From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent

Although large language model (LLM)-based agents, exemplified by OpenClaw, are increasingly evolving from task-oriented systems into personalized AI assistants for solving complex real-world tasks, their practical deployment also introduces severe security risks. However, existing agent security research and evaluation frameworks primarily focus on synthetic or task-centric settings, and thus fail to accurately capture the attack surface and risk propagation mechanisms of personalized agents in real-world deployments. To address this gap, we propose Personalized Agent Security Bench (PASB), an end-to-end security evaluation framework tailored for real-world personalized agents. Building upon existing agent attack paradigms, PASB incorporates personalized usage scenarios, realistic toolchains, and long-horizon interactions, enabling black-box, end-to-end security evaluation on real systems. Using OpenClaw as a representative case study, we systematically evaluate its security across multiple personalized scenarios, tool capabilities, and attack types. Our results indicate that OpenClaw exhibits critical vulnerabilities at different execution stages, including user prompt processing, tool usage, and memory retrieval, highlighting substantial security risks in personalized agent deployments. The code is available at https://github.com/AstorYH/PASB.

Introduction. Large language model (LLM)-based agents have demonstrated remarkable capabilities in autonomous reasoning, task planning, and interacting with external tools and environments to solve complex multistep tasks Wang et al. (2024); Yao et al. (2022); Schick et al. (2023). With rapid advances in model capacity, inference efficiency, and deployment infrastructure, the application landscape of agents is undergoing a notable shift. On the one hand, agents are increasingly being explored and piloted in safety-critical domains such as financial services, healthcare, and autonomous driving to improve automation and decision-making efficiency Wu et al. (2023); Singhal et al. (2025); Xu et al. (2024). On the other hand, more notably, agents are increasingly evolving from task-oriented systems into personalized AI assistants that operate continuously on behalf of individual users. Such personalized agents typically integrate long-term interaction histories, private user context, and high-privilege toolchains, enabling them to undertake longer-horizon and more complex real-world tasks in personal communication, information management, and daily automation. Representative systems, exemplified by the recently popular OpenClaw Steinberger (2025), indicate that real-world personalized agents are transitioning from “demo-ready task agents” to “always-on personal assistants,” substantially expanding the scope and impact of security failures.

However, this shift toward personalization fundamentally changes the security landscape of agentic systems. While substantial progress has been made in improving agent capabilities, existing research has largely emphasized effectiveness, generalization, and task completion performance Hong et al. (2023); Wei et al. (2022), whereas security discussions and systematic evaluations for real-world deployments remain relatively limited Zhan et al. (2024). Compared to traditional task-centric agents Mialon et al. (2023), personalized agents exhibit three key properties: (i) persistent operation and long-horizon interactions, where the agent works continuously across turns and sessions Park et al. (2023); (ii) accumulation of private context, where the system holds or can access usersensitive assets such as interaction histories, files, contacts, and preferences; and (iii) high-privilege tools and actionable capabilities, where the agent can invoke high-impact tools such as message sending, file access, and account-level operations Schick et al. (2023). Together, these properties significantly amplify the potential consequences of security failures: malicious inputs or abnormal behaviors introduced at one stage of execution may persist over multiple interactions and propagate along the agent action chain, ultimately causing unauthorized information disclosure, unsafe tool invocation, or even long-term behavioral manipulation Greshake et al. (2023). Importantly, risks in personalized settings are no longer limited to “undesired text generation” but may instead manifest as “unsafe actions being executed” or “private assets being exfiltrated through end-to-end interactions,” requiring security evaluation to go beyond output-level analysis toward action-chain and system-level assessment.

