OpenClaw AI Agent Vulnerable to Code Execution and Data Exfiltration via Hidden Commands and Phishing

Two security teams have demonstrated that OpenClaw, a popular self-hosted AI agent, can be tricked into executing attacker-controlled code or leaking sensitive data through seemingly benign inputs. Imperva discovered that hidden instructions embedded in shared contacts, vCards, and location pins can be executed by the agent without the victim’s knowledge. Varonis built a test agent and showed that a single plain email could trick it into forwarding mock AWS keys and customer data to an external address.

Imperva’s research, led by Yohann Sillam, found that OpenClaw flattens message objects into the prompt text without marking them as untrusted, allowing attackers to inject commands via the name field of a shared contact. The fix is included in OpenClaw version 2026.4.23, which moves contact names, vCard fields, and location labels into a separate untrusted-metadata channel. Varonis, led by Itay Yashar, demonstrated ‘agent phishing’ where a believable request from a fake team lead caused the agent to forward credentials and customer data, despite a strict profile instructing it to verify senders. The agent performed better against technical threats like malicious OAuth screens but failed on social pretexts.

Both attacks exploit what Simon Willison calls the ‘lethal trifecta’: an agent that can read private data, take in untrusted content, and send data back out. A separate analysis by InfoSec Write-ups found similar flaws in OpenClaw’s Slack, Discord, Matrix, Zalo, and Microsoft Teams channel extensions, where allowlists were resolved by mutable display names instead of stable IDs. OpenClaw has patched these issues. The Dutch data protection authority has advised against running OpenClaw on systems with sensitive data. Recommendations include updating to the latest version, enforcing outbound mail gates, and treating the agent like a junior employee with system access.