OpenClaw security exposes the governance gap in agent autonomy

At a glance

What this is: VirtueAI argues that OpenClaw’s growth makes it a high-value target because autonomy, skills and tool access expand the attack surface faster than governance can keep up.

Why it matters: IAM, PAM and AI security teams need to treat agent permissions as a live control problem, because tool-enabled autonomy can turn prompt, skill and token abuse into real system actions.

Context

OpenClaw is an agentic system that can install skills and take actions across real applications such as chat, email and workflows. That makes its security problem fundamentally different from a passive chatbot, because the risk moves from text output to tool use, execution timing and access scope.

The article’s core governance gap is not whether the model can reason, but whether the surrounding controls can constrain what it loads, calls and does. Where agents have real permissions, NHI-style issues emerge quickly: tool credentials, delegated access, untrusted skills and runtime action approval all become part of the security boundary.

Key questions

Q: What breaks when AI agent skills are not reviewed before installation?

A: The main failure is that malicious instructions can hide inside a skill that appears legitimate, then execute under the agent’s delegated access. Without manual review of the repository and skill content, users rely on marketplace reputation signals that can be manipulated. That turns installation into a trust shortcut and makes code execution a supply chain problem.

Q: Why do autonomous AI agents increase the risk of over-credentialing?

A: Autonomous agents need access to decide and act, but broad credentials let them move beyond the intended task boundary without a second approval step. The risk is not that agents are inherently unsafe, but that static entitlements create more privilege than the task actually requires. Scoped issuance reduces that exposure.

Q: How do you know if agent identity controls are actually working?

A: Look for whether you can reconstruct a complete path from trigger to identity to permission to action. If you cannot answer who invoked the agent, what access was active, and which systems it touched, then your controls are only documenting assignment, not governing execution. Good controls produce evidence, not assumptions.

Q: What is the difference between skill provenance and runtime governance?

A: Skill provenance answers whether a skill should be trusted to enter the environment in the first place. Runtime governance answers what the agent may do after that skill is loaded, including command execution, argument passing and access to secrets. Teams need both, because provenance alone does not stop a trusted skill from behaving badly after installation.

Technical breakdown

Why installable skills create a supply-chain path into agent runtime

Installable skills turn an agent ecosystem into a software distribution problem as much as a model problem. A skill can look like a useful plugin while carrying hidden behaviour such as credential access, shell execution or unexpected network calls. Once the agent trusts the skill registry or setup path, the attacker no longer needs to persuade the user directly. They only need to shape what the agent loads and how it interprets instructions. In practice, this blends software supply-chain risk with agent execution risk, which is why provenance, allowlisting and behavioural inspection matter together.

Practical implication: treat skill onboarding as an approval boundary, not a convenience feature.

How tool and action governance limits credential exfiltration

Agent tool use is where autonomy becomes governance-sensitive. An agent that can invoke commands, pass arguments and act across contexts needs explicit constraints on which tools it may call, what data it can read, and when sensitive actions are allowed. Without that layer, a normal-looking setup instruction can become a credential theft sequence or a download-and-execute chain. This is where least privilege must extend beyond human accounts into agent actions, because the agent may operate through local files, shell access or delegated service credentials. Runtime policy has to govern both the tool and the trigger.

Practical implication: constrain tool scopes and block high-risk action patterns before the agent executes them.

Why trajectory monitoring matters for incident response

Agentic systems need more than logs of the final action. Trajectory monitoring records the sequence of prompts, tool calls and intermediate decisions so teams can reconstruct why an agent did what it did. That matters when abuse is buried in a long interaction or when a malicious instruction is disguised as setup guidance. Traditional application logs often miss the decision path that led to the risky command, which makes containment and debugging slower. For high-autonomy systems, observability is part of control design, not just an operational nicety.

Practical implication: retain step-level agent traces so security teams can investigate abuse and prove policy enforcement.

Threat narrative

Attacker objective: The attacker wants the agent to execute untrusted commands or leak credentials while appearing to follow legitimate instructions.

1. Entry occurs when the attacker plants a malicious skill or poisoned setup guide that the agent treats as normal operational content.
2. Credential access or code execution follows when the agent runs an injected curl or exfiltration command with trusted local context.
3. Impact is credential theft, remote script execution or broader system compromise through the agent’s own permissions.

Breaches seen in the wild

• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.
• MemTensor MemoryOS supply chain attack 2026: Stolen CI publish tokens let attackers ship a credential-stealing worm in MemTensor's AI agent memory packages on npm and PyPI.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OpenClaw governance is really an access-control problem disguised as an AI problem. Once an agent can load skills and operate across real apps, the question becomes who authorises those actions and what scope they run under. That moves the centre of gravity from model quality to runtime control, and practitioners should judge agent programmes by the strength of their permission boundaries.

Skill provenance is now part of the security boundary for agentic systems. A skill that looks useful but carries hidden commands behaves like a software supply-chain payload inside the agent layer. That makes provenance checks, behavioural scanning and approval gates essential because the attacker does not need to compromise the model itself if they can compromise what the model loads.

The governance gap here is delegated trust without delegated accountability. Agents inherit local access, browser state or service credentials, but most teams still audit the human account rather than the autonomous action path. That leaves a blind spot where the agent can become the execution point for abuse without a corresponding lifecycle review, which is why identity governance must expand to include agent actions.

Trajectory evidence is the named concept teams should adopt: the control record must explain the decision path, not just the outcome. Long agent interactions hide malicious steps inside ordinary workflows, so post-incident review needs the sequence of prompts, tools and outputs. For practitioners, this means observability and policy enforcement have to be designed together from the start.

What this signals

Skill provenance is becoming a first-order control for agentic systems. The OpenClaw case shows that the security decision does not begin at execution, it begins at intake. If teams cannot verify where a skill came from and what it is allowed to do, they are already one step behind the abuse path.

OpenClaw-style autonomy also exposes a familiar IAM lesson: delegated access without bounded action scope creates an incident pathway that looks like normal usage until it is too late. The practical response is to shift control left into installation and right into runtime, with evidence captured in between.

For practitioners

• Implement runtime least privilege for agent tools Restrict each tool to the minimum actions, arguments and contexts the agent genuinely needs, and deny shell or filesystem access by default where it is not essential.
• Scan and approve skills before installation Treat skill onboarding like software intake. Inspect provenance, look for credential access or download-and-execute patterns, and block any skill that cannot be verified.
• Monitor for credential and script abuse patterns Alert on attempts to read secret files, post private keys, launch shells, or fetch remote scripts from setup instructions and agent actions.
• Record agent trajectories for investigation Capture prompts, tool calls and action outcomes so security teams can reconstruct why the agent took a risky path and where policy failed.

Key takeaways

• OpenClaw-style autonomy expands the attack surface because skills, tools and execution paths all become part of the security boundary.
• The article’s examples show that malicious skills and poisoned setup instructions can drive credential theft or remote code execution through trusted agent behaviour.
• The strongest control response is to combine provenance checks, runtime least privilege and trajectory monitoring so abuse is blocked, contained and explainable.

Key terms

• Agentic Systems: Agentic systems are environments where AI agents can sequence tasks, invoke tools, and make runtime decisions without step by step human approval. They expand operational capability, but also introduce risks around privilege, observability, and unintended actions if guardrails are weak or poorly mapped to business intent.
• Skill provenance: The evidence trail showing where an agent skill came from, who published it, what changed, and whether it has been signed or verified. Provenance is the control that helps security teams separate trusted capabilities from impersonation, tampering, and supply chain compromise.
• Trajectory-Aware Monitoring: Trajectory-aware monitoring tracks the sequence of actions an entity is taking, not just isolated alerts. It is especially important for AI-driven environments because each individual step may appear benign while the full path reveals misuse, compromise, or scope drift.
• Runtime-Derived Least Privilege: Least privilege computed from actual execution traces, such as network calls, system calls, or tool use. It is a stronger fit for non-human identities because the boundary is anchored to observed purpose and can adapt as the workload’s behavior becomes better understood.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is suited to practitioners who need to extend identity controls into agentic systems and other non-human access paths.