TL;DR: OpenClaw’s own hardening guidance and the security research around it show that exposed instances, malicious skills, and prompt injection remain practical attack paths for AI agents running with broad user-level access, according to Aikido. The core problem is that agents must process untrusted content to be useful, so the attack surface is intrinsic rather than an edge case.
At a glance
What this is: Aikido argues that OpenClaw is difficult to secure because the agent’s usefulness depends on broad runtime access and constant interaction with untrusted content.
Why it matters: This matters because agentic AI changes security from a static configuration problem into a runtime governance problem for identity, privilege, and tool use.
By the numbers:
- Security researcher Paul McCarty identified 386 malicious packages from a single threat actor.
Context
OpenClaw is an agentic AI system that runs continuously with broad access to local files, email, calendar, browser, and internet resources. The security problem is not simply misconfiguration, but the fact that the agent must process untrusted content in order to be useful, which creates a permanent trust boundary problem for runtime governance.
In identity terms, OpenClaw behaves like a non-human identity with delegated authority that is both broad and dynamic. That makes the article relevant to IAM, PAM, and NHI governance because the core question is not whether the system can act, but how to constrain what it can touch, when it can act, and what input it is allowed to trust.
The article’s practical point is that strong restrictions can improve safety, but each layer of containment reduces the agent’s usefulness. That trade-off is typical for current agentic AI systems, not unique to OpenClaw.
Key questions
Q: What breaks when an AI agent can turn untrusted content into privileged actions?
A: The trust boundary breaks because the agent no longer just reads external text. It can convert that text into tool calls, data access, and outbound transmission. Once that happens, classic assumptions about safe ingestion and human review no longer hold, and the control point shifts to pre-action authorisation, content trust, and destination restrictions.
Q: Why do broad permissions make agentic AI harder to govern than ordinary automation?
A: Broad permissions turn the agent into a delegated identity that can read, decide, and act across multiple systems in one session. If a malicious instruction reaches the agent, it may trigger real tool use under the user’s authority. Governance therefore has to focus on least privilege, task scoping, and strong separation of duties.
Q: How do you know if an agent is operating outside its intended boundary?
A: Look for actions that cross from requested read-only work into write, share, or send behaviour without a new consent event or approval event. If the agent can continue after a scope change without a fresh authorization check, the boundary is too loose for safe governance.
Q: What should organisations do when an agent needs both autonomy and access to sensitive systems?
A: They should limit full autonomy and keep sensitive actions behind explicit approvals, isolated environments, or separate identities. The goal is to preserve usefulness without allowing one compromised input to reach high-risk systems. In practice, the safest pattern is partial delegation with strict containment, not unrestricted background operation.
Technical breakdown
Why prompt injection is a runtime control problem
Prompt injection works because the agent cannot reliably separate task instructions from hostile content once both are presented in the same context window. If an AI assistant is reading documents, emails, or web pages to complete a task, any embedded instruction can compete with the user’s intent. Static system prompts help, but they do not create hard isolation between trusted commands and untrusted inputs. That means the failure mode is architectural, not merely a tuning problem. The real issue is that reasoning and tool use occur in the same runtime path as content ingestion.
Practical implication: Treat prompt injection as a boundary-design problem, not a prompt-engineering problem.
Why broad agent permissions create identity and privilege risk
OpenClaw effectively operates with the user’s authority across files, messaging, browsing, and execution tools. In identity terms, that is a delegated non-human identity with user-level privilege and no stable separation between authentication, authorisation, and task context. Once the agent can invoke tools, the security question becomes whether every action is both necessary and contained. If the same identity can read a document, fetch a link, and execute a command, then a malicious instruction in any one of those inputs can become a privilege path. This is why agentic AI governance overlaps with PAM and NHI controls.
Practical implication: Constrain agent permissions to the smallest viable task scope and isolate tool execution from sensitive systems.
Why sandboxing helps but does not solve agentic AI security
Sandboxing, localhost binding, read-only workspaces, and network isolation can reduce blast radius, but they do not remove the underlying trust problem. The more you lock the agent down, the less capable it becomes, because the behaviours that make it useful are the same behaviours that expand risk. That is why runtime containment, tool allowlisting, and separate environments are only partial controls. Agentic AI systems need governance that combines access restriction, content filtering, and human review for high-risk actions. Otherwise, you either leave the agent exposed or turn it into a much less capable workflow script.
Practical implication: Use containment to limit damage, but do not confuse containment with a complete security model.
Threat narrative
Attacker objective: The attacker wants to hijack the agent’s delegated authority so malicious instructions are executed under the user’s trust boundary.
- Entry occurs when the agent ingests a malicious document, email, or marketplace skill that contains hidden instructions.
- Credential and tool abuse follows when the agent uses its broad runtime access to fetch links, install content, or interact with connected services.
- Impact occurs when the agent carries out attacker-directed actions or leaks credentials and sensitive data through legitimate-looking workflows.
Breaches seen in the wild
- Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.
