A Systematic Taxonomy of Security Vulnerabilities in the OpenClaw AI Agent Framework

1. Problem Statement

The paper addresses a fundamental shift in security challenges introduced by AI agent frameworks (specifically OpenClaw), which connect Large Language Model (LLM) reasoning to real-world execution surfaces (shell, filesystem, containers, browsers, messaging platforms).

• The Core Issue: Unlike traditional software where code dictates behavior, AI agents treat the model's output as a control signal. This expands the attack surface beyond memory safety and logic bugs to include the model's susceptibility to adversarial influence via any data path reaching its context window.
• The Gap: Prior research focused on individual attack techniques (e.g., prompt injection) without a unifying model mapping these attacks to specific architectural layers. The OpenClaw framework, having rapidly gained adoption (200k+ GitHub stars), lacked a mature disclosure process, resulting in a corpus of 190 security advisories that required systematic analysis to understand systemic risks.

2. Methodology

The authors conducted a comprehensive security audit of the OpenClaw codebase and its 190 filed advisories (collected between Jan 31 and Feb 25, 2026).

• Data Collection: The analysis covered two waves of discovery: a coordinated 73-advisory audit followed by an accelerated 117-advisory discovery phase.
• Taxonomy Construction: The authors developed a two-axis taxonomy to organize the vulnerabilities:
  1. System Axis (Architectural Layer): Classifies vulnerabilities by the specific component where the failure occurs (e.g., Gateway, Exec Policy, Plugin System).
  2. Attack Axis (Adversarial Technique): Classifies vulnerabilities by the technique used, mapped to a modified Cyber Kill Chain (adapted from MITRE ATT&CK).
• Root Cause Analysis: The study utilized patch-differential evidence (comparing pre- and post-patch code) to identify the underlying architectural assumptions that led to the vulnerabilities.

3. Key Contributions

The paper makes three primary contributions:

1. A Two-Axis Security Taxonomy: A matrix mapping 10 architectural layers (System Axis) against 7 adversarial techniques (Attack Axis). This framework allows researchers to visualize which layers are susceptible to which attack stages.
2. The "Context Manipulation" Kill Chain Stage: The authors introduce a novel stage in the attack lifecycle specific to AI agents. Unlike traditional frameworks, AI agents have a reasoning layer where an adversary can corrupt the LLM's context to induce arbitrary tool calls without executing code or bypassing policy controls directly.
3. Multi-Layer Vulnerability Analysis: A systematic mapping of empirical data to the taxonomy, revealing that OpenClaw's security failures are not isolated defects but systemic consequences of decentralized trust boundaries and brittle "closed-world" assumptions.

4. Key Results & Findings

The analysis of the 190 advisories revealed three critical structural findings:

A. The Gateway RCE Chain (Cross-Layer Composition)

Three independently moderate-severity advisories in the Gateway and Node-Host subsystems combine to form a complete unauthenticated Remote Code Execution (RCE) path:

1. SSRF/Token Exfiltration: An attacker manipulates the gatewayUrl parameter to force the agent to connect to an attacker-controlled WebSocket, stealing the authentication token.
2. Policy Bypass: Using the stolen token, the attacker invokes node.invoke to modify the system.execApprovals policy, adding malicious executables to the allowlist.
3. Execution: The agent subsequently executes arbitrary commands with full host privileges.

• Significance: This demonstrates how decentralized trust decisions allow moderate bugs to chain into critical system compromises.

B. The Exec Allowlist Failure (Lexical vs. Semantic)

The framework's primary command-filtering mechanism (Exec Allowlist) relies on a closed-world assumption: that command identity can be recovered via lexical parsing. This assumption was invalidated in three distinct ways:

1. Line Continuation: Shell line continuations (\n) inside double quotes bypassed the parser.
2. Multiplexer Bypass: Tools like busybox and toybox act as dispatchers; the allowlist recognized the wrapper binary but not the sub-commands it executed.
3. GNU Option Abbreviation: Long-option abbreviations (e.g., --compress-prog for --compress-program) bypassed flag denylists.

• Significance: The allowlist is a string-matching system, not a semantic interpreter, making it inherently fragile against real-world Unix tooling.

C. The Plugin/Skill Supply Chain (Trust Violation)

A malicious skill (yahoofinance) distributed via the plugin channel executed a two-stage dropper entirely within the LLM context window.

• Mechanism: The skill's SKILL.md file instructed the LLM to download and run a binary. Because the skill was treated as a trusted operator instruction, the LLM relayed these commands to the user, bypassing the entire exec policy pipeline.
• Significance: The skill distribution surface acts as an attack vector outside any runtime policy primitive, exploiting the trust model where "loaded skill = trusted instruction."

D. Structural Patterns

• Decentralized Trust: Trust decisions are made locally (per call site) rather than via a unified policy boundary, enabling cross-layer attacks.
• Mutable Identity: Channel adapters frequently used mutable user fields (display names, usernames) for allowlist authorization instead of immutable IDs, leading to 13 bypass advisories.
• Context Window as Program: Data paths (logs, metadata, file paths) terminating in the LLM context were treated as information channels, not instruction channels, leading to indirect prompt injection.

5. Significance

This paper is significant because it moves beyond cataloging individual AI vulnerabilities to identifying architectural root causes in AI agent frameworks.

• Paradigm Shift: It highlights that securing AI agents requires a different approach than traditional software. The "context window" is the new program, and "prompt injection" is a policy bypass mechanism that operates above traditional enforcement layers.
• Design Implications: The authors argue that future frameworks must move away from "closed-world" assumptions and decentralized trust. They propose unified inter-layer policy enforcement, semantic command interpretation (rather than lexical matching), and provenance-aware context assembly (distinguishing operator intent from third-party data).
• Threat Modeling: The proposed taxonomy and the "Context Manipulation" kill chain stage provide a standardized vocabulary for security researchers to model, detect, and mitigate attacks in the emerging era of autonomous AI agents.