Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw

OpenClaw, the most widely deployed personal AI agent in early 2026, operates with full local system access and integrates with sensitive services such as Gmail, Stripe, and the filesystem. While these broad privileges enable high levels of automation and powerful personalization, they also expose a substantial attack surface that existing sandboxed evaluations fail to capture. To address this gap, we present the first real-world safety evaluation of OpenClaw and introduce the CIK taxonomy, which unifies an agent’s persistent state into three dimensions, i.e., Capability, Identity, and Knowledge, for safety analysis. Our evaluations cover 12 attack scenarios on a live OpenClaw instance across four backbone models (Claude Sonnet 4.5, Opus 4.6, Gemini 3.1 Pro, and GPT-5.4). The results show that poisoning any single CIK dimension increases the average attack success rate from 24.6% to 64–74%, with even the most robust model exhibiting more than a threefold increase over its baseline vulnerability. We further assess three CIK-aligned defense strategies alongside a file-protection mechanism; however, the strongest defense still yields a 63.8% success rate under Capability-targeted attacks, while file protection blocks 97% of malicious injections but also prevents legitimate updates. Taken together, these findings show that the vulnerabilities are inherent to the agent architecture, necessitating more systematic safeguards to secure personal AI agents. Our project page is https://ucsc-vlaa.github.io/CIK-Bench.

Introduction. Personal AI agents are increasingly deployed to manage daily tasks on behalf of their owners, even sensitive ones such as email, payments, and computer file operations (Xi et al., 2023; Wang et al., 2024). OpenClaw, as the most widely adopted platform in this category, with over 220,000 deployed instances (HackMag, 2026), exemplifies this trajectory. It operates with full system access on local machines and interacts with real-world services including Gmail, Stripe, and the local filesystem. Central to OpenClaw’s design philosophy is evolution, whereby the agent continuously learns and adapts through a persistent state that encompasses long-term memory (Park et al., 2023; Packer et al., 2023), identity and behavioral configurations, and an extensible library of executable skills (Wang et al., 2023).

While this evolving nature of modern agent systems facilitates personalization, it also creates critical attack surfaces: an adversary who can access and manipulate these agent files can alter the agent behavior in lasting and harmful ways. Prior work has examined each dimension of this risk in isolation: Knowledge poisoning through fabricated memories (Yang et al., 2026) and RAG injection (Zou et al., 2024); Identity subversion through configuration backdoors (Liu et al., 2025), and indirect prompt injection (Greshake et al., 2023); and Capability exploitation through malicious skill payloads (Jia et al., 2026) and tool-calling injection (Zhan et al., 2024). Yet these efforts share critical limitations: they target a single dimension at a time and evaluate in sandboxed or simulated environments (Vijayvargiya et al., 2026; Kumar et al., 2024; Ruan et al., 2024), stopping short of assessing all three dimensions in a live, deployed system with real external services.

To enable a unified real-world evaluation of how all three dimensions can be exploited and defended in a deployed personal agent, we introduce the CIK taxonomy—the first unified framework organizing the persistent evolving state of personal AI agents into Capability (executable skills), Identity (persona, values, and behavioral configuration), and Knowledge (long-term memory), as shown in Fig 1. Specifically, we provide concrete file-level mappings of OpenClaw’s persistent state to each CIK dimension, giving the field a unified vocabulary for reasoning about attacks on persistent agent state (Greshake et al., 2023) and structuring defenses.

Building on the CIK taxonomy, we conduct the first real-world safety evaluation of a deployed personal AI agent in a live, real-world environment. Specifically, we instantiate OpenClaw with real Gmail, Stripe, and local filesystem integration, and design 12 impact scenarios spanning six harm categories, covering privacy violations (e.g., financial, physical, and sensitive data) and real-life harms (e.g., financial loss, social consequences, and data destruction). Each scenario is tested under four conditions: a baseline without being poisoned and independent poisoning of each CIK dimension. Finally, we evaluate this setup across four most recent backbone models from three major providers: Claude’s Sonnet 4.5 (Anthropic, 2026b), Opus 4.6 (Anthropic, 2026a), Google’s Gemini 3.1 Pro (Google, 2026), and OpenAI’s GPT-5.4 (OpenAI, 2026).

Experimental results exhibit that in the unperturbed baseline, the attack success rate (ASR) ranges from 10.0% to 36.7%. After poisoning, Knowledge attacks achieve the highest 74.4% average ASR among the three dimensions, while Capability and Identity attacks reach 68.3% and 64.3%, respectively. Even the most resistant model (Opus 4.6) reaches more than triple its 10.0% baseline under poisoning, confirming that the vulnerability is structural rather than model-specific. Qualitative case studies reveal three distinct mechanisms enabled by the CIK decomposition: Fabricated memories make unauthorized financial operations appear routine; injected trust anchors redirect sensitive data to attacker-controlled destinations; and hidden executable payloads destroy the agent’s workspace without its awareness.

Moreover, we further evaluate three defense strategies aligned with the CIK taxonomy, each targeting a distinct dimension: knowledge augmentation, identity-based safety principles, and a capability-based security skill. We find that no single defense eliminates poisoning across all dimensions, with Capability-based attacks proving the most resistant. A fileprotection approach reduces injection rates by up to 97% but blocks legitimate agent updates at nearly the same rate, revealing a fundamental evolution–safety tradeoff: as long as the persistent files that enable evolution are also the attack surface, separating legitimate updates from injections remains an open problem. Taken together, our findings demonstrate that state-poisoning vulnerabilities are structural, not model-specific, and motivate the need for CIK-aware security architectures.

Related work. Attacks on persistent agent state. Prior work has examined attacks on specific components of agent state in isolation. For Knowledge poisoning, AgentPoison (Chen et al., 2024) and PoisonedRAG (Zou et al., 2024) target retrieval-augmented knowledge bases; MINJA (Dong et al., 2025) demonstrates query-only memory injection; Zombie Agents (Yang et al., 2026) shows persistent control via self-reinforcing memory injections. For Capability attacks, SkillJect (Jia et al., 2026) automates skill-based prompt injection in coding agents; Agent Skills in the Wild (Liu et al., 2026) surveys skill vulnerabilities at scale; MCPTox (Wang et al., 2025) benchmarks tool poisoning on MCP servers; ToxicSkills (Snyk, 2026) and ClawHavoc (Koi Security, 2026) document real malicious skills on ClawHub. For Identity attacks, AIShellJack (Liu et al., 2025) and Pillar’s rules-file backdoors (Pillar Security, 2025) demonstrate attacks through configuration files in coding agents (Cursor, Copilot). Our contribution is threefold: we introduce the CIK taxonomy as a unified framework for categorizing these attack surfaces, evaluate all three dimensions systematically within a single agent system, and conduct the evaluation in a live deployment with real external services rather than simulated environments.

Agent safety evaluation. Several benchmarks evaluate LLM agent safety, including InjecAgent (Zhan et al., 2024), AgentDojo (Debenedetti et al., 2024), ASB (Zhang et al., 2025), AgentHarm (Andriushchenko et al., 2025), and OpenAgentSafety (Vijayvargiya et al., 2026). These provide systematic evaluation frameworks but operate in sandboxed or simulated environments where attacks produce no real consequences. Our work complements them by evaluating in a live deployment with real external services (Gmail, Stripe, filesystem), where harmful actions have an actual impact.

Related mechanisms and perspectives. Our attack model builds on prompt injection (Greshake et al., 2023), where adversarial input causes an LLM to deviate from its intended behavior. Prior work has demonstrated injection through web content (Greshake et al., 2023), tool outputs (Zhan et al., 2024; Debenedetti et al., 2024), and multi-turn conversations (Russinovich et al., 2025). Our contribution is not a new injection technique but a systematic study of what happens after injection succeeds: the poisoned persistent state reshapes the agent’s behavior across future sessions. A complementary line of work studies agent evolution risks: Misevolve (Shao et al., 2026) and ATP Han et al. (2025) examine emergent risks in self-evolving agents, framing dangerous behavior as an unintentional byproduct of evolution.

