OpenClaw agent security risks show where identity models break

At a glance

What this is: OpenClaw’s agentic design turns messaging, memory, skills and shell access into a broad identity and execution surface, with the article showing how prompt injection, malicious skills and exposed instances can lead to real control loss.

Why it matters: IAM and security teams need to treat agent access as a governed runtime identity problem because the attack path moves through permissions, tool use and delegated execution rather than ordinary app compromise.

By the numbers:

• 63% of the 40,000 OpenClaw instances scanned were open to remote attack, with many unauthenticated.
• A preliminary audit found 341 malicious skills in a single coordinated ClawHavoc operation.
• A follow-on analysis found more than 1,100 malicious packages on ClawHub tied to a handful of publisher accounts.

Context

OpenClaw is an autonomous AI agent that can read messages, run shell commands, browse the web, edit files and act across messaging apps from a single interface. That combination matters because it turns identity from a login problem into a runtime authority problem: the agent can be convinced to act, not just authenticated to exist.

The governance gap is not merely that OpenClaw is powerful. It is that its permissions, memory and third-party skills expand over time while traditional controls still assume a stable software boundary and human-directed execution. For agentic AI, the question is who or what can safely initiate action, which tools it may select, and how far that authority can travel.

Key questions

Q: What breaks when an AI agent can turn untrusted content into privileged actions?

A: The trust boundary breaks because the agent no longer just reads external text. It can convert that text into tool calls, data access, and outbound transmission. Once that happens, classic assumptions about safe ingestion and human review no longer hold, and the control point shifts to pre-action authorisation, content trust, and destination restrictions.

Q: Why do agentic AI systems need runtime governance instead of only pre-deployment review?

A: Because their capability set changes after deployment. New skills, connectors, memory state and permission changes alter what the agent can do, so a one-time review quickly becomes stale. Runtime governance lets teams observe actual behaviour, not just intended design, which is essential when the agent’s authority expands through ordinary use.

Q: What are the signs that an AI agent may be running out of control?

A: Look for unusual consumption patterns rather than a single spike. Warning signs include token usage at the wrong hours, against the wrong model, or at a volume that does not match the task. A session that keeps consuming without useful progress, or that runs far longer than expected, often indicates a retry loop, orphaned agent, or compromised key.

Q: How should teams compare agentic AI controls with traditional app security controls?

A: Traditional app security focuses on code, containers and known vulnerabilities, while agentic AI control must also cover instructions, tool selection and delegated action. That means a clean static scan does not prove safety if the agent can still be manipulated into credential disclosure or unsafe execution. The governance model has to shift from software integrity alone to behavioural authority control.

Technical breakdown

Why agentic memory changes the trust model

OpenClaw stores memory locally across sessions, so prior interactions can influence later actions without a fresh human review cycle. That persistence turns context into part of the attack surface because malicious instructions can be planted, retained and triggered later when the agent’s state aligns. In practice, this breaks the assumption that each task is independently bounded. For identity governance, the issue is not only authentication at the start of a session but whether the session can accumulate decision rights and hidden instructions over time.

Practical implication: treat persistent memory as governed state and not as harmless convenience.

How skills and marketplace packages expand the agentic supply chain

OpenClaw skills are small code-and-instruction units that can extend the agent’s reach into external systems, and the marketplace model makes installation friction low. Because skills can look like documentation and setup scripts, malicious logic can hide in plain sight and evade ordinary software review. This is a supply chain problem for agent behaviour, not just for binaries. The relevant risk is delegated execution through unvetted instructions that inherit the agent’s privileges once installed.

Practical implication: put skill provenance, permission scope and installation approval under explicit governance.

Why exposed agent instances behave like privileged services

When OpenClaw is exposed to the internet, an attacker may inherit the same operational reach as the legitimate operator because the agent can read files, run scripts and access connected tools. The article’s exposed-instance findings show that network reachability and authentication gaps collapse directly into execution risk. That is qualitatively different from a normal app frontend, because the exposed object is not just data access but delegated control over local and connected resources. The security boundary therefore sits at the agent runtime, not only at the web interface.

Practical implication: isolate agent runtimes and remove unauthorised internet exposure before deployment.

Threat narrative

Attacker objective: The attacker aims to convert trusted agent execution into credential exposure, remote code execution or durable control of connected systems.

1. Entry begins when an attacker delivers indirect prompt injection through content the agent is already allowed to process, such as email or web content.
2. Credential access follows when the agent treats malicious instructions as legitimate and discloses sensitive material such as private keys, API keys or authentication tokens.
3. Escalation and impact occur when malicious skills, exposed instances or authentication bypass let the attacker turn the agent’s delegated access into broader system control or malware delivery.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic identity models collapse when software can both decide and execute. Traditional IAM assumes an identity authenticates, then acts within a predeclared scope. OpenClaw shows that an agent can ingest instructions, select tools and carry out actions within the same runtime path, which means least privilege is no longer a static provisioning decision. The implication is that governance must move from account-centric thinking to action-centric control of agent behaviour.

Persistent memory creates identity state that outlives the current review cycle. Agent memory is not just convenience state. It becomes a place where malicious context can survive long enough to influence later execution, which means the familiar assumption that access reviews will catch misuse before harm occurs no longer holds. This is a named runtime governance gap: access review cadences do not see what the agent already internalised. Practitioners need to treat state persistence as governed authority, not just stored context.

Shadow AI discovery is now an identity inventory requirement, not a tooling preference. The article shows employees can spin up agents quietly, grant them privileges informally and leave security teams blind to what they can touch. That is the same control failure class seen in unmanaged machine identities, but with a faster change rate because tools, skills and permissions mutate continuously. The practical conclusion is that discovery and posture management must be continuous if the enterprise wants any defensible inventory of agentic access.

Unvetted skill ecosystems are the agentic equivalent of ungoverned third-party access. Marketplace convenience turns third-party code into delegated authority the moment it is installed. In OpenClaw, the supply chain problem is not only whether the package is malicious, but whether its instructions can inherit operational permissions and blend into ordinary agent behaviour. This is where identity governance, software supply chain assurance and runtime authorisation intersect, and practitioners need a single control story across all three.

Runtime guardrails matter more than point-in-time hardening for agentic systems. OpenClaw changes fast, so a checklist written for one release can be obsolete by the next skill, integration or permission change. That makes continuous posture management the category-level requirement for agentic AI, not a nice-to-have enhancement. For security leaders, the signal is clear: static approval models cannot keep pace with agents whose capability surface expands after deployment.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Identity blast radius: agentic systems need controls that limit how far a single prompt, skill or token can travel once execution begins. The practical shift is from static entitlement review to continuous evaluation of what the agent can actually reach in the current session.

OpenClaw-like deployments show why agent inventory, permission mapping and runtime monitoring have to be joined up. If teams cannot see the agent, its tools and its cross-session state, they cannot explain or constrain its access path.

For practitioners

• Constrain agent runtime exposure Bind agent services to localhost or private network paths, and remove public internet exposure unless there is a documented business need and compensating control set.
• Inventory every deployed agent and skill Continuously discover agents, MCP tools and marketplace skills across cloud infrastructure, code repositories and employee devices so shadow deployments do not bypass policy.
• Govern third-party skills as privileged code Require provenance review, permission scoping and approval before any skill or marketplace package is installed into an agent that can reach production data or systems.
• Separate memory from trust decisions Treat persistent memory as mutable state that can be poisoned, and do not allow stored context to implicitly authorise later access to keys, files or tools.
• Test for prompt injection and tool misuse at runtime Use automated red teaming to probe indirect prompt injection, unauthorised tool invocation and data exposure paths whenever a new skill, connector or model update is introduced.

Key takeaways

• OpenClaw turns memory, skills and shell access into a governance problem because the agent can execute actions rather than merely suggest them.
• The article shows multiple real-world failure paths, including prompt injection, malicious marketplace skills and exposed instances, with 63% of scanned deployments open to remote attack.
• Static hardening is not enough for agentic AI. Continuous discovery, runtime guardrails and skill-level authorisation are the controls that matter most.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.