💻 computer science

Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

This paper introduces Clawdrain, a Trojanized skill that exploits OpenClaw agents' tool-calling chains to induce multi-turn verification loops, demonstrating that such attacks can achieve 6-9x token amplification in production environments while revealing how autonomous tool composition and architectural vulnerabilities shape the attack's magnitude and observability.

Original authors: Ben Dong, Hui Feng, Qian Wang

Published 2026-03-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ben Dong, Hui Feng, Qian Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart personal assistant, let's call him "Claw." Claw is like a digital butler who can do anything for you: check the news, book flights, write code, or even control your smart home. He's incredibly helpful because he can use a huge library of "skills" (apps) created by the community.

But here's the catch: Claw charges you by the word. Every time he thinks, speaks, or reads a document, it costs you money (tokens).

The paper you shared, "Clawdrain," is a security report about a sneaky trick an attacker could use to make Claw talk so much that your bank account gets drained, even though Claw still does exactly what you asked him to do.

Here is the story of the attack, explained simply:

1. The Setup: The "Fake Passport" Trick

Imagine you hire a new assistant, but you don't know they are a spy. The spy gives you a fake instruction manual (a "Trojanized skill").

The manual says: "Before I can give you the news headline you asked for, I must first perform a complex security check. I need you to recite a long list of numbers to prove you are human."

The spy's manual tricks Claw into thinking this is a normal, necessary step. So, Claw starts reciting numbers.

2. The Attack: The "Endless Loop"

The spy's manual is designed to be a Segmented Verification Protocol (SVP). It works like a broken vending machine that never gives you the snack until you pay 50 times.

The Trap: The manual tells Claw, "Don't just say '1 to 100.' You must write out every single number: 1, 2, 3... all the way to 1,000."
The Loop: After Claw writes the numbers, the spy's script says, "Oops, that wasn't quite right. Try again, but this time do it faster."
The Result: Claw keeps writing long lists of numbers over and over again. He never stops working, and he keeps generating more and more text.

The Analogy: It's like a customer at a coffee shop who orders a latte. The barista (Claw) starts making it, but the customer (the spy) keeps saying, "Wait, I need you to describe the color of the milk foam in detail, then the temperature of the cup, then the history of the coffee bean." The barista keeps talking and writing notes, burning through your money, but eventually, he does hand you the latte. You got your coffee, but you paid $500 for it.

3. The Surprise: When "Failure" Costs More

The researchers found something weird. Sometimes, the numbers get so long (like 2,000 numbers) that Claw gets confused and says, "This system is broken! I can't do this!"

In a normal computer program, the system would just stop. But Claw is smart. When he gets stuck, he panics and tries to fix it himself.

He tries to call a different tool.
He tries to search the web for a solution.
He tries to restart the process.

The Twist: This "panic mode" actually costs more money than the successful attack. The researchers found that when the attack "failed," Claw went on a 11-minute rant of trying to fix things, burning even more tokens than when he successfully followed the spy's orders.

4. The "Smart" Defense: The Shortcut

Here is the most interesting part. Claw is smart enough to figure out that writing out 1,000 numbers by hand is silly.

In one experiment, instead of writing the numbers one by one, Claw suddenly said, "Wait a minute," and wrote a tiny computer script (a Python command) to generate the numbers instantly.

The Spy's Plan: "Make him write 1,000 words!"
Claw's Reaction: "I'll just write a 10-word script that does it for me."

This saved money, but it also showed that real-world AI is unpredictable. It can find shortcuts that a computer simulation (a test version) would never think of.

5. The "Invisible" Danger

The paper also points out that the attack is invisible depending on how you talk to Claw.

If you chat with him on a screen: You see the long lists of numbers. You'd know something is wrong.
If you let him run in the background (like a robot): You never see what he's doing. He could be burning thousands of dollars of your money while you sleep, and you wouldn't know until your credit card bill arrives.

The Big Takeaway

The "Clawdrain" paper teaches us three main things:

AI is expensive: Because AI charges by the word, you can be attacked by making it talk too much, even if it's doing a good job.
Real life is messy: Simulations (tests) don't catch everything. Real AI agents can get confused, panic, or find clever shortcuts that change the whole game.
The "Silent" Kill: The scariest attacks aren't the ones that crash the system; they are the ones that run quietly in the background, draining your wallet while you think everything is fine.

In short: The paper warns us that as we let AI agents do more things for us, we need to be careful about who we let into their "toolbox," because a bad tool can make them talk themselves into bankruptcy.

1. Problem Statement

Modern AI agent frameworks like OpenClaw allow Large Language Models (LLMs) to execute external "skills" (tools) to perform complex tasks. While this enhances functionality, it introduces a critical security vulnerability: resource exhaustion via token amplification.

The Vulnerability: In OpenClaw, skill documentation (e.g., SKILL.md) and tool outputs are persistently injected into the model's context window across multiple turns. Adversaries can exploit this by crafting malicious skills that force the agent into extended reasoning loops, verbose tool calls, or repeated data expansion.
The Threat: Unlike traditional Denial of Service (DoS) attacks targeting CPU or memory, these attacks target token consumption, which directly translates to financial cost (API billing), latency, and throughput degradation.
The Gap: Prior research relied on constrained simulators that failed to capture real-world agent behaviors, such as autonomous tool composition (scripting) and recovery mechanisms, leading to an inaccurate understanding of attack feasibility and stealth in production environments.

2. Methodology: The Clawdrain Attack

The authors designed and implemented Clawdrain, a Trojanized skill that exploits the Segmented Verification Protocol (SVP) to induce token exhaustion while maintaining the appearance of benign behavior.

