mlsanityData to 7 Oct 2026

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

arXiv 2603.00902 ↗First posted 1 Mar 2026cs.CR cs.SEcited by 14

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Modern generative agents such as OpenClaw - an open-source, self-hosted personal assistant with a community skill ecosystem, are gaining attention and are used pervasively. However, the openness and rapid growth of these ecosystems often outpace systematic security evaluation. In this paper, we design, implement, and evaluate Clawdrain, a Trojanized skill that induces a multi-turn "Segmented Verification Protocol" via injected SKILL.md instructions and a companion script that returns PROGRESS/REPAIR/TERMINAL signals. We deploy Clawdrain in a production-like OpenClaw instance with real API billing and a production model (Gemini 2.5 Pro), and we measure 6-7x token amplification over a benign baseline, with a costly, failure configuration reaching approximately 9x. We observe a deployment-only phenomenon: the agent autonomously composes general-purpose tools (e.g., shell/Python) to route around brittle protocol steps, reducing amplification and altering attack dynamics. Finally, we identify production vectors enabled by OpenClaw's architecture, including SKILL.md prompt bloat, persistent tool-output pollution, cron/heartbeat frequency amplification, and behavioral instruction injection. Overall, we demonstrate that token-drain attacks remain feasible in real deployments, but their magnitude and observability are shaped by tool composition, recovery behavior, and interface design.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 13 of its 24 references that are in the map. First posted on arXiv 1 Mar 2026.

Builds on

13 of 24 references.

Closest ancestors · 3

Same direction, newest first

  1. 2026Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents16 Jan
  2. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification30 Jul
  3. 2024The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models25 Jul

Other references · 10

  1. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  2. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
  3. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  4. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  5. 2024Coercing LLMs to do and reveal (almost) anythingcited by 88
  6. 2025Multi-Agent Coordination across Diverse Applications: A Surveycited by 37
  7. 2025AlphaAgent: LLM-Driven Alpha Mining with Regularized Exploration to Counteract Alpha Decaycited by 36
  8. 2024Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settingscited by 33
  9. 2024An Engorgio Prompt Makes Large Language Model Babble oncited by 30
  10. 2025Optimizing Prompt Sequences using Monte Carlo Tree Search for LLM-Based Optimizationcited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 14.

14 papers.

Sort:

By area:

  1. 2026Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollutioncited by 5
  2. 2026BraveGuard: From Open-World Threats to Safer Computer-Use Agentscited by 4
  3. 2026Resource Consumption Threats in Large Language Modelscited by 2
  4. 2026Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClawcited by 2
  5. 2026When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agentscited by 2
  6. 2026Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agentscited by 2
  7. 2026Examining Users' Behavioural Intention to Use OpenClaw Through the Cognition--Affect--Conation Frameworkcited by 1
  8. 2026When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agentscited by 1
  9. 2026Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasurescited by 1
  10. 2026Understanding and mitigating the risks of OpenClaw for non-technical users: A practical guide with Skillcited by 0
  11. 2026The Claws in Plain Sight: Unauthorized Context Disclosure through LLM Agent Tool Callscited by 0
  12. 2026SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agentscited by 0
2 more
  1. 2026Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agentscited by 0
  2. 2026Cheap to Hypothesize, Costly to Verify: The Defense Surface of Agentic Vulnerability Discoverycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents
  2. 2026Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance
  3. 2026ClawTrap: A MITM-Based Red-Teaming Framework for Real-World OpenClaw Security Evaluation
  4. 2026Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
  5. 2026Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw
  6. 2026Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw
  7. 2026A Security Analysis of the OpenClaw AI Agent Framework
  8. 2026From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent