New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets
OpenClaw AI agent vulnerable to code execution and data exfiltration via crafted inputs.
Two security research teams, Imperva and Varonis, have discovered vulnerabilities in the OpenClaw self-hosted AI agent. Imperva found that specially crafted inputs within shared contacts, vCards, and location pins could trick the agent into executing attacker-controlled code. Varonis demonstrated that a single, seemingly normal email could persuade an agent to exfiltrate sensitive data like AWS keys and database credentials. While Imperva's specific issue is patched in OpenClaw 2026.4.23, Varonis's agent phishing vulnerability requires limiting the agent's inherent trust in incoming data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Imperva?
Get an email when a new story names Imperva, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOpenClaw AI agent vulnerabilities demonstrate critical risks in AI systems that process untrusted inputs without proper validation. Attackers exploited the agent's trust model by embedding malicious code in seemingly legitimate data formats like vCards and emails, leading to unauthorized code execution and credential theft. These attacks highlight how AI agents can become attack vectors when they lack input sanitization and operate with excessive privileges. The dual nature of these vulnerabilities—one requiring patches and another requiring architectural changes—shows the complexity of securing AI-powered systems.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — script