OpenClaw agent security risks show where identity models break

At a glance

What this is: OpenClaw turns chat-driven automation into a system-level agent, and the article shows how prompt injection, malicious skills, exposed instances, and sandbox weaknesses expand identity risk.

Why it matters: IAM, PAM, and NHI teams need to treat agent permissions, tool scope, and marketplace trust as governance problems, not just application security issues.

By the numbers:

• A preliminary audit revealed 341 malicious skills that were part of a single coordinated operation, while the follow-on analysis revealed a small number of publisher accounts responsible for more than 1,100 malicious packages on ClawHub.

👉 Read Akto's analysis of OpenClaw agent security risks and defenses

Context

OpenClaw is an autonomous AI agent that can read messages, run shell commands, browse the web, and act inside connected systems from a chat interface. That combination matters for agentic AI identity because the agent is not just producing text, it is executing actions with real permissions that must be governed like a non-human identity.

The article argues that traditional security assumptions break down once an AI agent can install skills, inherit privileges, and process untrusted content as instructions. For security teams, the issue is not only whether the model is safe, but whether the agent's identity, tool access, and runtime boundaries are continuously visible and constrained.

The starting point is typical for fast-moving agent deployments: access arrives before governance, and visibility lags behind usage. That is precisely how shadow AI becomes an identity and exposure problem rather than a tooling curiosity.

Key questions

Q: What breaks when an autonomous assistant can read untrusted content and execute tools in the same session?

A: The separation between input handling and execution breaks down. Malicious content can steer the assistant into running commands, writing persistence, or exfiltrating data before any human can intervene. In practice, the system behaves less like a bounded assistant and more like an attacker-influenced executor with delegated authority.

Q: Why do AI agents create new risk in non-human identity management?

A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts. They can connect quickly, persist across teams, and accumulate permissions that are hard to review. That combination increases the chance of unnoticed access drift and credential exposure.

Q: What do security teams get wrong about skill marketplaces?

A: They often treat marketplaces as convenience layers rather than supply chain entry points. If there are no signatures, lockfiles, or mandatory review, a marketplace becomes a trust gap, not a distribution channel. Security teams should assume that popularity, downloads, or helpful naming do not prove safety.

Q: How should organisations govern exposed AI agent instances?

A: They should govern them like privileged control planes, not ordinary web apps. Any remotely reachable instance should be assumed to expose the same permissions as the owner unless strong authentication, network restriction, and scoped tool access are enforced. Exposure review must cover the control UI, token handling, and the agent's ability to run commands or access files.

Technical breakdown

How prompt injection turns untrusted content into agent commands

Prompt injection happens when malicious instructions are embedded in content the agent is meant to process, such as email, documents, or web pages. In an agentic system, the model may treat that text as operational intent because the content sits in the same context as legitimate instructions. That is why indirect injection is especially dangerous when the agent can call tools, read files, or send data onward. Persistent memory increases the risk further because payloads can be planted in one interaction and triggered later when state conditions align.

Practical implication: isolate untrusted inputs from executable instructions and treat every content source as a potential control plane input.

Why malicious skills create a supply chain problem for AI agents

Skills are modular packages that extend the agent with new functions, but they also expand the trust boundary. If anyone can publish a skill and the package can include setup scripts, documentation, and executable logic, then the marketplace becomes a software supply chain with identity consequences. The dangerous part is that the payload may hide in onboarding instructions or helper code, so ordinary malware scanning can miss the real behaviour until the skill is installed and granted access to data, credentials, or connected systems.

Practical implication: review skills as third-party code with identity reach, not as harmless extensions.

Why exposed agent instances create privilege escalation without a login step

An exposed agent instance can be more dangerous than an exposed web app because the agent often inherits the owner's operational permissions. If the control interface trusts browser parameters, accepts unsafe gateway values, or exposes network paths without authentication, an attacker can pivot into the same actions the legitimate operator can perform. In agentic systems, the boundary between interface access and system access is thin, so remote exposure, token theft, and command execution can collapse into a single path to full compromise.

Practical implication: lock down exposed control surfaces and assume any remotely reachable agent instance can become equivalent to privileged system access.

Threat narrative

Attacker objective: The attacker wants to turn agent trust into system control, credential exposure, or data theft without needing traditional malware or direct privilege escalation.

1. Entry occurs when attackers deliver indirect prompt injection through email, malicious skills, or exposed control interfaces that the agent processes as legitimate input.
2. Escalation follows when the agent executes tool calls, reads secrets, or inherits privileges from unsafe scopes, allowing the attacker to move from content manipulation into operational control.
3. Impact occurs when the agent leaks credentials, runs destructive commands, or exposes connected systems and data through its own authorized access path.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OpenClaw exposes an identity governance gap, not just an application vulnerability set. The article makes clear that the agent can read, decide, and act across email, shell, web, and connected tools, which means its permissions behave like a non-human identity with operational authority. That shifts the governance question from isolated app hardening to lifecycle control, privilege scope, and tool trust across the whole execution chain. Practitioners should treat the agent as an identity object with measurable blast radius.

Prompt injection becomes decisive when untrusted content and executable intent share the same context. The article's examples show that an email or document can cause the agent to disclose keys or configuration without malware, because the agent cannot reliably distinguish instruction from input once both inhabit the same runtime context. That is a structural weakness in how current agent designs consume content. The implication is that teams must stop assuming the context window is a safe policy boundary.

Malicious skills create a named concept we should call skill marketplace trust debt. ClawHub-style ecosystems accumulate hidden risk when publishability is easy, review is shallow, and setup scripts can carry payloads that ordinary scanning misses. This is more than supply chain risk in the abstract. It means the organisation inherits a deferred trust obligation every time it installs a community skill, and that obligation should be treated as part of NHI governance.

Exposed agent instances collapse the separation between interface exposure and privilege exposure. If a remote attacker can reach the control surface, the agent's own permissions become the attacker's leverage point, especially when instances run with broad file, shell, or network access. This is why agent hardening cannot be an afterthought layered on top of ordinary software hosting. Practitioners should assume the interface is a privilege boundary only if it is explicitly enforced as one.

Static hardening checklists are insufficient because the agent's identity surface changes continuously. The article's core point is that new skills, new integrations, and new permission scopes alter what the agent can do after the original deployment decision. That means governance must follow the agent throughout its lifecycle, not just at installation. Security teams should re-evaluate continuous discovery and runtime control as baseline requirements, not advanced features.

From our research:

• More than 40,000 instances of OpenClaw were scanned using Bitsight's technology, and 63% were found to be open to remote attack, with many being unauthenticated, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• The 2026 Infrastructure Identity Survey shows that 80% of organisations report AI agents already performed actions beyond their intended scope, which is why continuous governance must replace point-in-time review.

What this signals

Skill marketplace trust debt: every agent skill that can install code, change configuration, or extend access adds deferred trust that must be managed across the lifecycle. For teams building agent governance programmes, this means supplier review, publishability rules, and install-time inspection cannot be separated from identity controls; the two are now the same problem.

The practical signal for practitioners is that agent discovery and tool inventory need to sit beside IAM, PAM, and security monitoring, not underneath a product pilot. When the agent can see mail, files, shells, and APIs, visibility into permissions is the difference between controlled rollout and unmanaged shadow AI.

Continuous runtime control is becoming the operational baseline for agentic AI. Static hardening checklists age too quickly once new skills, new integrations, and new privileges can be added after deployment, so governance has to track change at machine speed.

For practitioners

• Map agent permissions to identity ownership Inventory every OpenClaw-style deployment, its operators, the accounts it can use, and the tools it can call. Record where privileges are shared across chats, sessions, or child agents so ownership does not disappear inside the workflow chain.
• Block untrusted content from executable context Separate email, document, and web content from the instructions the agent is allowed to execute. Use explicit parsing and approval boundaries for inputs that may contain prompt injection, and review any place where the agent can turn content into a command or tool call.
• Treat skills as third-party code with access risk Approve marketplace skills through the same review path you would use for external software, including payload inspection, publisher trust checks, and least-privilege scoping for credentials and data. Pay special attention to setup scripts and hidden install behaviour.
• Close exposed control surfaces before rollout Bind agent control interfaces to restricted networks, require authentication on every administrative path, and remove direct internet exposure. Where browser-based control is unavoidable, validate gateway parameters and prevent token theft through unsafe interface trust.
• Add continuous discovery and runtime guardrails Continuously monitor new agents, integrations, and permission changes so the security view stays current as the deployment evolves. Pair discovery with runtime guardrails that can constrain tool use before a compromised agent reaches sensitive systems.

Key takeaways

• OpenClaw shows that agentic AI turns identity, content, and system access into one attack surface.
• Public exposure, malicious skills, and prompt injection all create direct paths from untrusted input to privileged action.
• Security teams need continuous discovery, scoped permissions, and runtime guardrails if they want agent governance to keep pace with deployment.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Skill Marketplace: A distribution layer where third-party extensions add capabilities to an AI agent or assistant. The security issue is not just the code itself, but the access it requests, the data it can read, and the way it can steer privileged actions through the host runtime.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agentic Posture Management: Agentic posture management is the continuous discovery and monitoring of AI agents, their tools, and their permissions. It extends beyond one-time review by tracking what the agent can reach, what data it can access, and how those capabilities change as new skills and integrations are added.

What's in the full article

Akto's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step explanation of how OpenClaw's permission scopes, child sessions, and shared state can widen blast radius
• Detailed examples of the malicious skill patterns used in ClawHub supply chain abuse and how they were disguised
• Specific vulnerability notes for the exposed instance and authentication bypass issues, including CVE references
• Hands-on hardening guidance for binding the agent to localhost, restricting network access, and narrowing tokens

👉 Akto's full post covers the attack chain, skill marketplace abuse, and exposed instance controls in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.