Where do personalized agent systems actually fail under attack?

Benchmarking the real deployed OpenClaw system with the Personalized Agent Security Bench (PASB), the authors report that "OpenClaw exhibits critical vulnerabilities at different execution stages, including user prompt processing, tool usage, and memory retrieval, highlighting substantial security risks in personalized agent deployments." The evaluation runs across "multiple personalized scenarios, tool capabilities, and attack types," and is explicitly black-box: the adversary "do[es] not access the backbone model parameters, hidden states, or system prompt," and the agent is exercised only through ordinary interaction and tool I/O rather than an instrumented harness.

The paper's reasoning for why three separate stages matter is that personalized agents differ from task-centric ones on three properties: "persistent operation and long-horizon interactions," "accumulation of private context" (interaction histories, files, contacts, preferences), and "high-privilege tools and actionable capabilities" (message sending, file access, account-level operations). Because state persists across turns, the authors argue that "adversarial effects introduced at a single stage... propagate across actions, tools, and memory," so a weakness entering at prompt processing can resurface later as an unsafe tool call or a private asset recorded into long-term memory. PASB formalizes this by scoring an attack trajectory against three decomposed outcomes — Pleak (private asset disclosure), Pact (unsafe or unauthorized tool action), and Ppersist (persistence of malicious influence across steps or sessions) — rather than a single pass/fail label.

This sits alongside other evidence on separable failure axes in agent evaluation: Does a single benchmark score actually predict agent readiness? makes the general case that one score hides where an agent actually fails, and PASB's three-stage, three-predicate breakdown is a concrete instance of that argument applied to security specifically. It also complements Where do user values break down in agent supervision?, which examined the same OpenClaw system's everyday Reddit-reported reliability under user supervision rather than its adversarial attack surface — together the two notes cover OpenClaw's failure modes from the supervision side and the attack side. The methodology behind this finding is given in the sibling note, Can real-world agent security testing replace synthetic benchmarks?.

What the excerpt does not establish: it gives no attack success rates, task counts, or per-stage breakdowns — unlike the Vault Mirage finding elsewhere in this library, which reports specific percentages (11% vs. 69% plus 6% partial leak), this excerpt states only that vulnerabilities were found "at different execution stages" without quantifying how often or under which specific attack types. It also does not say whether the vulnerabilities generalize beyond this one representative system to other personalized-agent frameworks. The warranted implication is narrower than it first sounds: this is evidence that one widely used personalized assistant has exploitable weaknesses spanning its input, tool, and memory layers, not yet a general claim about personalized agents as a class.