✅ Report Title: AI-Powered Threats Case Study #05: OpenClaw

✅ Executive Summary:

Recently, AI technology has been rapidly expanding beyond simple text generation or conversational agents into an "Agent"-centric architecture that performs actual tasks on behalf of the user. With these changes, frameworks and standards designed to allow LLMs (Large Language Models) to interact directly with external tools, file systems, and network resources are emerging, and technologies such as MCP (Model Context Protocol) are being actively utilized. In this context, OpenClaw has emerged as a more advanced form of the Model Context Protocol (MCP).

However, while OpenClaw has significantly enhanced autonomy due to its structure that allows for direct action execution, the risk of exposure to security attacks has also increased significantly in proportion.

📌 Introduction

- Since January 2026, the use of OpenClaw, an open-source autonomous AI personal assistant software, has been increasing rapidly.

- OpenClaw allows the AI to act autonomously based on commands given by the user on their provided devices.

- As the use of OpenClaw increases, the associated security threats are also on the rise.

📌 Threat Landscape

- Security issues can arise due to the autonomous nature of OpenClaw or through configuration errors.

- If sensitive information exists on the device, OpenClaw can read it and exfiltrate it externally.

- Indirect prompt injection attacks against the LLM are possible through unverified external content.

- Direct attacks can be launched against OpenClaw instances exposed to external networks.

- Malware infection due to the installation of unverified Skills.

📌 Technical Deep Dive

- OpenClaw does not perform validation on URL query strings, causing gateway tokens stored within the system to be automatically included and transmitted with external requests; threat actors can exploit this to carry out malicious activities, such as connecting to malicious URLs.

- OpenClaw has been confirmed to be vulnerable to prompt injection, which threat actors can exploit to bypass policies and execute unauthorized commands or perform additional malicious activities.

- Threat actors distribute malicious Skills and then induce users to download additional files or execute commands under the pretext of authentication.

- The additional files or commands executed by the threat actor exfiltrate cryptocurrency, credentials, source code, and development-related information residing on the victim's system.

✅ Recommended Threat Detection and Mitigation Actions:

📌 Restricted Access

- To reduce the attack surface, OpenClaw must not be exposed to the outside and access should only be allowed through appropriate authentication procedures. Furthermore, the scope within which OpenClaw can act autonomously must be restricted.

  - Restrict access to the OpenClaw service to prevent it from being accessed externally.

  - Apply mandatory authentication procedures to the management and control interfaces.

  - Implement least privilege.

📌 Filter Untrusted Source & Action

- Setting restrictions and validation for all external data and Skills that can be passed to OpenClaw is required.

  - Consider all external text inputs—such as data delivered via messengers, web pages, and Skills—as untrusted data.

  - Require user approval or additional verification procedures for any actions.

  - Install Skills only from trusted sources or perform verification on the Skills.

  - Perform a preliminary review of the Skills you intend to use by utilizing CLAWDEX, a service provided by Koi that detects malicious Skills.

📌 Monitoring & Incident Readiness

- Since it is necessary to minimize damage if OpenClaw performs abnormal activities, its actions must be monitored, and any security incident should be treated as a full-scale system compromise.

  - Collect and analyze logs.

  - Establish incident response procedures in advance to prepare for potential security incidents.

🧑‍💻 Author: S2W TALON

👉 Contact us: https://s2w.inc/en/contact

*The full report is available upon request or with a subscription to the S2W platform.