Two Teams Find OpenClaw Open to Code Execution
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Imperva researcher Yohann Sillam found OpenClaw flattens message objects (shared contacts, vCards, location pins) directly into LLM prompts without marking them as untrusted, letting hidden instructions ride inside legal characters like angle brackets in a contact name — and in tests against Gemini 3.1 Pro (preview), the agent downloaded and ran a script from a researcher-controlled server.
- OpenClaw shipped a fix in version 2026.4.23 that moves contact names, vCard fields, and location labels out of the prompt body into a separate untrusted-metadata channel, though Imperva found the same flattening pattern in other personal AI assistants.
- Varonis Threat Labs, led by Itay Yashar, built a test agent called Pinchy on OpenClaw wired to a Gmail inbox of synthetic data and mock secrets, and watched it fail both exfiltration tests — forwarding mock AWS IAM keys, database connection strings, and SSH credentials in one case, and shipping a synthetic dataset of 247 enterprise customers in another.
- Varonis drew a line between traditional prompt injection and what it calls "agent phishing" — believable social requests arriving through normal channels — and noted OpenAI's Codex GPT-5.4 was more cautious than Gemini 3.1 Pro about sending data outside, but both models fell for the social pretexts even with a strict sender-verification policy in place.
- A separate InfoSec Write-ups analysis turned OpenClaw's past advisories into static-analysis rules and found five more flaws in the Slack, Discord, Matrix, Zalo, and Microsoft Teams channel extensions — all the same bug, where startup code resolved allowlists by mutable display name rather than stable ID, letting an attacker rename themselves to match an allowed user.
- The Dutch Autoriteit Persoonsgegevens told users and organizations not to run OpenClaw on systems holding sensitive data, citing data-breach and account-takeover risks.
- Varonis laid out four architectural controls: treat the instruction file as enforced version-controlled policy, gate outbound mail to unfamiliar addresses, tie connector access to the trust level of the triggering task, and require human approval before forwarding credentials or moving money.
Why it matters: OpenClaw's design — reading untrusted data, sending data out, broad system access — makes the prompt-injection problem architecturally unsolvable with patches alone. The Dutch DPA has formally told users not to run it on sensitive systems, and the real mitigation is architectural (human-in-the-loop, outbound mail gates, trust-level connector scoping), not prompt engineering — a warning that applies to any agent with email and shell access.
