# A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)

arXiv: https://arxiv.org/abs/2602.14364 · HTML: https://mlsanity.com/paper/2602.14364/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 29 references that are in the map.
- First posted on arXiv 16 Feb 2026.

## Builds on (most cited first, 6 of 6)

- [A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions](https://mlsanity.com/paper/2311.05232/) (2023)
- [AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security](https://mlsanity.com/paper/2601.18491/) (2026)
- [Reducing Tool Hallucination via Reliability Alignment](https://mlsanity.com/paper/2412.04141/) (2024)
- [Are Your Agents Upward Deceivers?](https://mlsanity.com/paper/2512.04864/) (2025)
- [AgenTRIM: Tool Risk Mitigation for Agentic AI](https://mlsanity.com/paper/2601.12449/) (2026)
- [LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarios](https://mlsanity.com/paper/2602.03255/) (2026)

## Built on by (most cited first, 16 of 16)

- [Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats](https://mlsanity.com/paper/2603.11619/) (2026)
- [ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers](https://mlsanity.com/paper/2603.24414/) (2026)
- [Auditing Agent Harness Safety](https://mlsanity.com/paper/2605.14271/) (2026)
- [Quantifying Trust: Financial Risk Management for Trustworthy AI Agents](https://mlsanity.com/paper/2604.03976/) (2026)
- [AgentWatcher: A Rule-based Prompt Injection Monitor](https://mlsanity.com/paper/2604.01194/) (2026)
- [Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution](https://mlsanity.com/paper/2603.23064/) (2026)
- [Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens](https://mlsanity.com/paper/2606.30755/) (2026)
- [BraveGuard: From Open-World Threats to Safer Computer-Use Agents](https://mlsanity.com/paper/2606.01166/) (2026)
- [SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents](https://mlsanity.com/paper/2606.18356/) (2026)
- [When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents](https://mlsanity.com/paper/2607.05189/) (2026)
- [How do AI agents talk about science and research? An exploration of scientific discussions on Moltbook using BERTopic](https://mlsanity.com/paper/2603.11375/) (2026)
- [Examining Users' Behavioural Intention to Use OpenClaw Through the Cognition--Affect--Conation Framework](https://mlsanity.com/paper/2603.11455/) (2026)
- [Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures](https://mlsanity.com/paper/2605.25435/) (2026)
- [Understanding and mitigating the risks of OpenClaw for non-technical users: A practical guide with Skill](https://mlsanity.com/paper/2606.11007/) (2026)
- [SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains](https://mlsanity.com/paper/2608.06862/) (2026)
- [Concepts for Securing Agentic AI Coding and the Terok Environment](https://mlsanity.com/paper/2608.22930/) (2026)

## Abstract (arXiv)

Clawdbot is a self-hosted, tool-using personal AI agent with a broad action space spanning local execution and web-mediated workflows, which raises heightened safety and security concerns under ambiguity and adversarial steering. We present a trajectory-centric evaluation of Clawdbot across six risk dimensions. Our test suite samples and lightly adapts scenarios from prior agent-safety benchmarks (including ATBench and LPS-Bench) and supplements them with hand-designed cases tailored to Clawdbot's tool surface. We log complete interaction trajectories (messages, actions, tool-call arguments/outputs) and assess safety using both an automated trajectory judge (AgentDoG-Qwen3-4B) and human review. Across 34 canonical cases, we find a non-uniform safety profile: performance is generally consistent on reliability-focused tasks, while most failures arise under underspecified intent, open-ended goals, or benign-seeming jailbreak prompts, where minor misinterpretations can escalate into higher-impact tool actions. We supplemented the overall results with representative case studies and summarized the commonalities of these cases, analyzing the security vulnerabilities and typical failure modes that Clawdbot is prone to trigger in practice.