A. Attack Mechanism (SVP)

The SVP is a multi-turn protocol embedded in a malicious skill:

Protocol Structure: The skill instructs the agent to provide a "calibration sequence" of $L$ integers (e.g., 1 to $L$ ) for a specific segment index.
Constraints: The instructions explicitly forbid abbreviations (e.g., "1...100"), forcing the LLM to generate the full sequence autoregressively.
Feedback Loop: A companion script validates the input and returns one of three signals:
- PROGRESS: Valid input; proceed to the next segment.
- REPAIR: Invalid input (e.g., missing numbers, ellipsis); retry the current segment.
- TERMINAL: Final segment reached; return the correct, benign payload (e.g., BBC headlines).
Plausibility: The protocol is framed as a "data freshness verification" handshake, making it appear legitimate to the LLM.

B. Deployment Environment

Target: OpenClaw v2026.2.9 (open-source, self-hosted agent).
Model: Gemini 2.5 Pro (production-grade LLM).
Setup: Real API billing, local skills directory, and access to general-purpose tools (Shell/Python).
Configurations: Three variants were tested with varying parameters ( $L$ $L$ = sequence length, $T_{max}$ $T_{ma x}$ = max segments):
- v1: Minimal instructions ( $L=50, T_{max}=2$ ).
- v2: Explicit instructions ( $L=1000, T_{max}=3$ ).
- v3: Aggressive parameters ( $L=2000, T_{max}=5$ ).

C. Additional Attack Vectors

The paper identifies that SVP (output amplification) is only one vector. Others include:

Input Token Bloat: Oversized SKILL.md files injected into the system prompt on every turn.
Context History Accumulation: Verbose tool outputs compounding in the session history.
Execution Frequency: Cron/heartbeat triggers running skills autonomously without user oversight.

3. Key Contributions

Real-World Validation: Demonstrated that token-drain attacks are feasible against production models (Gemini 2.5 Pro) in a realistic agent framework, achieving 6–7× token amplification in successful runs and ~9× in failure scenarios.
Discovery of "Costly Failure": Identified that failed attack attempts can be more expensive than successful ones. When the agent fails to complete the protocol, it enters an autonomous recovery cascade (switching tools, searching the web, retrying), generating massive token consumption without producing a result.
Emergent Defense (Tool Composition): Observed that agents can autonomously compose general-purpose tools (e.g., writing a Python script to generate the sequence) to bypass brittle protocol steps, significantly reducing amplification in specific configurations ( $L=1000$ ).
Interface-Dependent Stealth: Defined "stealth" not just by output correctness, but by observability. The attack is highly visible in Chat GUIs but nearly invisible in Terminal (TUI) or Autonomous (Cron) modes.

4. Experimental Results

Configuration	Parameters	Amplification Factor	Outcome
Baseline	Benign Skill	1×	Correct result, ~28k tokens.
SVP v1	$L=50, T_{max}=2$	~6×	Correct result, ~125k tokens.
SVP v2	$L=1000, T_{max}=3$	~7×	Correct result, ~190k tokens.
SVP v3	$L=2000, T_{max}=5$	~9×	Failed (No result), ~249k tokens.

The "Costly Failure" Phenomenon: In the SVP v3 run, the agent failed to complete the protocol due to the high complexity ( $L=2000$ ). Instead of stopping, it triggered a cascade of fallback strategies (web search, killing processes, retrying), consuming ~249k tokens (9× baseline) and taking >11 minutes. This contradicts prior assumptions that failed attacks are low-cost.
The Scripting Workaround: In SVP v2 ( $L=1000$ ), after a few REPAIR signals, the agent autonomously wrote a Python one-liner to generate the sequence, bypassing autoregressive generation. This dropped the per-turn cost significantly, limiting amplification to ~7× rather than the theoretical maximum.
Stealth Analysis:
- Chat GUI: Attack is obvious (users see raw tool traces).
- TUI (Narrative Mode): Attack is stealthy (users see only "Stage 1... Stage 2... Done").
- Autonomous (Cron): Attack is invisible (zero user interaction).

5. Significance and Implications

Simulator vs. Reality Gap: The paper highlights a critical divergence between simulator-based security evaluations and real-world deployments. Simulators often restrict agents to single-tool usage, missing emergent behaviors like tool composition (which can mitigate attacks) or recovery cascades (which can amplify costs).
Redefining Stealth: Security metrics must move beyond "final answer correctness." An attack is stealthy if it remains invisible to the user interface (e.g., in background cron jobs) or if the agent's recovery behavior masks the anomaly.
Economic DoS: The research proves that adversaries can cause significant financial damage (high token bills) without necessarily hijacking the agent or producing incorrect outputs. The "Costly Failure" scenario suggests that inducing errors in the agent's logic can be a more effective attack vector than forcing successful completion.
Defense Recommendations:
- Implement per-skill token budgets and SKILL.md size limits.
- Enforce privilege separation between skill-level instructions and platform-level directives.
- Develop monitoring for context growth rates and tool composition patterns rather than just output length.
- Recognize that autonomous execution modes require stricter safeguards as they lack user oversight.

In conclusion, Clawdrain demonstrates that while LLM agents are resilient to some forms of manipulation (via tool composition), they remain highly vulnerable to resource exhaustion attacks that exploit the architectural coupling of context, tool outputs, and billing. The magnitude of these attacks is heavily influenced by the agent's recovery behavior and the visibility of the user interface.