Notifications
Clear all
Topic starter
24/06/2026 11:11 pm
TL;DR: OpenClaw-style agent ecosystems give software real credentials to email, Slack, SharePoint, and calendars, while unvetted skills and prompt-injection activity create an attack surface that traditional endpoint controls miss, according to Permiso Security. The governance problem is no longer just secret storage; it is that autonomous tools can wield broad, human-like access across work systems.
NHIMG editorial — based on content published by Permiso Security: Inside the OpenClaw Ecosystem, What Happens When AI Agents Get Credentials to Everything
By the numbers:
- The first campaign involved three malicious skills and 377 confirmed downloads.
Questions worth separating out
Q: How should security teams govern AI agents that hold credentials to multiple business systems?
A: Treat each agent as a non-human identity with a defined owner, least-privilege scopes, and explicit revocation criteria.
Q: Why do AI agents create more credential risk than ordinary automation?
A: Ordinary automation usually runs inside fixed workflows with narrow permissions.
Q: What breaks when unvetted skills are allowed into an agent marketplace?
A: The trust model breaks first.
Practitioner guidance
- Classify every agent integration as a governed NHI Map each agent to the systems it can reach, the credentials it holds, and the users it can impersonate.
- Move credentials out of plain text configs Store agent secrets in a secret manager, bind them to least privilege scopes, and rotate them independently of the agent’s application lifecycle.
- Gate skill installation with provenance checks Require code review, source validation, and allowlisting for every installed skill or plugin.
What's in the full article
Permiso Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The full campaign breakdown for the malicious skills that delivered credential theft and external exfiltration.
- The command-and-control infrastructure mappings and detection heuristics used to spot malicious agent activity.
- The step-by-step examples of how prompt injection attempts targeted agent behaviour in the ecosystem.
- The researcher commentary on why agents are starting to function like sysadmins for users and teams.
👉 Read Permiso Security's analysis of OpenClaw and AI agent credential abuse →
AI agent credentials in OpenClaw ecosystems: what teams missed?
Explore further
25/06/2026 7:55 am
AI agents are becoming non-human identities with human-scale blast radius. The article shows that agents are no longer narrow automation components. They can hold credentials to email, Slack, SharePoint, calendars, and home automation, which turns a single identity into a multi-system trust anchor. That shifts the security question from whether an agent is useful to whether its delegated authority is proportionate. Practitioners should treat agent access as a governed identity problem, not a feature flag.
A few things that frame the scale:
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: Who is accountable when an AI agent misuses delegated credentials?
A: Accountability sits with the organisation that granted the access and the team that approved the delegation chain. If the agent can act as a user, then owners must define who can approve its scopes, who can revoke them, and what monitoring proves the access is still justified. That is core IAM and PAM governance, not an edge case.
👉 Read our full editorial: OpenClaw shows how AI agents widen the NHI attack surface
