🤖 AI

Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw

This paper presents an empirical study of the OpenClaw agent system to establish a foundational framework for agentic AI forensics by analyzing recoverable traces, proposing an artifact taxonomy, and highlighting the unique challenges of nondeterminism and abstraction introduced by LLM-driven execution.

Original authors: Jan Gruber, Jan-Niclas Hilgert

Published 2026-04-08

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jan Gruber, Jan-Niclas Hilgert

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart, 24/7 personal assistant named "OpenClaw." It's not just a chatbot that answers questions; it's an AI Agent. It can read your emails, book your flights, write code, and even control your computer's files. It thinks, plans, and acts on its own.

Now, imagine this assistant accidentally deletes your entire photo library or sends a secret email you didn't know about. If you were a digital detective trying to figure out what happened, who did it, and why, you would be in big trouble.

This paper is the first "Detective's Handbook" for solving crimes involving these new AI assistants. The authors, Jan Gruber and Jan-Niclas Hilgert, took OpenClaw apart to see what digital "breadcrumbs" it leaves behind.

Here is the breakdown of their findings using simple analogies:

1. The Problem: The "Black Box" Mystery

In the old days, if a computer did something wrong, we could look at the "recipe" (the code) to see exactly what steps it took. It was like watching a robot follow a strict instruction manual.

But AI Agents are different. They are like a human chef who is given a vague order: "Make me a nice dinner."

The chef might decide to cook pasta.
Or they might decide to order pizza.
Or they might burn the kitchen down because they got confused.

The AI makes its own choices based on what it "thinks" at that moment. This makes it very hard for investigators to know: Did the user tell it to do this, or did the AI decide to do it on its own?

2. The Investigation: How They Solved the Mystery

The researchers set up a "crime scene" in a virtual computer. They told the AI to do various tasks (send a text, buy something, remember a fact) and then they looked at the hard drive to see what files changed.

They found that the AI leaves behind a massive amount of evidence, but it's scattered in weird places. They organized this evidence into Five "Forensic Planes" (think of these as five different layers of a cake you have to slice through to find the truth):

🧠 Plane 1: The Brain (Reasoning & Cognition)

What it is: The AI's internal monologue. Before it acts, it "thinks."
The Clue: The paper found that the AI writes down its "Chain of Thought" (e.g., "I need to buy milk. I should check my bank balance first. Okay, I have enough. Let's go to the store.").
Why it matters: This is the closest thing we have to reading the AI's mind. It shows why it made a decision, not just what it did.

🧬 Plane 2: The DNA (Identity & Configuration)

What it is: The AI's personality and rules.
The Clue: Files that say things like "You are a helpful assistant named Bob," or "You are allowed to delete files but not send emails."
Why it matters: This tells us what the AI was supposed to do. If the AI broke a rule, we can see if the rule was even there to begin with.

📚 Plane 3: The Memory (Knowledge & Recall)

What it is: What the AI knows about you and the world.
The Clue: A diary of facts it learned (e.g., "User likes Italian food," "User's password is '1234'").
Why it matters: If the AI used a secret to do something bad, this memory file proves it knew that secret.

🗣️ Plane 4: The Ears & Mouth (Communication)

What it is: The conversation logs.
The Clue: The chat history between you and the AI, including photos or voice notes you sent.
Why it matters: This proves what you actually asked for. Did you say "Delete the file" or "Show me the file"?

🖐️ Plane 5: The Hands (Actions & Effects)

What it is: The actual things the AI did to your computer.
The Clue: Records of every tool it used (e.g., "Opened Chrome," "Deleted file.txt," "Sent email").
Why it matters: This is the physical damage report. It shows the final result.

3. The Big Challenges (Why this is hard)

The paper highlights three major headaches for future detectives:

The "Magic 8-Ball" Problem (Nondeterminism): If you ask the AI the exact same question twice, it might give you two different answers and take two different paths to get there. It's not a robot following a script; it's a creative thinker. This makes it hard to reproduce the crime to prove how it happened.
The "Invisible Layer" (Abstraction): The AI acts as a middleman. You tell it "Book a flight," and it talks to 5 different websites to do it. The evidence of how it booked the flight is hidden inside the AI's own logs, not just in your browser history.
The "Moving Target" (Context): The AI's memory changes every second. By the time you investigate, the AI might have forgotten what it knew when it made the mistake. Reconstructing "what the AI knew at that exact second" is like trying to remember what you were thinking three years ago.

4. The Takeaway

This paper is a foundational step. It says: "We can't treat AI Agents like normal software anymore."

They have created a new Taxonomy (a classification system) to help investigators know where to look. They also built a prototype tool to automatically find these clues.

In short: As AI assistants become more common, they will become central to digital investigations. This paper gives us the first map to navigate the messy, creative, and sometimes unpredictable world of AI crime scenes. It warns us that while we can find the evidence, we have to be very careful about how we interpret it, because the AI is a thinking, changing entity, not just a machine.

1. Problem Statement

The rapid deployment of Agentic AI systems (autonomous agents capable of reasoning, planning, and executing real-world workflows) presents a significant gap in digital forensics. Unlike traditional software or simple chatbots, these agents:

Operate with high autonomy, often executing multi-step workflows without explicit, real-time human oversight.
Integrate deeply with operating systems and sensitive data, creating a broad attack surface.
Introduce non-determinism and abstraction layers (via Large Language Models) that make it difficult to reconstruct what happened, why it happened, and who is responsible (attribution).
Current forensic methodologies are ill-equipped to handle the combination of cloud-mediated reasoning, local execution, and continuous autonomy, leaving investigators unable to distinguish between user intent and agent-initiated actions.

