Skip to content

Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures

🕒 Published (v1): 2026-05-25 05:25 UTC · Source: Arxiv · link

Why this paper was selected

Security fundamentals, attacks, countermeasures for persistent OpenClaw agent frameworks

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

OpenClaw is an open-source autonomous agent framework (released November 2025, 330k GitHub stars) that runs as a continuously operating harness integrating persistent memory, modular skill orchestration, and OS-level execution. This survey systematically maps the security threats specific to OpenClaw's architecture across three layers—cognition, execution, and interaction—and reviews existing countermeasures. The paper distinguishes OpenClaw from prior general-purpose LLM agent frameworks by its deep coupling of reasoning with OS-level resources and a user-installable third-party skill marketplace.

Problem

Existing AI agent security surveys focus on general-purpose or multi-agent frameworks and do not capture the unique threat surface introduced by OpenClaw-style systems, where persistent memory, continuous runtime operation, high-privilege OS access, and a community skill marketplace collectively amplify the blast radius of standard LLM vulnerabilities. Cisco found that 26% of ~31k publicly available OpenClaw skills contain at least one vulnerability; Oasis Security demonstrated that a malicious webpage can hijack locally deployed OpenClaw agents without browser plugins or explicit user interaction.

Method

Survey paper structured as a layered taxonomy: 1. Architecture analysis — decomposes OpenClaw into seven components (agent-user interface, gateway control plane, agent runtime, reasoning engine, skill system, memory system, execution nodes) and identifies the three key characteristics that distinguish it: tool/skill-augmented reasoning, persistent memory (working/short-term/long-term), and OS-level access. 2. Threat categorization — organizes threats into a three-tier hierarchy mirroring the architecture: cognition layer (reasoning/memory), execution layer (skills/code), interaction layer (multi-channel/inter-agent comms). 3. Defense review — maps existing and proposed countermeasures to each threat class. (Defense section is truncated in the supplied text.)

The cognition-layer threats catalogued include: indirect prompt injection, prompt-based skill instruction override, structured instruction injection (exploiting chat-template parsing), persistent memory rule injection, vector DB soft backdoors, RAG knowledge source poisoning, and inference-stage context drift.

Key Contributions

  • Detailed architectural decomposition of OpenClaw's seven-component runtime and three-tier cognition/execution/interaction pipeline.
  • First survey focused specifically on OpenClaw-class systems (continuous-running, skill-augmented, OS-coupled), distinguishing their threat surface from conventional LLM agents.
  • Unified three-layer threat taxonomy covering: goal hijacking, memory/context poisoning, skill supply-chain attacks (ClawHub poisoning, capability impersonation, unpinned dependencies), unexpected code execution, cascading multi-agent failures, identity/privilege abuse, insecure inter-agent communication, and human-agent trust exploitation (consent fatigue).
  • Identification of cross-cutting compound threats—e.g., planner–executor coupling fan-out, fault persistence in saved state, loop amplification/resource overload—that arise specifically from the harness's continuous operation model.

Results

This is a survey; no original experimental benchmarks are reported. Cited empirical data points from prior work: - Cisco: 26% of ~31,000 publicly available OpenClaw skills contained at least one vulnerability. - Oasis Security: malicious webpages can hijack locally deployed OpenClaw agents during ordinary browsing without plugins or user interaction. - MM-POISONRAG [22]: poisoned RAG entries propagate through reranking and generation, converting local data corruption into pipeline-level failures. - Sunil et al. [21]: unprivileged users can poison persistent memory via query-only interactions, with effects persisting across sessions.

Limitations

  • Paper text is truncated; defense mechanisms and open challenges (Sections IV–VI) are not available for review.
  • No original empirical evaluation of attacks or defenses—all quantitative data is drawn from cited prior works.
  • OpenClaw is treated as a representative framework; generalizability of the taxonomy to other continuous-runtime agent harnesses (e.g., Eliza, AutoGPT-style systems) is asserted but not demonstrated.
  • The skill supply-chain analysis relies on Cisco's snapshot of 31k skills; coverage and recency of that dataset are not characterized.

Relevance to Harnesses / Meta-Harnesses

OpenClaw is itself a canonical instance of an agent meta-harness—a persistent, continuously running orchestration runtime that manages memory, schedules skills, routes multi-channel I/O, and abstracts over multiple LLM backends—making this survey directly applicable to anyone designing or securing similar harness architectures. The three-tier threat taxonomy (cognition/execution/interaction) maps cleanly onto the functional layers that any orchestration harness must implement, providing a reusable threat-modeling vocabulary. The supply-chain risks documented here (ClawHub poisoning, unpinned skill dependencies, capability impersonation) are structurally identical to threats faced by any harness with a plugin/skill marketplace. Practitioners building meta-harnesses should treat the cross-stage compound threats—particularly planner–executor coupling fan-out and fault persistence in saved state—as first-class design constraints rather than afterthoughts.