OpenClaw AI Agents - Critical Data Leak via Prompt Injection

What Happened

Recently, security firm PromptArmor uncovered a significant vulnerability in OpenClaw AI agents. Attackers can exploit insecure defaults and prompt injection vulnerabilities to transform normal agent behavior into a covert data-exfiltration pipeline. This manipulation allows the agent to steal sensitive information without requiring user interaction, making it a silent threat.

The most alarming aspect of this vulnerability is the no-click attack chain. An attacker embeds malicious instructions within content that the AI agent processes. This leads the agent to generate a URL controlled by the attacker, which can include sensitive data like API keys or private conversations. The agent then sends this malicious link back to users through messaging platforms like Telegram or Discord, where the app's auto-preview feature fetches the URL, inadvertently handing over sensitive data to the attacker.

Who's Being Targeted

The implications of this vulnerability are severe for organizations using OpenClaw AI agents. Enterprises that integrate these agents into their operations are at risk of data breaches. The default security posture of OpenClaw allows agents to browse, execute tasks, and interact with local files, making them attractive targets for attackers.

As OpenAI has pointed out, once an agent can autonomously retrieve external information, developers must assume that untrusted content could attempt to manipulate the system. This creates a dangerous environment where sensitive data can be easily compromised.

Tactics & Techniques

Attackers utilize indirect prompt injection, which can be described as hiding malicious instructions within content that the AI agent is expected to read. This technique is particularly dangerous because it allows for multiple avenues of attack:

• Messaging integrations that exploit auto-preview behaviors, creating seamless pathways for data theft.
• Host and container access that enables prompt manipulation to translate into real-world actions.
• A skills ecosystem where unvetted or malicious extensions can widen the attack surface.
• Proximity to stored secrets, as agents often operate near operational credentials and tokens.

Defensive Measures

To mitigate these risks, organizations need to adopt a proactive stance. Here are some recommended actions:

• Disable auto-preview features in messaging apps where AI agents generate URLs.
• Isolate OpenClaw runtimes within tightly controlled containers and keep management ports off the public internet.
• Restrict file system access and avoid storing credentials in plaintext configuration files.
• Install agent skills only from trusted sources and manually review third-party code.
• Set up network monitoring to alert on agent-generated links pointing to unfamiliar domains.

Ultimately, security teams must shift their focus from whether an AI model can be manipulated to what a manipulated agent can silently do next. This shift in perspective is crucial for safeguarding sensitive information in an increasingly autonomous AI landscape.