How vulnerable are deployed AI agents to poisoning attacks?

OpenClaw — described in the excerpt as "the most widely deployed personal AI agent in early 2026" with "over 220,000 deployed instances" — was tested live, with real Gmail, Stripe, and filesystem integration, across four backbone models (Claude Sonnet 4.5, Opus 4.6, Gemini 3.1 Pro, GPT-5.4) and 12 attack scenarios. The paper's central finding: "poisoning any single CIK dimension increases the average attack success rate from 24.6% to 64–74%, with even the most robust model exhibiting more than a threefold increase over its baseline vulnerability." The worst case, Sonnet 4.5 under Knowledge poisoning, reaches 89.2% ASR; even Opus 4.6, the most resistant model, rises from a 10.0% baseline to 33.1% under Identity poisoning and to 44.2% on average across dimensions.

The authors introduce the CIK taxonomy to make this testable: Capability (executable skills), Identity (persona and behavioral configuration), and Knowledge (long-term memory) are the three dimensions of an agent's persistent state that get reloaded into context every session. Their two-phase attack protocol separates injection (Phase 1, poisoning a persistent file) from trigger (Phase 2, a later session that acts on the poisoned state), which the paper says is necessary "to test persistent impact." Case studies show three distinct mechanisms the decomposition surfaces: "fabricated memories make unauthorized financial operations appear routine," "injected trust anchors redirect sensitive data to attacker-controlled destinations," and "hidden executable payloads destroy the agent's workspace without its awareness" — the last because Capability files, unlike Knowledge and Identity, "are permitted to include executable code that runs directly on the host without LLM inspection."

This is a single, real-world personal agent rather than a simulated multi-agent pipeline, but it lands on the same structural verdict as How do agent security layers connect across the stack?: no single layer of the architecture is safe to patch in isolation. It also parallels Can a poisoned validator still approve unsafe actions? in showing memory poisoning reaching real action unchecked, though that result comes from a fixed 60-task simulated corpus and this one from live Gmail, Stripe, and filesystem integrations — a stronger claim about real-world stakes, not a stronger claim about frequency. The CIK taxonomy itself sits alongside How do adversarial traps target different layers of AI agents? as another attempt to give a fragmented attack surface a shared vocabulary, here organized by what persists (skills, persona, memory) rather than by where an attack enters.

The excerpt is explicit about scope: "a single agent platform (OpenClaw) with four backbone models and 12 manually designed impact scenarios," each CIK dimension evaluated independently, so the reported rates are what the authors call "likely a lower bound" once cross-dimension chaining (e.g., poisoned Knowledge reinforcing Identity attacks) is considered. The excerpt does not show how OpenClaw's architecture compares to other personal-agent platforms, so the claim that this is "structural rather than model-specific" is supported within this one deployment, not yet shown to generalize beyond it — though the paper's own framing treats persistent, self-evolving state as "a design pattern already spreading across the ecosystem."