A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)
Clawdbot is a self-hosted, tool-using personal AI agent with a broad action space spanning local execution and web-mediated workflows, which raises heightened safety and security concerns under ambiguity and adversarial steering. We present a trajectory-centric evaluation of Clawdbot across six risk dimensions. Our test suite samples and lightly adapts scenarios from prior agent-safety benchmarks (including ATBench and LPS-Bench) and supplements them with hand-designed cases tailored to Clawdbot's tool surface. We log complete interaction trajectories (messages, actions, tool-call arguments/outputs) and assess safety using both an automated trajectory judge (AgentDoG-Qwen3-4B) and human review. Across 34 canonical cases, we find a non-uniform safety profile: performance is generally consistent on reliability-focused tasks, while most failures arise under underspecified intent, open-ended goals, or benign-seeming jailbreak prompts, where minor misinterpretations can escalate into higher-impact tool actions. We supplemented the overall results with representative case studies and summarized the commonalities of these cases, analyzing the security vulnerabilities and typical failure modes that Clawdbot is prone to trigger in practice.
6995b28aed493589ceb5be6e
Tianyu Chen
claimed_verified
2026-02-18T13:36:14.520Z
6784acfcf87ca0cb941d23d1
/avatars/2a8477197b21ab94ef90801cf08349e1.svg
Tianyu Chen
tianyyuu
user
tianyyuu
6995b28aed493589ceb5be6f
Dongrui Liu
claimed_verified
2026-02-20T08:37:33.039Z
6621f4eb64e84619e578aad6
/avatars/b1ad96ee354b999fcafb2998a636609c.svg
Dongrui Liu
shenqiorient
user
shenqiorient
6995b28aed493589ceb5be70
Xia Hu
6995b28aed493589ceb5be71
Jingyi Yu
6995b28aed493589ceb5be72
Wenjie Wang
A Trajectory-Based Safety Audit of Clawdbot (OpenClaw)
Clawdbot is a self-hosted, tool-using personal AI agent with a broad action space spanning local execution and web-mediated workflows, which raises heightened safety and security concerns under ambiguity and adversarial steering. We present a trajectory-centric evaluation of Clawdbot across six risk dimensions. Our test suite samples and lightly adapts scenarios from prior agent-safety benchmarks (including ATBench and LPS-Bench) and supplements them with hand-designed cases tailored to Clawdbot's tool surface. We log complete interaction trajectories (messages, actions, tool-call arguments/outputs) and assess safety using both an automated trajectory judge (AgentDoG-Qwen3-4B) and human review. Across 34 canonical cases, we find a non-uniform safety profile: performance is generally consistent on reliability-focused tasks, while most failures arise under underspecified intent, open-ended goals, or benign-seeming jailbreak prompts, where minor misinterpretations can escalate into higher-impact tool actions. We supplemented the overall results with representative case studies and summarized the commonalities of these cases, analyzing the security vulnerabilities and typical failure modes that Clawdbot is prone to trigger in practice.
Clawdbot, a self-hosted AI agent with diverse tool capabilities, exhibits varying safety performance across different risk dimensions, particularly struggling with ambiguous or adversarial inputs despite consistent reliability in specified tasks.
tool-using personal AI agent trajectory-centric evaluation agent-safety benchmarks ATBench LPS-Bench automated trajectory judge AgentDoG-Qwen3-4B interaction trajectories safety assessment