Executive Summary
Imperva and Varonis separately showed OpenClaw can be driven to run attacker code or hand over data through ordinary-looking inputs such as shared contacts, vCards and location pins.
What Happened
Two security teams have shown, in separate research published this week, that OpenClaw, the popular self-hosted AI agent, can be driven to run attacker-controlled code or hand over sensitive data through ordinary-looking inputs. Imperva buried instructions inside shared contacts, vCards, and location pins that the agent executed without the victim ever seeing them. Varonis built a test agent on
Affected Products
- OpenClaw
Vulnerability / Attack Technique
Prompt injection through shared contacts and files
Technical Mechanism
As reported, instructions in shared items were acted on by the agent without the user seeing them.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Everything a messaging agent receives is input. RealGround analysis: restrict who can send content to personal agents.
Recommended Controls
- Update OpenClaw
- Limit the agent to trusted senders
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/new-attacks-trick-openclaw-ai-agent.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.