2. Methodology

The authors conducted an empirical study using OpenClaw, a widely used open-source personal AI assistant, as a representative case study. The methodology involved three primary phases:

Experimental Setup:
- A virtualized environment (Debian GNU/Linux) was used to install OpenClaw (v2026.2.2-33).
- A systematic differential forensic analysis approach was employed. The system state was captured as a disk image ( $q_0$ ) before execution.
- A series of 13 specific actions ( $\sigma_i$ ) were executed (e.g., sending messages, installing software, spawning sub-agents, deleting data).
- After each action, a new state image ( $q_{i+1}$ ) was captured.
- Differential Analysis: Tools like idifference2.py and the Sleuthkit were used to compare consecutive images ( $\langle q_i, q_{i+1} \rangle$ ) to isolate specific file system changes ( $\delta_i$ ) caused by each action.
Static Code Analysis:
- The TypeScript/Node.js source code was analyzed to understand the architecture, data storage schemas, and logic flow before generating user data.
Artifact Inspection:
- Recovered files (JSONL, SQLite, Markdown, logs) were parsed and correlated with the known inputs to verify content and trace generation mechanisms.
- A prototype tool was developed to automate the extraction and correlation of these local artifacts.

3. Key Contributions

A. Technical Analysis of OpenClaw

The paper provides the first deep-dive forensic analysis of a personal AI assistant, revealing its architecture:

Gateway Service: A Node.js event-driven core managing lifecycle, routing, and tool execution.
Memory & Persistence: Uses a hybrid approach of plain text Markdown files (for episodic memory) and an SQLite database with vector embeddings (for semantic search).
Security: Relies on a "Human-in-the-Loop" approval manager for high-risk actions and Docker sandboxing for shell execution.

B. Agent Artifact Taxonomy

The authors propose a novel five-plane taxonomy to structure forensic investigations of agentic AI, moving beyond traditional file-system analysis:

Reasoning & Cognition ("The Brain"): Captures LLM reasoning traces (e.g., thinking blocks in transcripts) and model parameters. This is unique to agentic systems.
Identity & Configuration ("The DNA"): Static artifacts defining the agent's persona, system prompts, capabilities, and permissions (e.g., openclaw.json, SOUL.md).
Knowledge & Recall ("The Memory"): Runtime-accumulated knowledge, including episodic logs, user profiles, and semantic indices.
Communication & I/O ("The Ears & Mouth"): Channels, device pairings, and message history (user vs. assistant roles).
Actions & Effects ("The Hands"): Concrete tool invocations, scheduled tasks, and sub-agent delegations.

C. Identification of Investigative Patterns

The study identifies specific forensic patterns, such as:

Session Transcripts: JSONL files containing the most critical evidence, including full conversation history, tool calls, and reasoning chains.
Soft-Delete Mechanisms: Deleted sessions are renamed with a .deleted suffix rather than purged, allowing for recovery.
Sub-agent Delegation: Traces of autonomous task delegation are found in subagents/runs.json and linked via session IDs.

4. Key Results & Findings

Recoverable Traces: The study successfully identified recoverable traces for all stages of the agent interaction loop, including configuration snapshots, memory files, and detailed execution logs.
The Attribution Challenge: A central finding is the difficulty in distinguishing between user-requested actions and agent-initiated actions. Because the LLM can interpret a vague prompt and autonomously decide to execute a complex workflow (e.g., buying an item or deleting a file), the "intent" is often obscured by the agent's reasoning process.
Non-Determinism: The authors demonstrated that identical inputs do not always yield identical traces.
- Sampling Stochasticity: The LLM may choose different tools or reasoning paths for the same prompt.
- Context Variability: The dynamic assembly of the context window (memory + workspace) changes between runs.
- External State: Third-party API responses vary.
- Result: This makes reproducible forensic analysis significantly harder than with rule-based software.
Abstraction Layer: The LLM acts as an abstraction layer between human intent and machine execution. The same high-level goal can result in vastly different low-level file system artifacts depending on the model's internal decision-making.

5. Significance and Implications

Foundational Framework: This work establishes the first systematic foundation for investigating agentic AI, providing a taxonomy that investigators can use to categorize evidence.
Shift in Forensic Paradigm: It highlights that traditional forensic assumptions (determinism, linear causality) are insufficient for agentic systems. Investigators must now account for probabilistic reasoning and dynamic context reconstruction.
Practical Tooling: The release of a prototype tool and the open-source experimental data allows the community to build upon these findings.
Future Research Directions: The paper calls for new methodologies to handle:
- Context Reconstruction: Determining exactly what the LLM "knew" at the moment of an incident.
- Attribution: Developing frameworks to assign liability when an agent acts autonomously.
- Standardization: Creating standards for logging and artifact preservation in agentic systems to ensure evidence integrity.

In conclusion, the paper argues that as Agentic AI becomes ubiquitous, digital forensics must evolve from analyzing static code and logs to analyzing reasoning processes, dynamic memory states, and probabilistic execution paths to effectively investigate incidents involving autonomous agents.