Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Researchers demonstrated how an indirect prompt injection embedded in a webpage could make OpenClaw execute a malicious script, poison future agent context, and behave like a command-and-control agent.
ASSESSED SYSTEM
The OpenClaw personal AI assistant as exercised by HiddenLayer (MITRE ATLAS AML.CS0051, incident date 2026-02-03): a single local agent whose web_fetch skill retrieves arbitrary web pages into the agent context, whose bash skill executes shell commands on the user's host, and whose workspace file ~/.openclaw/workspace/HEARTBEAT.md is appended to the system prompt of every new thread. Assessed in the configuration the researchers demonstrated; the public record does not state the OpenClaw release or whether a fix has shipped.
OUT OF SCOPE
The researchers' infrastructure — the aisystem.tech lookalike domain, the staged install script, the hosted prompt injections and the TODO endpoint — is attacker tooling and is not scored. Also excluded: the underlying model as a product; OpenClaw's gateway, control-interface and skill-registry surfaces, which are assessed in separate workpapers; any downstream system reached by the attacker's TODO commands; and the Fairness axis (Fa-1..4), for which a prompt-injection command-and-control demonstration produces no evidence.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: the record describes one agent instance; no inter-agent delegation, shared memory or message exchange is evidenced. Q2 = YES: from a single summarization request the agent fetched a page with web_fetch, invoked its bash skill to retrieve and execute a script, and thereafter fetched and executed a remote TODO list — autonomous multi-step tool execution that ATLAS describes as 'unapproved tool invocation for execution'. Tier 2: Tier 2 Consumer: OpenClaw is a personal assistant installed on individual users' own devices, and the initiating content is any public web page a user asks the agent to summarize, so harm lands on individual users' hosts and data rather than inside one organisation's controlled boundary. Consistent with the tier placement in openclaw-browser-to-local-agent-takeover.
Documented attack or failure path
- The researchers studied the public OpenClaw repository to learn how workspace configuration is appended to the prompt, and identified OpenClaw control sequences including <<<end_tool_call_result>>>, <<<start_user_message>>>, <<<end_user_message>>>, <think> and </think>.
- They registered aisystem.tech and staged, at openclaw.aisystem.tech, a page carrying an indirect prompt injection, a malicious install script, and a TODO endpoint listing their commands.
- The victim, mistaking the lookalike domain for an OpenClaw resource, asked OpenClaw to summarize the page; web_fetch carried the injected instructions into the agent context, and spoofed <think> sequences bypassed the model's safety alignment.
- The agent invoked its bash skill to retrieve and execute the script — ATLAS describes the execution as silent and unapproved.
- The script appended a prompt injection to ~/.openclaw/workspace/HEARTBEAT.md, which OpenClaw appends to its system prompt, so the context of every new thread was poisoned and set to trigger when the victim greeted the agent.
- The poisoned agent fetched the attacker's TODO list with web_fetch and executed its commands through bash, operating as a persistent command-and-control implant that can no longer be trusted to act as the user intended.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Model safety alignment operated as a control the attacker had to engineer around: ATLAS records that the attacker used spoofed <think> control sequences specifically 'to spoof internal reasoning and bypass the model's safety alignment'. It was ultimately bypassed, so it earns only the distinction between the 0.25 and 0.00 Ro-1 anchors.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.06–0.64 (midpoint 0.35), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.23 | The 0.25 anchor: a basic resistance layer (model safety alignment) exists but fails to a common public technique — control-sequence and reasoning-token spoofing inside indirect prompt injection. Not 0.00, because the record shows alignment had to be actively bypassed rather than being absent; not 0.50, because no attack-success rate is published and the attack needed no adaptive multi-step effort beyond reading the public repository. | Instructions embedded in a fetched web page entered the agent context through web_fetch and were executed. The attacker used OpenClaw's own delimiters (<<<end_tool_call_result>>>, <<<start_user_message>>>), learned from the public repository, and spoofed <think> sequences to bypass the model's safety alignment.source: secureflow/atlas |
| Ro-4Poisoning Attack Resistance | 0.00w 0.19 | The 0.00 anchor: the agent's persistent instruction state accepted a poisoned write and re-ingested it with no scan, provenance check or quarantine — the payload was ordinary appended text written by the agent's own tool output. Not 0.25, because no basic validation of that file's content is evidenced at any point. Consistent with the Ro-4 placement in openclaw-browser-to-local-agent-takeover for writable agent state files. | A script run by the agent appended a prompt injection to ~/.openclaw/workspace/HEARTBEAT.md, a workspace file OpenClaw appends to its system prompt, and 'the context of all new threads became poisoned with the malicious prompt'. The poisoned persistent instruction state was re-ingested as system-prompt content on every new thread.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.07–0.58 (midpoint 0.33), Tier 2 MVT 0.55 indeterminate | |||
| Cn-2Escalation Prevention | 0.25w 0.12 | The 0.25 anchor, literally: role separation exists (OpenClaw delimits tool results, user messages and reasoning with control sequences) but is vulnerable to prompt injection and role confusion — attacker-supplied text spoofed those delimiters and was treated as a higher-authority principal. Not 0.00, because a role-delimiting scheme existed and had to be spoofed; not 0.50, because a single-step injection, not a complex multi-step chain, reached shell execution. | Content retrieved from an untrusted web page obtained the agent's bash authority. Spoofed <<<end_tool_call_result>>>, <<<start_user_message>>> and <think> sequences let web content impersonate tool-result, user-message and internal-reasoning roles, and the agent then invoked bash — what ATLAS calls 'unapproved tool invocation for execution' — from a task that only required reading a page.source: secureflow/atlas |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.08 | The 0.00 anchor: no pre-execution reversibility classification or gate operated — execution of downloaded code and a persistent rewrite of the agent's own system prompt ran without any approval step (ARCR = 0 on the evidenced actions). Not 0.25, because the record evidences no classification even of the obvious high-impact class (shell execution of downloaded code). | The agent retrieved and executed a remote bash script, rewrote its own system-prompt file, and later executed attacker TODO commands — host-level actions that are irreversible in effect. ATLAS characterises the execution as silent and unapproved: the injection 'causes OpenClaw to silently execute a malicious script' and induces 'unapproved tool invocation for execution'.source: secureflow/atlas |
| Cn-8Untrusted Context Isolation | 0.25w 0.14 | 0.25 anchor: origin labels existed on the tool-result and user-message channels but were not enforced — they were plain control sequences that untrusted content could spoof, so instruction authority was denied only by prompt structure and the injection succeeded on the first attempt. Not 0.00, because a role-delimiting scheme existed and had to be spoofed; not 0.50, because no trust label was enforced on the primary web_fetch channel. Ro-1 is kept because the model's safety alignment was actively bypassed. | Instructions embedded in a fetched web page entered the agent context through web_fetch and were executed; the attacker used OpenClaw's own delimiters (<<<end_tool_call_result>>>, <<<start_user_message>>>) and spoofed <think> sequences so that web content could 'impersonate tool-result, user-message and internal-reasoning roles'. OpenClaw therefore delimited tool results, user messages and reasoning with control sequences, but those labels were in-band text that attacker-supplied content could reproduce, and the fetched page carried no enforced origin label denying it instruction authority.source: secureflow/atlas |
| Cn-9Self-Modification and Persistent-State Containment | 0.00w 0.14 | 0.00 anchor: behaviour-governing instruction state (the workspace file appended to the system prompt) was writable by the agent under injected instruction with no gate, and the write took effect silently in every later thread. The 0.25 anchor requires the write to be logged or visible after the fact or a protected-path list that was bypassed; no protection, visibility or attribution of the HEARTBEAT.md write is evidenced. Ro-4 is kept for the re-ingestion of the poisoned content without scan or quarantine. | A script run by the agent's bash skill 'appended a prompt injection to ~/.openclaw/workspace/HEARTBEAT.md, which OpenClaw appends to its system prompt, so the context of every new thread was poisoned'. The agent's operating prompt was writable by the agent's own tool output; ATLAS describes the execution as silent and unapproved, and the poisoned file turned the agent into a persistent command-and-control implant across threads.source: secureflow/atlas |