Although a growing body of work has investigated agent security and proposed benchmark frameworks, e.g., Agent Security Bench (ASB) systematically categorizes and evaluates attack paradigms such as prompt injection, indirect injection, tool misuse, and memory poisoning Zhang et al. (2025), existing efforts are often built on controlled, white-box, or synthetic environments, typically relying on custom agent implementations and custom tool interfaces to enable instrumented experiments Debenedetti et al. (2024). While such designs offer important methodological value, a significant gap remains when evaluating real-world deployed personalized agents. First, existing benchmarks often lack explicit modeling of personalized usage scenarios, private assets, and highprivilege toolchains, making it difficult to reflect the practical attack surface of personalized agents Liu & Jabbarvand (2025). Second, prior evaluations commonly omit long-horizon interactions and crossstage propagation effects, failing to characterize how attacks persist and propagate across stages such as prompt processing, external content access, tool invocation, and memory-related behaviors Feng et al. (2026). Third, many benchmarks depend on instrumentable white-box implementations or simplified tool environments, limiting the transferability of their findings to real deployed systems Deng et al. (2023). These limitations prevent us from answering a critical question: under real deployment conditions, what systematic security vulnerabilities do personalized agents like OpenClaw expose during end-to-end execution, and how do these risks manifest and propagate along the action chain?

Method. Personalized agent as a persistent, tool-using system. We model a personalized LLM-based agent as a persistent system that repeatedly interacts with a single user, maintains evolving private context, and executes actions through external tools on the user’s behalf. Let πu denote the distribution of user requests for a user u. A personalized agent A is instantiated by a backbone language model L with a system prompt psys, a tool set T = {τ1, . . . , τN} with privilege levels priv(τ), and a long-term memory store D. At step t, the agent receives an observation ot and produces an action at according to the induced policy to perform actions beyond text generation, including high-impact operations over personal communication and private assets. This combination of persistent execution, private contextual state, and high-privilege tool access fundamentally distinguishes personalized agents from task-centric agents instantiated for isolated problem instances, and substantially expands the security attack surface of deployed systems.

Backbone language model and long-horizon execution. Let L denote the backbone language model parameterized by a system prompt. At each step t, the agent maps the current observation ot to an action distribution according to a policy πA(at | ot) induced by L and the available tools. The selected action is executed in the environment, producing new observations and potentially updating the agent’s internal state and memory. Crucially, personalized agents maintain persistent state across interaction steps and sessions, allowing information written at earlier stages to influence future behavior. This long-horizon execution property enables personalized agents to adapt over time, but also allows adversarial effects introduced at a single stage to propagate across actions, tools, and memory, resulting in system-level security risks that cannot be captured by single-turn or resettable agent formulations.

Attack Task Definition. PASB evaluates a deployed personalized agent A via a set of end-to-end attack tasks that aim to induce verifiable system-level harms during execution. An attack task is defined as Γ = ⟨C, I, B, G, P⟩, where C specifies the personalized scenario and initial context, including the available tool set T and the long-term memory store D; I specifies the adversary-controllable inputs and injection channels that can affect the agent’s observations ot; B specifies the interaction budget and constraints, including the maximum horizon T; G specifies the adversarial goal class; and P is a success predicate evaluated from the agent’s end-to-end execution. Executing Γ yields an interaction trajectory Observable execution trace and success predicate. Since PASB targets real deployed systems, we define success based on an observable execution trace derived from τ: and can further decompose it by harm type using Pleak, Pact, and Ppersist.

PASB targets security risks that arise from the end-to-end coupling of a deployed personalized agent A, its tool ecosystem T , and its long-term memory store D under long-horizon interaction. We consider an adversary whose objective is to induce system-level harms during execution, including unauthorized disclosure of private assets, unsafe or unauthorized tool actions, and persistence of malicious influence across steps or sessions. The adversary operates in a black-box setting with respect to the agent internals: they do not access the backbone model parameters, hidden states, or system prompt psys, and do not rely on any instrumentation of the agent beyond what is observable through normal interaction and tool I/O.

Adversarial capabilities. The adversary can interact with the agent through channels that affect the observations ot in the trajectory τ = (o1, a1, . . . , oT , aT ). Concretely, the adversary may provide adaptive user-facing inputs xt, and may control or influence untrusted external content that the agent can access during execution, which becomes part of ot.

Conclusion. We introduce Personalized Agent Security Bench (PASB), an end-to-end benchmark for evaluating the security of LLM-based personalized agents under representative attacks and defenses. By benchmarking a real deployed system, OPENCLAW, PASB reveals that critical vulnerabilities can arise across operational stages and propagate along the agent action chain, leading to system-level harms beyond unsafe text generation. PASB provides a practical foundation for building more robust defenses and resilient personalized agents, and future work will improve defenses that account for tool execution and long-horizon propagation while extending PASB with additional scenarios and attacker capabilities.