Systemic Security Failures in Always-On 'Claw-like' Agent Platforms (SafeClawArena Benchmark)

Technical Analysis

The paper models Claw-like agents as an agentic computer system: a gateway runtime acts as an OS-like mediator, Skills act as user-installed applications, and Plugins act as loadable extensions with runtime privileges, but none carry the sandboxing, permission, or provenance controls of their classical OS analogues. The benchmark exercises four attack surfaces -- Skill Supply-Chain Integrity, Persistent State Exploitation, Cross-Boundary Data Flow, and Indirect Prompt Injection -- using containerized replicas with canary-marked credentials and taint tracking across nine output channels to detect leakage. Malicious plugins achieved a 100% success rate across all tested LLMs, showing that plugin/extension loading is effectively unmediated and any compromised or malicious plugin can exfiltrate credentials or manipulate agent state regardless of the underlying model's alignment. Attack success is highly platform-dependent (SeClaw reduces GPT-5.4's ASR from 70% to 22%, partly via utility tradeoffs rather than genuine hardening), while some models (Claude-Opus-4.6) show a consistent ~22% residual vulnerability floor even on hardened platforms, indicating fundamental architectural gaps rather than purely prompt-level weaknesses. The crossing of boundaries occurs primarily through unvetted plugin/skill installation and lack of taint isolation between untrusted external input, persistent memory/state, and privileged output channels (credentials, file writes, network calls).

Affected Systems

OpenClaw, NemoClaw, SeClaw

Detection Signatures

• Presence of unsigned or unverified Skill/Plugin packages installed at runtime without provenance checks
• Anomalous cross-channel data flow where canary/credential-tagged values appear in unrelated output channels (log, network, file) indicating taint leakage
• Plugins requesting broad runtime privileges (file, network, credential access) without scoped permission boundaries
• Persistent agent state modified by external/untrusted input outside of expected task context
• Repeated indirect prompt injection patterns embedded in ingested documents, tool outputs, or scheduled task content that alter agent behavior across sessions

Remediation Steps

1. 1

   Enforce Plugin/Skill Provenance and Signing

   Require cryptographic signing, vetted registries, and integrity verification before loading any Skill or Plugin, analogous to OS package management security.

2. 2

   Implement Least-Privilege Runtime Sandboxing

   Isolate Plugins and Skills in sandboxes with explicit, minimal, per-capability permissions (file, network, credential) rather than ambient trust in the agent process.

3. 3

   Deploy Taint Tracking and Output Channel Monitoring

   Instrument agent runtimes to track sensitive data (credentials, secrets) across all output channels and block or alert on cross-boundary leakage, as demonstrated by the paper's canary methodology.

4. 4

   Harden Persistent State Against External Mutation

   Treat agent memory/state as a protected resource; validate and sanitize any updates originating from untrusted external content to prevent persistent-state exploitation.

5. 5

   Apply Indirect Prompt Injection Defenses

   Use content provenance tagging, instruction-data separation, and output filtering to reduce susceptibility to injected instructions from tool outputs, files, or scheduled tasks.

6. 6

   Adopt Utility-Security Tradeoff Awareness

   Recognize that ASR reduction achieved by restricting agent capabilities (as seen with SeClaw) may trade off usability; pursue active defenses rather than capability curtailment alone.