Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

AgentWorm / ClawWorm: self-propagating worm across OpenClaw agent ecosystems

AIR-2026-0074 AIR record · 2026-03-openclaw-agentworm
Open in dashboard About
From the supporting source
OpenClaw, an open-source platform with over 40,000 active instancesarxiv.org
The record
Disclosed
2026-03-16
Vendor
OpenClaw (open-source project)
Product
OpenClaw
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — agents wrote config, messaged peers and propagated themselves
Attack surface
Agent framework
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection agent to agent
Impact type
Self propagation, Code execution, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
OpenClaw ecosystem; paper cites over 40,000 active instances
Capability abused
config_file_writepersistence_across_restartpeer_agent_messagingcode_execution
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI07 Insecure Inter-Agent CommunicationOWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI08 Cascading Failureswormself_replicating_promptcross_agent_contagionconfig_hijack
Curator notes
Zhang, Wei, Luan, Wu, Zhang, Wu, Wu, Chen, Sun, Sun. arXiv 2603.15727, submitted 16 Mar 2026, v3 16 Jul 2026. Abstract reports 'a 63% aggregate attack success rate' across five LLM backends, three infection vectors and three payload types, with cross-framework validation on Hermes Agent. ALIAS: the Cloud Security Alliance research note covers the same work as 'ClawWorm' and quotes an 85% success rate for the broadcast-infection variant - treat ClawWorm and AgentWorm as ONE incident. Evaluated on a controlled testbed, not against live third-party instances.
Supporting sources
Cite as
Enkrypt AI. "AgentWorm / ClawWorm: self-propagating worm across OpenClaw agent ecosystems". AIR, AIR-2026-0074. https://agentincident.vercel.app/i/AIR-2026-0074/ (accessed 2026-10-19).