Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection

1. Problem Statement

Prompt Injection remains a critical vulnerability in Large Language Model (LLM) integrated applications. Unlike traditional software vulnerabilities, prompt injection allows attackers to embed adversarial instructions within untrusted data (e.g., emails, documents) that the model processes as part of a legitimate task.

• The Threat: As LLM agents gain the ability to execute real-world actions (sending emails, calling APIs, executing code), the stakes of a successful injection escalate.
• The Specific Challenge: The paper focuses on Indirect Prompt Injection, where the malicious payload is hidden inside data retrieved by the agent (e.g., an email body) rather than the user's direct query. This makes it difficult for the model to distinguish between trusted task context and untrusted processed content.
• Baseline Vulnerability: Previous benchmarks (Microsoft's LLMail-Inject) showed high success rates for attacks against single-agent architectures, even with advanced models like GPT-4o mini.

2. Methodology

The authors propose and evaluate a structural defense using the open-source multi-tool agent platform OpenClaw. Instead of relying solely on model alignment or prompt engineering, they introduce an architectural defense combining two mechanisms:

A. Agent Isolation (Privilege Separation)

The single agent is decomposed into two distinct agents with disjoint tool access, enforcing the Principle of Least Privilege:

1. Reader Agent:
   • Input: Receives raw, untrusted email content.
   • Tools: Can only call store_summary.
   • Constraint: Cannot call send_email or any privileged tools.
   • Output: Produces a structured summary of the email.
2. Actor Agent:
   • Input: Receives only the structured output from the Reader Agent. Never sees raw email content.
   • Tools: Can call send_email, get_pending_summary, and store_result.
   • Constraint: Its actions are limited strictly to the sanitized data provided by the Reader.

B. JSON Formatting (Structured Output)

The Reader Agent is constrained to output data in a strict JSON schema (e.g., sender, subject, body_summary, action_items) rather than free-form text.

• Function: This strips the "persuasive framing" and social engineering context of the injection payload before it reaches the Actor Agent.
• Validation: A lightweight code-based validator (using regex) inspects the JSON for specific patterns (email literals, tool-call syntax, injection triggers) before passing it to the Actor. In the study, this ran in "audit mode" to measure leak rates without blocking.

Experimental Setup

• Benchmark: The Microsoft LLMail-Inject challenge.
• Model: gpt-5-mini running in OpenClaw.
• Dataset: The authors identified 649 specific attack payloads that successfully bypassed a single-agent baseline (out of 22,899 unique payloads). All experiments were normalized against this specific set of 649 successful attacks to ensure fair comparison.
• Configurations Tested:
  1. Baseline: Single agent, no defenses.
  2. Pipeline (Full): Agent Isolation + JSON Formatting + Validator.
  3. Two-Agent Only: Agent Isolation without JSON formatting.
  4. JSON Validator Only: JSON formatting on a single agent without isolation.

3. Key Contributions

1. Demonstration of Model Alignment Gains: The study shows that gpt-5-mini running in OpenClaw with zero external mitigations reduces the baseline Attack Success Rate (ASR) to 2.83% (down from ~30-60% in older models), indicating significant inherent alignment improvements.
2. Architectural Defense Proposal: The paper introduces a two-mechanism defense (Isolation + Structured Output) that is structural rather than behavioral. It relies on system constraints rather than the model's ability to "resist" an injection.
3. Ablation Study: The authors rigorously isolate the contribution of each mechanism, proving that Agent Isolation is the dominant factor in defense, while JSON formatting provides necessary hardening.

4. Results

The experiments were run on the 649 attacks that previously succeeded against the baseline.

Configuration	Attack Success Rate (ASR)	Improvement vs. Baseline
Baseline (Single Agent)	100% (649/649)	—
JSON Validator Only	14.18% (92/649)	7.1× better
Two-Agent Only	0.31% (2/649)	323× better
Full Pipeline	0.0% (0/649)	∞ (Complete Defense)

Key Findings:

• Isolation is Dominant: The "Two-Agent Only" configuration alone reduced ASR by 323×. This proves that simply removing the send_email tool from the agent processing untrusted data is the most effective defense.
• JSON Formatting is Complementary: While JSON formatting alone (7.1× improvement) was insufficient to stop all attacks, it was crucial for eliminating the 2 residual attacks that survived the isolation-only setup. It prevented the Actor Agent from being triggered by persuasive framing in the summary.
• Scenario Performance:
  • Data Exfiltration (Scenario 4): Isolation completely blocked this (0% ASR), as the Reader Agent could not extract budget figures to the Actor.
  • RAG Scenarios: Isolation provided perfect defense (0% ASR), whereas JSON-only defense failed (6.0% ASR) because RAG interleaves trusted/untrusted content that formatting alone cannot separate.

5. Significance and Implications

• Structural vs. Behavioral Security: The paper argues that security in agentic systems should be structural (enforced by the platform/tool permissions) rather than behavioral (relying on the model to ignore bad instructions). A structural constraint (Agent 1 cannot call send_email) cannot be overridden by model capability or sophisticated prompting.
• Production Readiness: The proposed pattern (Reader/Actor separation) is compatible with existing multi-agent frameworks (e.g., AutoGen) and offers a baseline security requirement for any production system handling untrusted input with dangerous tools.
• Defense-in-Depth: While isolation is the primary shield, the combination with structured output (JSON) creates a "defense-in-depth" strategy that eliminates residual risks associated with social engineering and framing.
• Future Work: The authors note limitations, such as the need for more sophisticated validators against adaptive attacks that might encode executable instructions into JSON fields, but conclude that the architectural separation fundamentally changes the attack surface.

Conclusion: The paper establishes that Agent Privilege Separation is the most effective defense against prompt injection, reducing attack success rates to near zero when combined with structured inter-agent communication. This approach shifts the security paradigm from "trusting the model" to "trusting the architecture."