mlsanityData to 7 Oct 2026

Execution Is the New Attack Surface: Survivability-Aware Agentic Crypto Trading with OpenClaw-Style Local Executors

arXiv 2603.10092 ↗First posted 10 Mar 2026cs.CR cs.AIcited by 4

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

OpenClaw-style agent stacks turn language into privileged execution: LLM intents flow through tool interception, policy gates, and a local executor. In parallel, skill marketplaces such as skills.sh make capability acquisition as easy as installing skills and CLIs, creating a growing capability supply chain. Together, these trends shift the dominant safety failure mode from "wrong answers" to execution-induced loss, where untrusted prompts, compromised skills, or narrative manipulation can trigger real trades and irreversible side effects. We propose Survivability-Aware Execution (SAE), an execution-layer survivability standard for OpenClaw-style systems and skill-enabled agents. SAE sits as middleware between a strategy engine (LLM or non-LLM) and the exchange executor. It defines an explicit execution contract (ExecutionRequest, ExecutionContext, ExecutionDecision) and enforces non-bypassable last-mile invariants: projection-based exposure budgets, cooldown and order-rate limits, slippage bounds, staged execution, and tool/venue allowlists. To make delegated execution testable under supply-chain risk, we operationalize the Delegation Gap (DG) via a logged Intended Policy Spec that enables deterministic out-of-scope labeling and reproducible DG metrics. On an offline replay using official Binance USD-M BTCUSDT/ETHUSDT perpetual data (15m; 2025-09-01--2025-12-01, incl. funding), SAE improves survivability: MDD drops from 0.4643 to 0.0319 (Full; 93.1%), |CVaR_0.99| shrinks from 4.025e-3 to ~1.02e-4 (~97.5%), and DG loss proxy falls from 0.647 to 0.019 (~97.0%). AttackSuccess decreases from 1.00 to 0.728 with zero FalseBlock in this run. Block bootstrap, paired Wilcoxon, and two-proportion tests confirm the shifts. SAE reframes agentic trading safety for the OpenClaw+skills era: treat upstream intent and skills as untrusted, and enforce survivability where actions become side effects.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 9 of its 22 references that are in the map. First posted on arXiv 10 Mar 2026.

Builds on

9 of 22 references.

References · 9

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  3. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  4. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
  5. 2026Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forwardcited by 105
  6. 2026"Humans welcome to observe": A First Look at the Agent Social Network Moltbookcited by 25
  7. 2026OpenClaw Agents on Moltbook: Risky Instruction Sharing and Norm Enforcement in an Agent-Only Social Networkcited by 19
  8. 2025AI-Governed Agent Architecture for Web-Trustworthy Tokenization of Alternative Assetscited by 3
  9. 2025Safe and Compliant Cross-Market Trade Execution via Constrained RL and Zero-Knowledge Auditscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026Examining Users' Behavioural Intention to Use OpenClaw Through the Cognition--Affect--Conation Frameworkcited by 1
  2. 2026Absorbing Complexity: An Interaction-Native Knowledge Harness for Financial LLM Agentscited by 0
  3. 2026OpenClaw and Ollama in Agentic AI: Toward Fully Autonomous and Scalable AI Agent Systemscited by 0
  4. 2026TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actionscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Architecting Resilient LLM Agents: A Guide to Secure Plan-then-Execute Implementations
  2. 2026Securing LLM Agents Need Intent-to-Execution Integrity
  3. 2026Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats
  4. 2026SINGED: Correct Outputs Do Not Certify Safe Execution in LLM Agents
  5. 2026Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection
  6. 2026Clawed and Dangerous: Can We Trust Open Agentic Systems?
  7. 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
  8. 2026Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations