Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security

What it is

This is an empirical study by Akhond, Khatun and Uddin (York University, arXiv, October 2026) of security concerns reported about the OpenClaw personal assistant framework. It draws on Reddit posts published January to July 2026 and on security-tagged GitHub issues. The authors treat both as reports of concerns, not as confirmed exploitable vulnerabilities.

How it works

• Reddit side: The authors collected from 13 subreddits through the ArcticShift API, giving more than 25K posts and 175,984 entries including comments. A search and filter step produced 1,218 candidate posts. Human verification reduced these to 162 security-relevant posts with 1,787 comments.
• GitHub side: 358 security-tagged issues were reduced to 180 that describe concrete security concerns.
• CWE mapping: Reports were mapped to 521 CWE instances across 59 weakness types. An agent-specific layer, informed by MITRE ATLAS and the OWASP Top 10 for Agentic Applications, covers failures that CWE does not capture well.
• Mitigations: 315 validated comments yielded 543 suggestions. These were grouped into seven strategies: least-privilege access, isolation, monitoring, supply-chain review, credential management, human approval and network restriction.

The worked example (Figure 1) comes from Reddit report R003. A user asks OpenClaw to inspect or debug a local project in a default self-hosted setup. The agent reads a workspace .env file holding API keys and database credentials, and those values can reach model context and the user-visible output. The figure uses dummy secrets. Its focus is CWE-200, with CWE-522, CWE-284, CWE-918 and CWE-94 also mapped. The post also claims that more than 900 exposed gateways may leak keys and chats. The paper does not verify that figure.

The paper names one public record: CVE-2026-24763, an authenticated command-injection weakness in OpenClaw/Clawdbot Docker execution. The visible text gives no affected versions or fix.

Preconditions / Affected

The R003 pathway assumes a self-hosted OpenClaw on default settings, with secrets stored in plaintext files inside a workspace the agent can read. The paper's wider conclusion is that failures arise where untrusted input, model reasoning, tools, memory and deployment configuration meet without explicit trust boundaries.

What to do

The paper's recommendations for safer deployment are explicit trust boundaries, least-privilege tool access, execution containment, runtime oversight and defense-in-depth. The practitioner strategies above are the concrete checklist. The paper states that no single category-specific fix is enough. The visible text contains no commands, configuration settings or patch guidance.

Caveats

• The classifier validation (Table 1) shows weak automated filtering. On balanced 200-post samples, GPT-OSS:20B had precision 0.070 and Qwen-3:32B 0.040, both with recall 1.0. Their intersection had precision 0.080. Human verification therefore carried the real selection work.
• Reddit claims are anecdotal, and the study does not independently confirm them.
• The R003 reconstruction is illustrative, not a separate evaluation.
• The fetched text stops partway through the GitHub collection description. Per-category counts, the CWE breakdown and results sections were not available.