Skip to content

Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study

🕒 Published (v1): 2026-04-30 06:04 UTC · Source: Arxiv · link

Why this paper was selected

Layered security attack/defense review for autonomous agent framework vulnerabilities

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This survey introduces a four-layer security taxonomy for autonomous agent frameworks—context/instruction, tool/action, state/persistence, and ecosystem/automation—and systematically maps attacks and defenses across each layer. It uses OpenClaw as a concrete case study to illustrate how real-world meta-harness architecture creates interconnected attack surfaces. The central finding is that threats propagate across layers, from manipulated inputs to unsafe actions to persistent state contamination to ecosystem-level compromise.

Problem

Existing agent security literature is fragmented: general LLM safety surveys ignore tool-execution and persistent-state risks; prompt injection surveys stop at the context layer; agent-specific studies (AgentDojo, ASB, PASB) benchmark individual mechanisms without providing a cross-layer synthesis. No prior work offers a layered taxonomy that traces the full attack lifecycle through autonomous agent frameworks or analyzes how vulnerabilities in one architectural layer enable or amplify threats in adjacent layers.

Method

The authors propose a four-layer decomposition motivated by the causal lifecycle of an attack—entry → execution → persistence → amplification—rather than by capability modules (planning, memory, tool use) used in prior agent surveys. Each layer is analyzed with a consistent template: functional role, attack surface, representative attack techniques, corresponding defenses, and attack-defense gaps/cross-layer implications. OpenClaw serves as the running case study because its architecture makes each layer explicit: runtime prompt construction (context layer), typed tool interfaces (tool layer), per-agent workspaces and session history (state layer), and skills/plugin/channel integrations (ecosystem layer). The analysis synthesizes existing studies into per-layer summary tables (attack surface × representative attack × defense × limitation) and then performs a cross-layer propagation analysis in §5.2.

Key Contributions

  • Unified four-layer taxonomy (context/instruction → tool/action → state/persistence → ecosystem/automation) as an organizing principle for agent framework security.
  • Systematic per-layer synthesis of existing attack techniques and defenses, identifying gaps where defenses intervene too late (post-action) relative to where attacks begin (tool selection, parameter construction).
  • Cross-layer threat propagation analysis showing a single injected instruction can escalate from manipulated input to systemic compromise via: prompt injection → unsafe tool call → workspace contamination → ecosystem-level lateral movement.
  • OpenClaw case study demonstrating practical relevance of the taxonomy in a deployed, dynamically-assembled meta-harness.
  • Identification of three structural research gaps: imbalance across layers (context layer overrepresented, ecosystem layer underexplored), lack of long-horizon evaluation, and weak ecosystem trust models.

Results

This is a survey paper; no new experimental benchmarks are reported. Representative quantitative findings from cited works: - Clawdrain (resource-amplification attack): achieves 6–7× token amplification, up to 9× in some configurations, by manipulating tool-use workflows. - ChatInject and PISmith-style adaptive injection (cited): demonstrate improved attack success rates by exploiting structured chat templates and reinforcement-learning-discovered injection strategies, though specific numeric results are not reproduced in the text provided. - InjecAgent and AgentDojo benchmarks (cited): confirm indirect prompt injection is effective in realistic tool-integrated, multi-step agent settings.

Limitations

  • Survey coverage is bounded by the text-provided excerpt; the state/persistence and ecosystem/automation layer analyses are truncated and cannot be fully assessed.
  • No new empirical evaluation; reliance on cited work means coverage depth is uneven across attack types.
  • OpenClaw is the sole concrete case study; generalizability of the taxonomy to other meta-harness architectures (e.g., LangGraph, AutoGen, Claude Code) is asserted but not validated.
  • Cross-layer propagation analysis (§5.2) is described conceptually without quantitative experiments demonstrating propagation rates or severity.
  • Defense recommendations remain largely qualitative; the survey identifies gaps but does not propose concrete new mechanisms.

Relevance to Harnesses / Meta-Harnesses

OpenClaw is itself a meta-harness—it dynamically assembles system prompts from tool lists, skill descriptions, bootstrap files, and runtime metadata, and extends agent capability via heartbeat/cron automation—making this paper a direct security analysis of the meta-harness paradigm. The four-layer taxonomy maps precisely onto the architectural components that define a harness: the prompt construction pipeline (context layer), tool/skill dispatch (tool/action layer), session and workspace state (state/persistence layer), and plugin/channel/cron integrations (ecosystem layer). For researchers building or extending agent harnesses, the cross-layer propagation model is the most actionable takeaway: a security compromise at the context-assembly stage (e.g., a poisoned skill description or tool-return injection) can cascade through the entire harness execution stack. The identified gap around long-horizon evaluation is particularly salient for meta-harnesses that run persistent, multi-session pipelines with minimal human oversight.