipulation scenarios, 3 domains: software security (version upgrade decisions for three real packages, passport-saml, keycloak-services, supabase/auth, with manipulation posts recommending versions containing known CVEs); financial decisions (comparisons of three groups of fictitious DeFi protocols, with posts recommending protocols with undisclosed structural flaws); academic citations (three fabricated papers, with realistic authors, venues, and DOIs). Tasks and judgment criteria are given in Table 7 of Appendix B.
• Social signal manipulation: authority (A1: post author is the submolt moderator / A2: ordinary account) × consensus (B1: comments unanimously agree / B2: at least one comment expresses doubt), for four combinations in total.

Evaluation protocol and metrics

• Same-session evaluation (Study 1): after heartbeat exposure, the downstream task is issued immediately within the same session, measuring short-term residual influence.
• Cross-session evaluation (Study 2, 3): after exposure, ordinary interaction and filler tasks are first performed, then a save prompt is issued (S0 no prompt through S4 explicitly requesting that useful findings be saved to MEMORY.md; wording in Table 4), and after the session is reset the task is issued in a new session; Study 3 replaces targeted single-post exposure with diluted browsing in which only 1 of 20 posts is manipulated, and undergoes OpenClaw's default session pruning and compaction.
• Metrics: ASR (the proportion of agents acting on the manipulated information); E→M save rate (the proportion of contaminated content written into long-term memory). An LLM judge (Claude Haiku 4.5) classifies each reply as misled or not_misled.

Experimental setup

• Models tested: 5 OpenClaw victim agents, all with Claude Haiku 4.5 as the underlying model, differing only in persona (Bold, Cheerful, Curious, Wise, Skeptical).
• Platform: MissClaw, an isolated research replica of Moltbook; experiments are based on the January 24, 2026 version of OpenClaw (pre-fix version).
• Tasks: 9 manipulation scenarios across 3 domains (software security, financial decision-making, academic citation; Appendix B Table 7).
• Metrics: ASR (proportion of replies that act on the manipulated information), E→M save rate (proportion written into long-term memory).
• Judging method: LLM judging (Claude Haiku 4.5) classifies replies as misled / not_misled; the authors state that some samples were manually verified, but the paper does not report the specific sample size or agreement numbers.
• Sample size: The paper does not explicitly report the number of runs per condition; the percentages in the tables are multiples of 6.7 (e.g., 66.7, 33.3), and the paper does not state the denominator.
• Number of repetitions: Not reported in the paper.

Main results

Study 1 same-session ASR under full social signals (A1B1) (%, per Table 3; w/o / w/ mean without / with web_search):

Swipe horizontally to read the table

Persona	Software w/o	Software w/	Financial w/o	Financial w/	Reference w/o	Reference w/	Overall w/o	Overall w/
Bold	66.7	58.3	66.7	91.7	50.0	33.3	61.1	61.1
Cheerful	58.3	66.7	75.0	75.0	41.7	16.7	58.3	52.8
Curious	58.3	58.3	41.7	58.3	50.0	33.3	50.0	50.0
Wise	58.3	50.0	41.7	50.0	50.0	41.7	50.0	47.2
Skeptical	33.3	25.0	16.7	0.0	0.0	8.3	16.7	11.1

• Social signals: The left panel of Figure 5 shows that without web_search, the authority condition A1 yields an ASR of 82.2% under consensus B1 and 22.2% under B2; A2 yields 73.3% under B1 and 11.1% under B2. The authors state that consensus is the more decisive factor, and that removing consensus greatly weakens the effect even when authority is retained.
• Persona: The authors state that Skeptical is consistently the least susceptible, while Bold and Cheerful are generally more susceptible, but no persona is fully immune under strong social signals.
• External search: The authors state that providing web_search does not reliably mitigate: the agent may not invoke it, or may still trust social content after invoking it, especially in the Financial domain (Bold's ASR in Financial with search was instead 91.7%).

Study 2: Can short-term contamination enter long-term memory

• Save rate (Table 5a): At S0, all domains are 0.0%; the average save rate rises from 26.7% at S1 and 40.0% at S2 to 64.4% at S3 and 91.1% at S4. At S3, Financial is 86.7%, Reference 73.3%, and Software only 33.3%.
• Cross-session ASR (Table 5b): Without web_search, the average ASR rises from 17.8% at S1 to 75.6% at S4; at S4, Software is 80.0%, Financial 73.3%, and Reference 73.3%. With web_search, the S4 average drops to 42.2%, with Financial falling from 73.3% to 20.0%, but Software still reaches 60.0% and Reference 46.7%.
• Authors' interpretation: Routine save behavior alone can elevate short-term contamination into persistent memory, without explicitly requesting that contaminated content be saved; external search provides only partial and domain-dependent mitigation.

