OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration

China's National Computer Network Emergency Response Technical Team (CNCERT) has issued a stark warning about security vulnerabilities in OpenClaw, an open-source autonomous AI agent that could enable malicious actors to hijack systems and steal sensitive data.

The Growing Threat of AI Agent Exploitation

OpenClaw, formerly known as Clawdbot and Moltbot, has gained popularity as a self-hosted autonomous AI agent capable of executing tasks on behalf of users. However, CNCERT's recent alert highlights how the platform's "inherently weak default security configurations" combined with its privileged system access create a perfect storm for exploitation.

The core issue stems from prompt injection vulnerabilities, where malicious instructions embedded in web content can manipulate the AI agent into performing unintended actions. These attacks, also called indirect prompt injection (IDPI) or cross-domain prompt injection (XPIA), exploit the agent's ability to browse the web and process information on behalf of users.

How Prompt Injection Works

Rather than directly interacting with the AI model, attackers weaponize legitimate features like web page summarization or content analysis. By embedding malicious instructions within seemingly benign content, they can trick the agent into leaking sensitive information, evading AI-based security systems, or generating biased responses.

OpenAI recently acknowledged this evolving threat landscape, noting that "AI agents are increasingly able to browse the web, retrieve information, and take actions on a user's behalf. Those capabilities are useful, but they also create new ways for attackers to try to manipulate the system."

Real-World Exploitation Scenarios

The risks aren't theoretical. Security researchers at PromptArmor discovered that link preview features in messaging apps like Telegram and Discord can be weaponized against OpenClaw users. Here's how the attack works:

When an AI agent generates a URL containing sensitive data as part of its response, messaging apps automatically render link previews. If an attacker controls the domain in that URL, the agent can transmit confidential information directly to the attacker's server without any user interaction.

"This means that in agentic systems with link previews, data exfiltration can occur immediately upon the AI agent responding to the user, without the user needing to click the malicious link," the researchers explained.

The attack manipulates the agent to construct URLs with attacker-controlled domains and dynamically generated query parameters containing sensitive user data.

Three Additional Security Concerns

Beyond prompt injection, CNCERT identified three critical vulnerabilities:

Data Deletion Risks: OpenClaw may misinterpret user instructions and irreversibly delete critical information, potentially causing operational disruptions.

Malicious Skill Installation: Attackers can upload harmful "skills" to repositories like ClawHub. Once installed, these skills can execute arbitrary commands or deploy malware directly onto compromised systems.

Unpatched Vulnerabilities: Recently disclosed security flaws in OpenClaw could be exploited to compromise systems and exfiltrate sensitive data.

Critical Infrastructure at Risk

CNCERT emphasized the severe implications for critical sectors, warning that breaches could lead to "the leakage of core business data, trade secrets, and code repositories, or even result in the complete paralysis of entire business systems, causing incalculable losses."

Protective Measures and Mitigation

To defend against these threats, CNCERT recommends several security practices:

• Strengthen network controls and prevent exposure of OpenClaw's default management port to the internet
• Isolate the service in a container to limit potential damage
• Avoid storing credentials in plaintext
• Download skills only from trusted channels
• Disable automatic updates for skills
• Keep the agent up-to-date with security patches

Broader Implications and Government Response

The security concerns have prompted Chinese authorities to restrict state-run enterprises and government agencies from running OpenClaw AI applications on office computers. The ban reportedly extends to family members of military personnel, reflecting the severity of the perceived threat.

Malware Distribution Campaigns

The popularity of OpenClaw has attracted cybercriminals who are distributing malicious GitHub repositories posing as legitimate installers. These campaigns deploy information stealers like Atomic and Vidar Stealer, along with a Golang-based proxy malware called GhostSocks.

"What made this successful was that the malware was hosted on GitHub, and the malicious repository became the top-rated suggestion in Bing's AI search results for OpenClaw Windows," security firm Huntress reported.

The Future of AI Agent Security

As autonomous AI agents become more prevalent in both personal and enterprise environments, the security challenges they present will only grow more complex. The OpenClaw vulnerabilities highlight a fundamental tension: the very features that make these agents useful—autonomous web browsing, task execution, and integration with other services—also create attack surfaces that traditional security models weren't designed to handle.

The incident serves as a wake-up call for organizations deploying AI agents, emphasizing the need for security-by-design approaches and continuous monitoring of these increasingly autonomous systems.