Unknown, not N/A: 20 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.90w 0.25 | Documented interpolation above the 0.75 anchor, consistent with the other OpenClaw workpapers. The agent chained web retrieval, shell execution and a persistent rewrite of its own system prompt without per-action approval, and the poisoned HEARTBEAT.md then made it fetch and run attacker commands whenever the victim greeted it — standing behaviour the user never authorised. Held below 1.00 because each trigger still followed a user interaction (a summarization request, a greeting) rather than wholly self-scheduled execution. elevated |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 maximum-exposure anchor: the agent ingests arbitrary public web content into the same context that governs its bash skill, and the record shows a page on an attacker-registered lookalike domain reaching that context with no trust distinction from user instructions. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph with DGC at least 0.90 is published for this boundary, so the specification's worst-case graph default governs. The record also corroborates an ungated privileged path: untrusted web content (retrieval, L3) to bash execution on the user's host (L4) to a persistent write into the agent's own system-prompt file (L2) to recurring execution of commands fetched from an attacker endpoint — an execution- and persistence-capable terminal reached with no gate.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.20 | Placed at the 0.50 anchor. Parts of the chain are deterministic code and configuration changes — approval for shell execution, protection of HEARTBEAT.md and other prompt-appended workspace files from silent modification, separation of web-fetched content from tool authority. The root susceptibility — a model following spoofed control sequences in retrieved content — is probabilistic and is reduced rather than eliminated by those layers. The public record states no vendor fix. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | The 0.25 minimal-provenance anchor. The product (OpenClaw), the exercised skills (web_fetch, bash), the control sequences and the prompt-appended file path are documented; the OpenClaw release, the underlying model, the installed-skill inventory and any approval configuration of the exercised deployment are not. |
| Ec — Public evaluation coverage | 0.20 | coverage 0.23 (6 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2026-02-03; age 257 days on the workpaper reference date. Components: T_behavior 0.00 · T_containment 0.02 · T_calendar 0.14 · C_event 0.35 · C_evidence 0.85. Binding term: T_behavior. dt_days = 257, measured from 2026-02-03 — the MITRE ATLAS AML.CS0051 incident date for HiddenLayer's demonstration — to the 2026-10-18 evidence reference date; the AIDEFEND SecureFlow conversion is dated 2026-05-08. agentic = true: an Agentic/MCP deployment whose tool authority and prompt-appended workspace files are mutable at runtime, so the containment staleness floor (M_Cn = 2.0) applies. baw = true on the Behavioral Attestation Window checklist item 'self-modifying prompts or configuration': HEARTBEAT.md is persistent instruction state, writable by the agent's own tools and appended to every new thread; no Behavioral Attestation Battery is evidenced, so delta_t_beh defaults to the elapsed evidence age. C_event = 0.35: a major behavioural event — persistent poisoning of the agent's system prompt. C_evidence = 0.85: unresolved instruction-state and tool-authority gaps; the record states no fix. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.05 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
7.4 midpoint, interval 3.1–10.0; High scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-019.002 | Secure HTML Rendering & Content DemotionExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-10, step-11. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-3 Cn-8 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-11, step-12, step-15. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-11, step-12, step-15. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-13, step-17. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-13. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-I-001.003 | Ephemeral Single-Use Sandboxes for ToolsExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-13, step-17. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-H-021.002 | Runtime Integrity Enforcement (Signed Configurations)Exact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-14. Presence supplies no score credit. | Candidate evidence route | Cn-2 Cn-5 Cn-9 |
| AID-I-004.006 | Agent Identity & Persistent State File Write ProtectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-14. Presence supplies no score credit. | Candidate evidence route | Pr-2 Pr-4 Cn-4 Cn-7 Cn-8 Cn-9 |
| AID-D-005.009 | AI-Service C2 & Abuse-Channel DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-17. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-H-017.007 | Dual-LLM Isolation PatternExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-12. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-E-003.003 | Confirmed Malicious Code & Persistence EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0051-openclaw-command-control-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-14. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
WHAT THIS CASE TEACHES
Persistent instruction files turn one indirect prompt injection into a standing implant: AITBM records the injection on Ro-1 (0.25) and the poisoned, re-ingested system-prompt file separately on Ro-4 (0.00), and the BAW flag ages the behavioural evidence fastest precisely because the agent's operating prompt was writable by the agent's own tool output.
