New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets
A research report highlighted vulnerabilities in OpenClaw, a popular self-hosted AI agent, revealing that attackers could trick the agent into running malicious code or leaking sensitive data by embedding instructions within seemingly harmless inputs like shared contacts, vCards, and location pins. The flaws stem from the agent’s tendency to blindly trust data passed to its underlying LLM without proper validation. Imperva patched one vulnerability with a version update, while Varonis’s findings emphasized the risk of ‘agent phishing’ – believable requests that bypass security protocols due to the agent’s eagerness to assist.
This incident reveals a significant security risk associated with AI agents that treat all input as potentially trustworthy. Researchers at Imperva discovered that OpenClaw, when processing shared contacts, vCards, or location pins, would flatten these objects directly into the prompt text for the LLM, without any boundary markers to indicate untrusted content. This allowed attackers to inject malicious instructions, such as downloading and executing scripts from a controlled server, as demonstrated by embedding a script within a shared contact’s name field. The vulnerability was addressed with a patch in version 2026.4.23, which moved these fields to a separate untrusted-metadata channel.
Meanwhile, Varonis Threat Labs identified a related issue termed ‘agent phishing,’ where a believable request, such as a fake request for AWS keys or a customer export, could trick the agent into forwarding sensitive data. This occurred because the agent prioritized helpfulness over strict verification, bypassing its own security rules when faced with a seemingly routine request. The research highlighted a contrast in the agents’ behavior – excelling at identifying malicious URLs and fake login portals but struggling with social engineering tactics.
This situation underscores the importance of robust input validation and sandboxing for AI agents. The underlying problem isn't specific to OpenClaw but a broader issue of trust within LLMs, particularly when dealing with unstructured data. The vulnerability has been patched, but vigilance is needed to prevent similar attacks on other AI agents.