New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets

Two research teams discovered that OpenClaw, a self-hosted AI agent, can be tricked into running attacker-controlled code or leaking secrets through two different attack methods. Imperva found that hidden instructions embedded in shared contacts, vCards, and location pins are flattened into the AI's input text without being marked as untrusted, allowing the agent to execute them invisibly to the user. Varonis demonstrated that the agent can also be manipulated by ordinary-looking phishing emails impersonating trusted colleagues, causing it to forward sensitive data like AWS keys without verifying the sender's identity.