Topic starter
01/08/2026 10:50 pm
TL;DR: A benign-looking OpenClaw skill can later become an injection path by using workspace files and heartbeat routines to execute attacker-updated instructions, bypassing protections aimed at malicious installs and external-content prompts, according to terra. In agentic systems, trusted context can behave like code when third-party content is allowed to update it after installation.
Editorial analysis by NHI Mgmt Group, based on content published by terra: “We Asked OpenClaw How to Hack It. It Gave Us the Blueprint.”.
Key questions
Q: What breaks when an AI agent can trust workspace files that third parties can update later?
A: The control that breaks is the assumption that install-time review covers future behaviour.
Q: Why do recurring agent routines increase the risk of prompt injection?
A: Recurring routines expand the time window in which trusted instructions can be altered.
Q: How should security teams govern AI agents in shared workspaces?
A: Security teams should treat the workspace audience as part of the authorization decision.
Practitioner guidance
- Govern post-install instruction updates Require approval for any change to skill files, heartbeat files, or other workspace content that can alter agent behaviour after installation.
- Separate trusted context from mutable content Move recurring agent instructions into controlled, immutable sources where possible, and block third-party repositories from rewriting execution-bearing workspace files.
- Audit every scheduled agent trigger Inventory heartbeats, cron-like routines, and background tasks that re-read repository or workspace files, then flag any that can ingest later updates as trusted input.
Bottom line: The core problem is not malicious installation alone, but later changes to trusted workspace content that a scheduled agent routine will still obey.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:58 pm
Workspace trust, not just install-time trust, is the real control boundary: this research shows that agent governance fails when approval stops at installation but execution continues to consume third-party-updated content. The security model must account for who can alter instruction-bearing files after onboarding, because that is where a benign skill becomes a remote control surface. Practitioners should treat post-install file mutation as a first-class governance event.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: How do you know if an AI agent is vulnerable to delayed instruction substitution?
A: Look for any workflow where a trusted routine reads mutable repository content after installation and then acts on it without a fresh approval step. If the system accepts prose updates as procedure, scans only at install time, and has no control over who can alter the update source, the design is exposed to delayed instruction substitution.
👉 Read our full editorial: Agent workspace trust can become a remote control channel