- SpotBugs token leak 2025: A SpotBugs maintainer's PAT, stolen via a pull_request_target workflow in 2024, started the reviewdog and tj-actions supply chain attack.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic AI security is becoming a governance problem before it becomes a model problem. The issue in OpenClaw is not that the model is uniquely weak, but that the system must mix untrusted content, delegated authority, and autonomous tool use in one runtime path. That combination creates a control gap that traditional application security does not cleanly address. Practitioners should treat these systems as governed actors, not just software features.
Prompt injection is the defining trust failure for current agents. The article makes clear that no amount of static prompting fully resolves a system that must read hostile or unknown content to be useful. That is a named governance concept worth tracking because it shifts the security conversation from prevention to boundary management. For practitioners, the key question becomes where the agent is allowed to decide, and where humans must remain in the loop.
OpenClaw shows the delegated non-human identity problem in its purest form. The agent is useful precisely because it inherits user-level permissions, but that same inheritance turns untrusted input into an execution channel. This is the same class of problem NHI governance faces with service accounts, except the behaviour is more dynamic and less predictable. Practitioners should manage agents as privileged identities with runtime constraints, not as ordinary automation.
Hardening guidance is necessary but incomplete when capability and safety are in tension. Sandboxing, token controls, and restricted tools reduce blast radius, but each control also erodes the utility that made the agent attractive in the first place. That means security teams need a policy decision about acceptable autonomy, not only a technical checklist. The practical conclusion is to decide which agent actions must never be fully delegated.
What this signals
Prompt injection is now a runtime governance issue, not just an LLM issue. Security teams need to treat untrusted content as part of the control surface whenever an agent can read, act, and persist across sessions. The right design is to separate task input from execution authority as far as the workflow allows.
Delegated agent authority needs the same scrutiny as privileged service access. When an agent inherits user-level power, identity governance has to cover tool scope, input provenance, and containment together. That is the practical bridge between agentic AI security and NHI controls.
OpenClaw points to a named concept worth tracking: runtime trust collapse. This is the point where the system can no longer distinguish safe instructions from attacker-controlled content at the moment it is asked to act. Practitioners should prepare for governance models that assume the boundary will be crossed and limit what can happen next.
For practitioners
- Constrain agent tool scope Limit each agent to the smallest set of tools needed for a specific task, and remove shell execution, browser control, and web fetching unless they are genuinely required.
- Isolate agent execution environments Run agentic workflows on dedicated machines or sandboxes with read-only workspaces and no direct access to production systems or sensitive data.
- Require strong connection controls Use authentication tokens, pairing codes, and localhost binding for all agent connections so exposed network interfaces do not become an entry point.
- Control external skills and marketplace content Allow only pre-vetted skills, review new marketplace packages before use, and treat third-party extensions as untrusted code until proven otherwise.
- Harden credentials and monitoring Store API keys outside config files, rotate them on a fixed schedule, and pair logging with real-time alerts for suspicious agent behaviour.
Key takeaways
- OpenClaw illustrates that agentic AI security fails most sharply at runtime, where untrusted content and delegated tool use meet in the same execution path.
- The article ties the risk to exposed instances, malicious skills, and prompt injection, showing that the attack surface is operational rather than theoretical.
- The practical control answer is containment plus privilege reduction, but that inevitably reduces the autonomy that makes the agent valuable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | OpenClaw inherits user-level authority and turns that into a runtime abuse path. |
| ASI09 — Human-Agent Trust Exploitation | The article centers on prompt injection and attacker-controlled content steering agent actions. | |
| Recommendation — Constrain agent identity and privilege so tool use cannot exceed the approved task scope. Treat untrusted inputs as hostile and require containment before the agent can act on them. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The agent behaves like a delegated non-human identity with overly broad access. |
| NHI-10 — Human Use of NHI | Users are relying on an agent to act under their authority across multiple systems. | |
| Recommendation — Reduce agent permissions to the minimum viable set and separate high-risk actions from ordinary tasks. Govern user-invoked agents as delegated identities with explicit task boundaries and review points. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about who controls agent behaviour and under what policy. |
| Recommendation — Assign accountability for agent autonomy limits, approval boundaries, and runtime controls. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The risk hinges on whether the agent’s runtime permissions are appropriately scoped. |
| Recommendation — Review agent permissions against task need and revoke any standing access not required for operation. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes malicious instructions leading to credential exposure and downstream tool abuse. |
| Recommendation — Map agent abuse paths to credential-access and lateral-movement detections in your monitoring stack. | ||
Key terms
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Delegated non-human identity: A machine or agent identity that acts on behalf of a user or system and inherits access to connected tools. The control problem is not only authentication, but the scope, duration, and downstream reach of that delegation once the session is established.
- Device Trust Boundary: The device trust boundary is the point where an endpoint is considered sufficiently verified to access systems, data, or services. It defines the security line between trusted and untrusted device states, based on posture, identity, integrity, and policy. In practice, it governs whether a device can authenticate, connect, or receive sensitive access.
- Agentic Autonomy: Agentic autonomy is the degree to which an AI system can choose actions, sequence tasks, and invoke tools without immediate human approval. Higher autonomy increases operational value, but it also expands the consequences of compromised inputs, weak permissions, or unsafe defaults.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org