mlsanityData to 7 Oct 2026

Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures

arXiv 2605.25435 ↗First posted 25 May 2026cs.AIcited by 1

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

The rapid evolution of large language model (LLM)-driven autonomous agents has given rise to OpenClaw, a new class of open-source agent frameworks that operate as continuously running, skill-augmented systems with persistent memory, multi-channel interaction, and high degrees of autonomy. Such capabilities enable OpenClaw agents to autonomously execute complex, multi-step tasks and interact seamlessly with external applications, but simultaneously introduce a substantially enlarged attack surface. In particular, the combination of high-privilege operations and persistent memory exposes OpenClaw agents to various emerging threats, including skill poisoning, cognitive manipulation, multi-agent cascading failures, and supply-chain vulnerabilities. In this survey, we present a comprehensive study of the security landscape of OpenClaw agents. We first examine the general architecture and key characteristics that distinguish OpenClaw agents from traditional AI agent systems. We categorize existing security and privacy threats into a layered framework and analyze how vulnerabilities arise during agent reasoning, action execution, and external interaction. Representative defense mechanisms are also reviewed to draw the current defense landscape. Finally, several unresolved issues related to the reliability and trustworthiness of OpenClaw ecosystems are discussed.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 41 of its 71 references that are in the map. First posted on arXiv 25 May 2026.

Builds on

41 of 71 references.

Closest ancestors · 27

Same direction, newest first

  1. 2026ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection13 Apr
  2. 2026Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw6 Apr
  3. 2026Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis3 Apr
  4. 2026SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Do28 Mar
  5. 2026AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems16 Mar
  6. 2026Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection13 Mar
  7. 2026Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw13 Mar
  8. 2026OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents12 Mar
  9. 2026Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats12 Mar
  10. 2026Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents1 Mar
  11. 2026Agents of Chaos23 Feb
  12. 2026Automating Agent Hijacking via Structural Template Injection18 Feb
15 more
  1. 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections17 Feb
  2. 2026MalTool: Malicious Tool Attacks on LLM Agents12 Feb
  3. 2026From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent9 Feb
  4. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management7 Feb
  5. 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale15 Jan
  6. 2026Memory Poisoning Attack and Defense on Memory Based LLM-Agents9 Jan
  7. 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory29 Sep
  8. 2025Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution1 Jun
  9. 2025Security of Internet of Agents: Attacks and Countermeasures12 May
  10. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  11. 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasures12 Mar
  12. 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
  13. 2024From Allies to Adversaries: Manipulating LLM Tool-Calling through Adversarial Injection13 Dec
  14. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies28 Jul
  15. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar

Other references · 14

  1. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  2. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 122
  3. 2024Best-of-N Jailbreakingcited by 71
  4. 2026AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?cited by 45
  5. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  6. 2026Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClawcited by 26
  7. 2026BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoningcited by 25
  8. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attackscited by 24
  9. 2026ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watcherscited by 18
  10. 2026A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)cited by 15
  11. 2025ReCAP: Recursive Context-Aware Reasoning and Planning for Large Language Model Agentscited by 13
  12. 2026AI Agents Need Memory Control Over More Contextcited by 7
2 more
  1. 2025Detecting Malicious Entra OAuth Apps with LLM-Based Permission Risk Scoringcited by 1
  2. 2026Cascade: Composing Software-Hardware Attack Gadgets for Adversarial Threat Amplification in Compound AI Systemscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Controlcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study
  2. 2026A Security Analysis of the OpenClaw AI Agent Framework
  3. 2026Clawed and Dangerous: Can We Trust Open Agentic Systems?
  4. 2026Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations
  5. 2026Toward Securing AI Agents Like Operating Systems
  6. 2026OpenClaw and Ollama in Agentic AI: Toward Fully Autonomous and Scalable AI Agent Systems
  7. 2026Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClaw
  8. 2026SafeClaw-R: Towards Safe and Secure Multi-Agent Personal Assistants