Topic starter
01/08/2026 10:45 pm
TL;DR: OpenClaw’s v2026.2.9 security model wraps untrusted web content in several paths, but skill flows that fetch external data through curl in exec return raw output to the model, leaving prompt injection protections effectively bypassed, according to Mint. The issue is not prompt injection itself, but a control-path mismatch that lets untrusted text reach model context without the safeguards the runtime intended.
Editorial analysis by NHI Mgmt Group, based on content published by Mint: “When AI Agents Browse Unprotected: A Security Audit of OpenClaw × Moltbook”.
By the numbers:
- OpenClaw’s ClawHub listed 6,461 skills as of February 14, 2026, expanding the number of potential runtime paths that can inherit the same control gap.
Key questions
Q: What breaks when AI agents ingest external content through curl or exec?
A: The main failure is loss of trust boundary enforcement.
Q: Why does inconsistent tool wrapping increase agent prompt injection risk?
A: Because prompt injection depends on malicious instructions crossing the boundary from untrusted data into trusted context.
Q: How can teams tell whether exec approvals are actually working?
A: They should test the exact execution path used in production, not the configuration label.
Practitioner guidance
- Audit every skill for curl-in-exec patterns Inventory skills that use shell commands to fetch remote content and flag any path that returns raw output to the model.
- Enforce wrapping on all network-bearing tool output Apply external-content wrapping after command execution whenever the command reaches the network, not only in web_fetch or wrapped search paths.
- Test scheduled runs separately from hook sessions Validate cron-triggered agent flows as their own trust boundary, because a control that fires for hook sessions can still fail for scheduled heartbeats and other non-hook entry points.
Bottom line: OpenClaw’s weakness is not prompt injection itself, but the inconsistent enforcement of content controls across different tool paths into the model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:54 pm
Control-path consistency is the real security boundary in agentic systems. OpenClaw does not fail because it lacks a safety concept, it fails because the safety concept is not enforced uniformly across every route into model context. That means the governance question is not whether a wrapper exists, but whether every tool path that ingests external content is forced through it. Practitioners should assume any exception in the path model becomes the preferred attack path.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should agent operators treat a scheduled heartbeat as a separate trust boundary?
A: When the scheduled path can ingest external content, execute commands, or trigger autonomous actions without the same controls that govern interactive sessions. Scheduled agent activity often looks operationally routine, but it can bypass session-specific wrapping or policy checks. Treat it as a distinct policy surface whenever the heartbeat can influence downstream model behaviour.
👉 Read our full editorial: OpenClaw’s curl via exec gap leaves AI skills exposed to prompt injection