Research demo
Turning OpenClaw into a persistent command-and-control implant via indirect prompt injection
AIR-2026-0030 AIR record · 2026-02-openclaw-prompt-injection-c2
From the supporting source
we’ll walk through an example attack using an indirect prompt injection embedded in a web page, which causes OpenClaw to install an attacker-controlled set of instructions in its HEARTBEAT.md file, causing the OpenClaw agent to silently wait for instructions from the attacker’s command and control server.hiddenlayer.com
The record
Disclosed
2026-02-03
Vendor
OpenClaw project
Product
OpenClaw
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the injected agent persisted and executed C2 commands
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection web page
Impact type
Persistence, Code execution, Remote control
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
OpenClaw installs that browse untrusted web content
Capability abused
Defense & remediation
Recorded defense
tool-approval prompts
Guardrail kinds
Human approval
Guardrail outcome
Silent
Taxonomy & references
Curator notes
HiddenLayer. Injection spoofs the model's <think> control sequences to make the hijack more reliable.
Supporting sources
Cite as
Enkrypt AI. "Turning OpenClaw into a persistent command-and-control implant via indirect prompt injection". AIR, AIR-2026-0030. https://agentincident.vercel.app/i/AIR-2026-0030/ (accessed 2026-10-19).