Study 3: Persistence under diluted browsing and context management

• Setup: The victim agent browses an entire submolt of 20 posts, with only 1 post manipulated and the other 19 benign, and the information stream keeps growing; OpenClaw's default session pruning and compaction take effect.
• Save rate (Table 6a): The average rises from 8.9% at S1 to 28.9% at S4; Financial reaches 60.0% at S4, while Software and Reference are overall much lower.
• Cross-session ASR (Table 6b): Without web_search, the S4 average is 17.8% (Financial 33.3%); with web_search, the S4 average is 11.1%, and the Reference domain drops to 0.0%. Financial has a 60.0% save rate at S4 but only 33.3% (without search) translates into behavioral influence.
• Authors' interpretation: Memory contamination is a necessary but not sufficient condition for behavioral influence; content dilution and context management weaken the effect but do not eliminate it, and Figure 6 shows that Study 3 is lower than Study 2 at every save level but remains non-zero.

Other ablations and analyses

• web_search × social signals (Figure 5b): With search, A1 yields ASR of 75.6%/20.0% under B1/B2, and A2 yields 73.3%/8.9%; the qualitative pattern is unchanged.
• Domain breakdown (Figure 5c, 5d): The authors state that Software and Financial maintain high ASR when both signals are present, and Reference is more sensitive to the absence of consensus.
• Version scope: Experiments are on the pre-fix version of January 24, 2026; a later issue #17804 (February 16, 2026) proposed pruning HEARTBEAT_OK turns, which the authors argue does not eliminate the architectural risk of the shared session.

Limitations and future directions noted by the authors

• Single model and isolated platform (§7.2): all victim agents run on a single model family, and the experiments are conducted on the isolated MissClaw replica, which cannot fully capture the concurrency, moderation, and evolving social dynamics of the real platform.
• Domain coverage (§7.2): only three representative domains are covered; higher-risk domains such as healthcare and law may exhibit different vulnerability profiles.
• LLM judging (§7.2): behavior classification relies on LLM judges, although some samples were manually verified.
• Save prompt is a proxy (§7.2): the save prompt gradient is a proxy for real users' memory-saving behavior; real users' instructions may be more diverse and more contextual.
• Tasks are controlled probes (§7.2): the evaluation tasks are controlled probes of downstream behavioral impact rather than an exhaustive modeling of real attackers' goals; stronger real attacks may pursue more direct goals such as payment redirection and account takeover.
• Static content and unevaluated mitigations (§7.2): the manipulated content is static rather than adaptive, and stronger attackers able to tailor false information to agent behavior may achieve higher success rates; the authors did not empirically evaluate the mitigations discussed (source labeling, heartbeat visibility, isolating the heartbeat context, checks before sensitive tasks).

Scope of the experiments

• The model tested is Claude Haiku 4.5 alone, with 5 persona configurations as victim agents; the judge model is also Claude Haiku 4.5.
• The experimental platform is MissClaw (an isolated replica of Moltbook), not run on the real Moltbook; the OpenClaw version is the pre-fix version of January 24, 2026.
• The tasks cover 3 domains—software security, financial decisions, and academic citation—with 9 scenarios in total; the social signals are 4 combinations of authority × consensus; the save prompts have five levels, S0–S4.
• The paper does not report the number of runs per condition, the number of repetitions, or the agreement figures between LLM judging and manual verification.
• The paper does not empirically test any defense or mitigation, only discussing potential directions in §7.1.

An attack paper targeting Claw persistent personal agents: the authors claim that the architectural design in which heartbeat background execution shares the same session as foreground conversation allows ordinary false information encountered in the background to silently contaminate memory and influence subsequent behavior without prompt injection.

• Problem: heartbeat runs in the same main session and is invisible to the user by default, and ingested content lacks source distinction; the authors formalize the contamination path as Exposure→Memory→Behavior and identify social platforms as the most scalable entry point (Table 2).
• Method: they build MissClaw, an isolated replica of Moltbook, deploy 5 OpenClaw agents with different personas (all Claude Haiku 4.5), conduct same-session and cross-session experiments across 9 scenarios in 3 domains—software security, financial decisions, and academic citation—and use LLM judging to determine ASR.
• Short-term impact: consensus is the dominant signal—without web_search, the ASR under the authority condition is 82.2% / 22.2% with / without consensus (Figure 5); the Skeptical persona has the lowest overall ASR (16.7%, Table 3), but no persona is fully immune.
• Long-term persistence: under the S4 save prompt, an average of 91.1% of contaminated content is written to long-term memory (Table 5a), and cross-session ASR averages 75.6% (without web_search, Table 5b); with web_search provided, the S4 average drops to 42.2%, and mitigation varies by domain.
• Realistic conditions: under diluted browsing where only 1 of 20 posts is manipulated, the S4 average write rate drops to 28.9% and cross-session ASR to 17.8% (without search); the effect weakens but is not eliminated; the authors consider built-in context management not a reliable defense.
• Authors' conclusion: building trustworthy persistent agents requires treating background execution, memory persistence, and source visibility as core security issues; potential mitigations include memory source labeling, heartbeat visibility, and isolating the heartbeat context, but the paper does not empirically evaluate them. The experiments are limited to the pre-fix version of January 24, 2026, a single model family, and an isolated platform.