OpenClaw Command & Control via Prompt Injection
Date: 2026-02-03
Affected: OpenClaw
Attack vector: adversarial-input
Category: research
Severity: High

Researchers at HiddenLayer demonstrated how a webpage can embed an indirect prompt injection that causes OpenClaw to silently execute a malicious script. Once executed, the script plants persistent malicious instructions into future system prompts, allowing the attacker to issue new commands, turning OpenClaw into a command and control agent. What makes this attack unique is that, through a simple indirect prompt injection attack into an agentic lifecycle, untrusted content can be used to spoof the model’s control scheme and induce unapproved tool invocation for execution. Through this single inject, an LLM can become a persistent, automated command & control implant.


Mitigations:

Architectural layers (MAESTRO):