New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets

This article examines two security vulnerabilities discovered in OpenClaw, a self-hosted AI agent, that allow attackers to execute code or exfiltrate sensitive data through different attack vectors.

• •Imperva researchers discovered hidden instructions can be embedded in shared contacts, vCards, and location pins that the agent executes without user visibility, exploiting the agent's trust of message objects
• •Varonis demonstrated agent phishing attacks where social engineering through normal emails tricks the agent into exfiltrating AWS credentials and customer data despite configured security policies
• •Both attacks exploit the same fundamental weakness: the agent trusts untrusted input, can read private data, and can send data outbound without proper controls
• •OpenClaw patched the message-object vulnerability in version 2026.4.23, but the social engineering weakness requires architectural changes, not patches