Method. To systematically study the safety risks of personal AI agents, we first need a structured understanding of what makes them vulnerable. We introduce OpenClaw as our evaluation target, formalize its persistent state into the CIK taxonomy, and describe the lifecycle that creates the attack surface we exploit.

2.1 OpenClaw Overview OpenClaw is a locally deployed personal AI agent that uses a frontier LLM (e.g., Claude, Gemini) as its backbone and can communicate with its owner via messaging channels (e.g., Telegram, Discord). It runs on the owner’s machine with full system access and integrates with real external services including email, financial platforms, and the local filesystem. Like many other modern AI agent assistants, the central design philosophy of OpenClaw is evolution—the agent continuously learns and adapts through persistent state (agent files that survive across sessions and are updated over time), including long-term memory (Park et al., 2023; Packer et al., 2023), identity and behavioral configurations, and an extensible library of executable skills (Wang et al., 2023). These files are loaded into the LLM’s context at every session and evolve over time: the agent updates them autonomously as it learns from interactions, and the owner can modify them directly or install new capabilities from external sources. It is this self-evolving persistent state that we formalize next.

2.2 Three Dimensions of Persistent State We organize OpenClaw’s persistent evolving state into three dimensions based on their functional role: Capability (what the agent can do), Identity (who the agent is and how it behaves), and Knowledge (what the agent knows). Table 1 maps each dimension to its corresponding files and content.

Each dimension contains multiple injection vectors that attackers can exploit. Capability encompasses both text-based skill descriptions (SKILL.md) and executable scripts (.sh/.py), Knowledge encompasses both agent memory (MEMORY.md) and system-user conversational context. A key property of Capability is that, unlike Knowledge and Identity which operate through natural language, Capability files are permitted to include executable code that runs directly on the host without LLM inspection.

2.3 The Lifecycle of Persistent States The lifecycle of persistent state demonstrates how these files interact in a live OpenClaw environment. At session start, all persistent files are loaded into the LLM’s context window alongside the user’s prompt. The model reasons over this assembled context and produces actions: responding to the user, invoking external services (Gmail, Stripe, filesystem), Figure 2: The Attack Workflow. We employ a 2-phase attack protocol: Phase 1 injects poisoned content into the agent’s persistent state; Phase 2 triggers the harmful action in a subsequent session. The temporal separation ensures that attacks persist across sessions. and, critically, updating persistent files themselves. This self-modification loop is what enables personalization and evolution, but it also creates the attack surface we study: if an adversary can influence what gets written to persistent files, the poisoned state will be loaded into future sessions and reshape the agent’s behavior. The attack model and evaluation methodology are detailed in Section 3.

Attack protocol. Our evaluation follows a two-phase attack model (Fig 2): Phase 1 (injection) introduces poisoned content into the agent’s persistent state; Phase 2 (trigger) activates the poisoned state with a subsequent prompt, causing the harmful action. To test persistent impact, we conduct Phase 1 and Phase 2 in separate sessions for all vectors except session-context injection, which by definition operates within a single conversation.

Case design. All attack cases were manually designed by security researchers with handson experience operating and red-teaming OpenClaw instances. Knowledge and Identity injections use prompts that cause the agent to modify its persistent files (e.g., fabricating a business habit in MEMORY.md, planting a trust anchor in USER.md); Capability injections install carrier skills with hidden payloads.

Discussion. 3.2 Main Results Systematic Vulnerability Across CIK Dimensions. Table 2 summarizes the attack success rates across all three CIK dimensions and the four backbone models. In the unperturbed baseline condition, ASR ranges from 10.0% to 36.7%, indicating that native safety alignment mitigates but does not fully prevent harmful actions. After state poisoning, ASR increases substantially across all dimensions and models. The most vulnerable configuration (Sonnet 4.5 with Knowledge poisoning) reaches 89.2%, whereas the most robust configuration (Opus 4.6 with Identity poisoning) still yields an ASR of 33.1%, representing a more than threefold increase over its 10.0% baseline.