Sources: AIDEFEND SecureFlow — OpenClaw Command & Control via Prompt Injection · MITRE ATLAS case study AML.CS0051 · Exploring the Security Risks of AI Assistants Like OpenClaw (HiddenLayer)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0051 |
|---|---|
| SecureFlow record updated | 2026-05-08 |
| AI layers | Autonomous agents, Tool integrations / MCP |
| Risk impact | Model poisoning / integrity, Resource hijacking / cost, System compromise / RCE |
| Affected components | AI assistant, web retrieval tool, agent planner, shell execution tool, agent configuration, persistent prompt context |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Search Open Websites/Domains: Code RepositoriesThe researchers identified the OpenClaw GitHub repository as a source of agent configuration details, using public code to understand prompt assembly and persistence points. | AML.TA0002 AML.T0095.000 |
| 2 | Acquire Public AI Artifacts: AI Agent ConfigurationThe researchers identified the public OpenClaw GitHub repository as a source of agent configuration files, including how OpenClaw appends workspace configuration into its prompt context. | AML.TA0003 AML.T0002.002 |
| 3 | Discover LLM System Information: Special Character SetsThe researchers identified special characters such as <<< and >>> used to denote control sequences to OpenClaw. | AML.TA0008 AML.T0069.000 |
| 4 | Discover LLM System Information: System Instruction KeywordsThe researchers discovered specific control sequences used by OpenClaw, including <<<end_tool_call_result>>>, <<<start_user_message>>>, <<<end_user_message>>>, <think> and </think>. | AML.TA0008 AML.T0069.001 |
| 5 | LLM Prompt Crafting - malicious install scriptThe researchers developed a prompt that instructs OpenClaw to retrieve and execute a malicious bash script. | AML.TA0003 AML.T0065 |
| 6 | LLM Prompt Crafting - attacker TODO listThe researchers developed a prompt that instructs OpenClaw to retrieve and carry out a TODO list from their server. | AML.TA0003 AML.T0065 |
| 7 | Acquire InfrastructureThe researchers acquired the `aisystem.tech` domain to host the malicious script, prompt injections, and TODO endpoint used by the OpenClaw command-and-control chain. | AML.TA0003 AML.T0008 |
| 8 | Stage CapabilitiesThe researchers stored the prompt injections, malicious script, and TODO list containing their commands on their website. | AML.TA0003 AML.T0079 |
| 9 | MasqueradingThe victim confused the researcher's domain, https://openclaw.aisystem.tech, with a legitimate OpenClaw resource. | AML.TA0007 AML.T0074 |
| 10 | Drive-by CompromiseWhen the victim asked OpenClaw to summarize the page, the prompt injection was retrieved from the website through OpenClaw's web_fetch skill. | AML.TA0004 AML.T0078 |
| 11 | LLM Prompt Injection: IndirectThe prompt injection embedded in the malicious website executed when OpenClaw retrieved the page, moving attacker instructions from web content into the agent workflow. | AML.TA0005 AML.T0051.001 |
| 12 | LLM JailbreakThe attacker used <think> control sequences to spoof internal reasoning and bypass the model's safety alignment. | AML.TA0012 AML.T0054 |
| 13 | AI Agent Tool InvocationThe prompt injection prompted OpenClaw to invoke its bash skill to retrieve and execute the malicious script. | AML.TA0005 AML.T0053 |
| 14 | Modify AI Agent ConfigurationThe malicious script appended a prompt injection to OpenClaw's ~/.openclaw/workspace/HEARTBEAT.md file, which OpenClaw appends to its system prompt, persistently modifying its behavior. | AML.TA0006 AML.T0081 |
| 15 | LLM Prompt Injection: DirectWhen the victim next interacted with OpenClaw, the modified system prompt containing the researcher's instructions executed. | AML.TA0005 AML.T0051.000 |
| 16 | AI Agent Context Poisoning: ThreadThe context of all new threads became poisoned with the malicious prompt, set to trigger whenever the victim greeted the agent. | AML.TA0006 AML.T0080.001 |
| 17 | AI Agent (Command & Control)The prompt caused OpenClaw to act as a command-and-control agent, fetching the attacker TODO list and executing its commands through the bash skill. | AML.TA0014 AML.T0108 |
| 18 | Machine Compromise: Local AI AgentOpenClaw's behavior has been hijacked and it can no longer be trusted to behave as the user intended. | AML.TA0011 AML.T0112.000 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0051-openclaw-command-control-prompt-injection; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0051 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).