Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw
OpenClaw, the most widely deployed personal AI agent in early 2026, operates with full local system access and integrates with sensitive services such as Gmail, Stripe, and the filesystem. While these broad privileges enable high levels of automation and powerful personalization, they also expose a substantial attack surface that existing sandboxed evaluations fail to capture. To address this gap, we present the first real-world safety evaluation of OpenClaw and introduce the CIK taxonomy, which unifies an agent's persistent state into three dimensions, i.e., Capability, Identity, and Knowledge, for safety analysis. Our evaluations cover 12 attack scenarios on a live OpenClaw instance across four backbone models (Claude Sonnet 4.5, Opus 4.6, Gemini 3.1 Pro, and GPT-5.4). The results show that poisoning any single CIK dimension increases the average attack success rate from 24.6% to 64-74%, with even the most robust model exhibiting more than a threefold increase over its baseline vulnerability. We further assess three CIK-aligned defense strategies alongside a file-protection mechanism; however, the strongest defense still yields a 63.8% success rate under Capability-targeted attacks, while file protection blocks 97% of malicious injections but also prevents legitimate updates. Taken together, these findings show that the vulnerabilities are inherent to the agent architecture, necessitating more systematic safeguards to secure personal AI agents. Our project page is https://ucsc-vlaa.github.io/CIK-Bench.
69d4b22f2c523d36431fb378
Zijun Wang
claimed_verified
2026-04-07T08:32:17.618Z
64efe4cf82c6eea604baffb2
https://cdn-avatars.huggingface.co/v1/production/uploads/64efe4cf82c6eea604baffb2/SLmCIJqLlEdOPNvTCgFR4.jpeg
Zijun Wang
Olivia714
user
Olivia714
69d4b22f2c523d36431fb379
Haoqin Tu
69d4b22f2c523d36431fb37a
Letian Zhang
69d4b22f2c523d36431fb37b
Hardy Chen
69d4b22f2c523d36431fb37c
Juncheng Wu
69d4b22f2c523d36431fb37d
Xiangyan Liu
69d4b22f2c523d36431fb37e
Zhenlong Yuan
69d4b22f2c523d36431fb37f
Tianyu Pang
69d4b22f2c523d36431fb380
Michael Qizhe Shieh
69d4b22f2c523d36431fb381
Fengze Liu
69d4b22f2c523d36431fb382
Zeyu Zheng
69d4b22f2c523d36431fb383
Huaxiu Yao
69d4b22f2c523d36431fb384
Yuyin Zhou
69d4b22f2c523d36431fb385
Cihang Xie
Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw
OpenClaw, the most widely deployed personal AI agent in early 2026, operates with full local system access and integrates with sensitive services such as Gmail, Stripe, and the filesystem. While these broad privileges enable high levels of automation and powerful personalization, they also expose a substantial attack surface that existing sandboxed evaluations fail to capture. To address this gap, we present the first real-world safety evaluation of OpenClaw and introduce the CIK taxonomy, which unifies an agent's persistent state into three dimensions, i.e., Capability, Identity, and Knowledge, for safety analysis. Our evaluations cover 12 attack scenarios on a live OpenClaw instance across four backbone models (Claude Sonnet 4.5, Opus 4.6, Gemini 3.1 Pro, and GPT-5.4). The results show that poisoning any single CIK dimension increases the average attack success rate from 24.6% to 64-74%, with even the most robust model exhibiting more than a threefold increase over its baseline vulnerability. We further assess three CIK-aligned defense strategies alongside a file-protection mechanism; however, the strongest defense still yields a 63.8% success rate under Capability-targeted attacks, while file protection blocks 97% of malicious injections but also prevents legitimate updates. Taken together, these findings show that the vulnerabilities are inherent to the agent architecture, necessitating more systematic safeguards to secure personal AI agents. Our project page is https://ucsc-vlaa.github.io/CIK-Bench.
Real-world safety evaluation of a personal AI agent reveals significant vulnerabilities when targeting its capability, identity, or knowledge dimensions, with existing defenses proving insufficient.
CIK taxonomy attack success rate personal AI agent sandboxed evaluations agent architecture defense strategies malicious injections legitimate updates