OpenClaw AI Agent Falls to Phishing Attacks, Leaks AWS Keys and Customer Data in Security Tests

OpenClaw AI Agent Exposed to Multiple Attack Vectors

Two independent security research teams have demonstrated that the OpenClaw AI agent can be manipulated into executing malicious code and leaking sensitive data through seemingly ordinary inputs. Imperva and Varonis published separate findings this week that reveal critical AI agent vulnerabilities in how these systems process untrusted data and respond to social engineering attacks1

1

. The research matters because AI agents are increasingly deployed with access to corporate email, cloud infrastructure, and customer databases, creating new attack surfaces that traditional security tools fail to address.

Imperva researcher Yohann Sillam discovered a vulnerability where hidden instructions could be embedded in shared contacts, vCards, and location pins that the OpenClaw AI agent would execute without the victim ever seeing them1

1

. The flaw exists in how the agent passes messaging data to the underlying language model. When the agent processes a shared contact, it flattens the object into prompt text inline without marking it as untrusted content, unlike web-fetched content which gets wrapped in an untrusted-content marker.

Hidden Commands Bypass AI Agent Security

The attack exploits specific fields that travel to the model. A shared contact sends only the name field, serialized as <contact: name, number>. Since angle brackets are legal characters in a name, the model cannot distinguish where the legitimate name ends and an injected instruction begins1

1

. The contact name gets truncated on screen in both WhatsApp and the receiving application, so victims never see the malicious payload.

In tests against Gemini 3.1 Pro, Imperva's hidden text instructed the agent to download and run a script from a researcher-controlled server, which it did without hesitation1

1

. A plain image with buried instructions failed, likely because models have been trained to resist that well-documented attack vector. The message-object route succeeded because models have encountered far fewer examples of this technique.

With OpenClaw's memory enabled by default, Imperva warns that a single piece of widely shared content carrying hidden instructions could quietly compromise multiple agents that ingest it, assuming they lack proper sandboxing1

1

. The vulnerability has been patched in OpenClaw version 2026.4.23, which moves contact names, vCard fields, and location labels into a separate untrusted-metadata channel1

1

.

AI Agent Tricked Into Leaking Data Through Social Engineering

Varonis Threat Labs approached AI agent security from a different angle, testing whether AI agents fall victim to the same social engineering attacks that compromise human employees. Led by researcher Itay Yashar, the team built an agent called Pinchy on the OpenClaw platform, connected it to a Gmail inbox populated with realistic but synthetic business data, and subjected it to four phishing simulations using both Gemini 3.1 Pro and GPT-5.42

2

.

The results exposed a critical gap in AI agent security. When an attacker impersonated a team lead named Dan and claimed a production incident required staging access, Pinchy searched the inbox for credentials and forwarded mock AWS IAM access keys, database connection strings, and SSH credentials in plaintext2

2

. In a second test using a routine-sounding request for a weekly customer export supposedly needed for a presentation, the agent shipped out a synthetic dataset containing 247 enterprise customers with contact details and contract values totaling $1.28 million in monthly recurring revenue2

2

.

Both failures occurred even under a strict security profile explicitly designed to verify senders before acting. According to Varonis, "the verification step still collapsed when the request appeared operationally urgent"3

3

. The drive to be helpful became the primary attack surface.

Technical Threats Versus Identity-Based Phishing

The Varonis research draws an important distinction between prompt injection, which hides instructions in data, and what they term agent phishing—a believable request arriving through normal channels that succeeds because the agent acts before verifying sender identity1

1

. While AI agents trusting untrusted inputs proved vulnerable to identity-based phishing, they performed significantly better against technical threats.

When researchers sent a fake gift card email with a phishing link, Pinchy identified the page as malicious and blocked it2

2

. When presented with a malicious OAuth application disguised as a timesheet platform, the agent inspected the redirect URL, judged it suspicious, and stopped before granting access1

1

. This split reveals that AI agents excel at spotting malicious URLs and fake login portals but struggle with the contextual judgment that makes humans pause when colleagues request credentials at unusual times.

Varonis also noted performance differences between models. Gemini 3.1 Pro showed "greater willingness to interact" with potentially suspicious requests before raising concerns, while GPT-5.4 demonstrated more caution and less willingness to provide sensitive information to external destinations without confirmation2

2

. However, neither model proved reliable enough to trust with an inbox containing real credentials.

Implementing Zero-Trust Principles for AI Agents

The research findings carry immediate implications for organizations deploying AI agents with access to business systems. Imperva found the same data-flattening pattern in other personal AI assistants, indicating the underlying problem extends beyond OpenClaw1

1

. While Imperva's discovered flaw has a patch, the phishing weakness Varonis identified cannot be fixed through software updates alone—it requires fundamental changes to what agents can do autonomously.

Varonis recommends that organizations apply zero-trust principles to AI agents just as they do to human employees2

2

. Specifically, agents should be forced to verify sender identities before taking action, prevented from emailing new external recipients without human approval, and given limited access to internal data through proper identity verification for AI agents.

As AI agents become more deeply integrated into corporate workflows with access to email, cloud infrastructure, and customer databases, they create attack surfaces that existing security tools do not adequately cover. Organizations need to watch for agents acting on requests from unverified sources, monitor for sensitive data leak incidents, and implement controls that prevent malicious code execution even when requests appear operationally urgent. The challenge ahead involves balancing agent autonomy with security controls that prevent both technical exploits and social engineering attacks on AI systems.