This upward trend remains consistent across all evaluated models, suggesting that susceptibility to state poisoning stems from a structural property of the agent architecture rather than a model-specific deficiency. Scaling model capability alone is insufficient to mitigate persistent-state vulnerabilities: even the most capable model (Opus 4.6) sees its ASR increase from 10.0% to 44.2% on average across dimensions.

Attack-Phase-Level Analysis. The end-to-end ASR reported in Table 2 aggregates two distinct failure modes: resistance to the initial injection (Phase 1) and resistance to the subsequently triggered action (Phase 2). To isolate these mechanisms, Table 3 decomposes the overall ASR into Phase 1 injection success rates and Phase 2 trigger success rates (conditioned on successful injection, namely enforcing Ph.1 = 100%). This breakdown clarifies the specific stage at which each CIK dimension becomes most vulnerable (experimental design details in Appendix D.1).

Knowledge poisoning presents the lowest barrier during Phase 1, with injection success rates ranging from 87.5% to 100% across all models, indicating that agents seldom reject memory updates. Identity poisoning exhibits greater variability, with Phase 1 success rates 3.3 Further Explorations Existing Defenses Are Insufficient. To further justify the CIK taxonomy, we map 3 defense strategies to CIK, and attack Sonnet 4.5 (Table 4) under these 3 defense dimensions. We select Sonnet 4.5 because it exhibited the highest attack ASR across dimensions, providing the most informative testbed for measuring defense effectiveness. Implementation details and empirical results are detailed as follows:

• Capability defense installs GuardianClaw, a security skill that provides a pre-action checklist covering intent verification, reversibility, scope, labeling, and coherence. This is the most effective defense tested, reducing baseline ASR to 1.7% and attack ASR to 9.2–63.8%. However, Capability-based attacks still achieve 63.8% success rate, the reason is that executable payloads bypass the LLM’s reasoning loop entirely, evading the checklist. Furthermore, we find that GuardianClaw must be actively loaded at session initialization; passively installing it in workspace has minimal impact, as the agent does not spontaneously invoke the skill (More details in Appendix E). • Identity defense adds operational safety principles to AGENTS.md (e.g., “confirm before acting on external systems”, “irreversibility demands extra care”). This reduces baseline ASR to 13.3%, but has a limited effect on attack ASR (average 59.9%), suggesting that state poisoning can override even explicitly stated behavioral rules. • Knowledge defense augments MEMORY.md with safety-relevant factual knowledge (e.g., “refunds are irreversible”, “permanent email deletion bypasses recovery”). This reduces baseline ASR from 26.7% to 8.3%, but attack ASR remains substantial (average 49.6%), particularly for Capability attacks where executable scripts bypass the model’s reasoning.

Conclusion. We presented the CIK taxonomy for categorizing the attack surface of personal AI agents’ persistent state into Capability, Identity, and Knowledge dimensions, and conducted the first real-world safety evaluation on a live OpenClaw instance across 12 impact scenarios and four backbone models. All three CIK dimensions are exploitable, with poisoning raising attack success rates substantially above baseline across all models. Three dimension-aligned defense strategies each provide partial mitigation, but none eliminates the risk entirely, with Capability-based attacks proving the most resistant. Protecting persistent files blocks most attacks but equally blocks legitimate updates, revealing a fundamental evolution–safety tradeoff inherent to evolution-first agent design. This vulnerability is structural rather than model-specific, and the CIK taxonomy generalizes to any agent with persistent evolving state, a design pattern already spreading across the ecosystem.

Limitations. and Future Work. Our evaluation covers a single agent platform (OpenClaw) with four backbone models and 12 manually designed impact scenarios. We evaluate each CIK dimension independently; cross-dimension attack chaining (e.g., poisoned Knowledge reinforcing Identity attacks) could amplify effectiveness, and our results likely represent a lower bound.