OpenClaw agents exhibit widespread trust-boundary security flaws
The claim
OpenClaw’s agentic system suffers numerous recurring security weaknesses across its execution pipeline
Published as: “Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security”
So what
Deployers of OpenClaw-like agents need built-in, defense-in-depth controls across the entire execution pipeline rather than relying on optional user-level hardening.
The five-minute version
OpenClaw security concerns are dominated by trust-boundary failures, with 521 CWE instances across 59 weakness types, especially access-control failures, sensitive-data exposure, injection, and unsafe execution. The study analyzes 162 security-relevant Reddit posts and 180 validated GitHub issues, extracting 543 practitioner mitigation suggestions that are grouped into seven defense-in-depth strategies. Evidence comes from public community reports rather than controlled experiments, and while the authors report zero false negatives in sampled LLM-filter audits, they acknowledge the counts are lower-bound estimates and not exhaustive.
What they found 2
- 521 CWE instances across 59 weakness types were identified, concentrated in access-control failures, sensitive-data exposure, injection, and unsafe execution.
“We identify 521 CWE instances across 59 distinct weakness types, concentrated in access-control failures, sensitive-data exposure, injection, and unsafe execution.”
- 543 practitioner mitigation suggestions were extracted and consolidated into seven defense-in-depth strategies.
“We extract 543 practitioner mitigation suggestions and consolidate them into seven defense-in-depth strategies for safer OpenClaw deployment.”
What undercuts it the paper’s own results
- The authors treat Reddit and GitHub reports as security-relevant behavior rather than confirmed exploitable vulnerabilities.
- The reported counts are described as lower-bound estimates, not exhaustive coverage of all OpenClaw weaknesses.
Stated limits 3
- Construct validity: "We therefore treat them as reports of security-relevant behavior, concerns, misconfigurations, and implementation weaknesses rather than confirmed exploitable vulnerabilities."
- Internal validity: "Our counts should be interpreted as lower-bound estimates rather than exhaustive coverage."
- External and temporal validity: findings are limited to OpenClaw and to public Reddit and GitHub sources, may overrepresent visible failures and exclude private deployments.
What’s new here 4
- Uses real-world community reports (Reddit discussions and GitHub issues) instead of controlled attack scenarios.
- Maps reported issues to CWE taxonomy, yielding 521 instances across 59 classes.
- Extracts and consolidates 543 practitioner mitigation suggestions into seven concrete strategies.
- Provides an evidence-grounded illustrative reconstruction of a sensitive-data exposure pathway.
Artifacts & methods 6
- Reddit postsdataset
- GitHub issuesdataset
- LLM-assisted filtering
- CWE mapping
- Mitigation suggestion extraction
- Illustrative reconstruction of a sensitive-data exposure pathwaysystem