OpenClaw agentic systems face recurring security and trust boundary flaws
Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security
Cryptography and SecuritySoftware Engineering
Summary
OpenClaw is a type of AI personal assistant that uses memory, reasoning, and tools to help with tasks, but this complexity also creates security risks. The authors studied thousands of online posts and issues to find many security problems, often caused by unclear trust boundaries between parts of the system. They found common weaknesses like unauthorized access, data leaks, and code injection. Based on these patterns, they suggest ways to improve safety, such as limiting tool permissions and closely monitoring execution.
What this means in practice
- •For software security engineers: Identify recurring security weaknesses in AI assistant frameworks to design safer access controls and containment measures.
- •For devops and deployment teams: Improve deployment configurations by applying defense-in-depth strategies and runtime monitoring to limit risks in complex agentic AI systems.
A survey. It maps existing work.
Authors
Mostafijur Rahman Akhond, Mahmuda Khatun, Gias Uddin
Abstract
AI-powered personal assistant frameworks such as OpenClaw combine LLM reasoning, persistent memory, tool invocation, local execution, and web-based workflows. These capabilities enable useful automation, but they also create security risks when untrusted inputs, model reasoning, tools, memory, and deployment configuration interact without explicit trust boundaries. This paper presents an empirical study of reported security concerns in OpenClaw using two complementary data sources: Reddit discussions and security-tagged GitHub issues. We analyze more than 25K Reddit posts from 13 OpenClaw-related subreddits and identify 162 security-relevant posts with 1,787 associated comments. We further collect 358 security-tagged GitHub issues and retain 180 issues describing concrete security concerns. Using qualitative analysis and evidence-grounded CWE mapping, we identify 521 CWE instances across 59 distinct weakness types, concentrated in access-control failures, sensitive-data exposure, injection, and unsafe execution. We also extract 543 practitioner mitigation suggestions and consolidate them into seven recurring strategies. To complement the empirical analysis, we present an evidence-grounded illustrative reconstruction of a representative sensitive-data exposure pathway using dummy secret values. Our findings show that OpenClaw security issues are not isolated implementation bugs; they reflect recurring trust-boundary failures across the agent execution pipeline. We discuss how these weaknesses map to both traditional software-security categories and agent-specific failure mechanisms, and derive implications for safer agentic systems, including explicit trust boundaries, least-privilege tool access, execution containment, runtime oversight, and defense-in-depth deployment.