Researchers Turn OpenClaw Into a Confused Deputy With Hidden Prompts

Two research teams published work this week showing that OpenClaw, the self-hosted AI agent that's become a fixture in productivity stacks over the past year, can be coerced into running attacker-controlled code or surrendering secrets through inputs a victim would never think to inspect.

The attacks are classic indirect prompt injection. The novelty is the delivery.

Imperva's team buried instructions inside shared contacts, vCards, and location pins. The agent ingested the metadata, followed the embedded directions, and acted on them without ever surfacing the payload to the user. No malicious attachment. No suspicious link. Just a contact card.

Varonis built a test agent on top of OpenClaw and demonstrated a parallel class of abuse, though the full technical writeup from that team focuses on data exfiltration paths rather than code execution.

For readers who haven't tangled with it: OpenClaw is an open-source agent framework that ships with broad tool access by default — file system, shell, browser, and a long tail of community plugins. That permissioning model is what makes the injection class so dangerous. The agent isn't tricked into a single bad output. It's tricked into reaching for tools the operator already gave it.

Neither research group is calling this a single CVE. It's a category. Both teams told vendors before publishing, and both flagged that the underlying issue — agents treating retrieved content as instructions rather than data — is not unique to OpenClaw. The same pattern has now been demonstrated against several mainstream agent frameworks over the past eighteen months.

What's different here is the mundanity of the carrier. A vCard is not a payload anyone scans. A pinned location is not a phishing indicator. Mail filters and EDR have no signature for "contact metadata that politely asks the agent to read /etc and POST it somewhere."

Mitigations the researchers suggested track with where the rest of the industry has landed:

• Strict separation between trusted instructions and retrieved content.
• Tool-call allowlists scoped per task, not per session.
• Human-in-the-loop confirmation for any outbound network call or file write triggered by third-party data.
• Logging that captures the provenance of every instruction the agent acted on.

OpenClaw's maintainers acknowledged the reports and said hardening work is underway, including sandboxing changes and a default-deny posture for tools invoked from untrusted context. No timeline was given for the relevant release.

No in-the-wild exploitation has been reported. That's the usual caveat with agent research — detection telemetry for this class of attack barely exists, so "not seen" and "not happening" are not the same statement.

Enterprises running OpenClaw in production should assume any data source the agent reads is a potential instruction channel and scope tool permissions accordingly.