The #1 AI Agent on GitHub Was Never Read by Its Creator

Jason Martin, Director of Adversarial Research at HiddenLayer, explores the security landscape of OpenClaw, a viral, open-source AI personal assistant that has gained immense popularity for its autonomous capabilities. The project’s unique “vibe-coded” origin—meaning its code was largely AI-generated and not fully reviewed by its creator—has led to a fascinating, albeit risky, real-world experiment in AI development and security.

What is OpenClaw?

OpenClaw is designed to be a highly autonomous personal assistant, often described as “what Siri should have been.” It integrates with messaging services like iMessage and Discord, acting as an independent entity on the user’s behalf.

• Architecture: Primarily written in TypeScript, OpenClaw is model-agnostic, defaulting to Claude but configurable with any model accessible via an API, such as through Open Router.
• Deep System Access: Upon installation, it inherits the user’s permissions, granting it access to the entire file system and command line. If the user has root or superuser privileges, the agent does as well.
• Memory and Skills: Its memory is stored in a local Markdown file, which can be edited by the user or the agent. Its functionality is extended through “skills”—Markdown files that describe behaviors and are often paired with tools to interact with APIs (e.g., a Slack skill paired with Slack API tools). This creates a growing ecosystem via a repository called “Claw Hub,” which introduces significant supply chain risks like “skill squatting,” where malicious skills masquerade as legitimate ones.

Core Security Vulnerabilities

The core design of OpenClaw prioritizes autonomy over security, delegating critical decisions to the LLM and removing traditional software guardrails. This creates several significant vulnerabilities.

• The Lethal Trifecta: The agent’s design combines three high-risk elements:

  1. Access to private data (files, emails, messages).
  2. Exposure to untrusted content (websites, external inputs).
  3. Ability for external communication.

• Prompt Injection and heartbeat.md Exploitation: A critical vulnerability demonstrated by HiddenLayer involves prompt injection. An attacker can embed a malicious instruction on a webpage. When the agent visits this page (e.g., while researching a topic for the user), the malicious prompt is executed. The attack involved instructing the agent to write a new set of instructions into a file called heartbeat.md.

  • This heartbeat.md file functions as a cron job, with its instructions being executed by the agent every 30 minutes.
  • By modifying this file, an attacker can establish persistent control, creating a command and control (C2) channel to exfiltrate data or execute arbitrary commands periodically.

• Lack of W^X (Write XOR Execute): A fundamental security principle is to separate writable locations from executable ones. OpenClaw violates this by allowing the agent to write to its own instruction files, like heartbeat.md and its own skills, effectively enabling it to rewrite its own program based on external input.

• Insecure by Default: At the time of the analysis, over 30,000 instances of OpenClaw were found to be publicly facing on the internet, allowing anyone to connect to them remotely. This was due to insecure default configurations, a likely artifact of its rapid, “vibe-coded” development.

Broader Implications and Mitigation Strategies

The OpenClaw experiment highlights critical challenges and lessons for the future of autonomous agents.

• Goal Hijacking and Social Engineering: Agents are highly susceptible to manipulation. An attacker doesn’t need sophisticated exploits; they can simply use text to “flip” an agent to work on their behalf through task redirection. Protecting agents from this kind of social engineering is a “trillion-dollar question.”

• Botnet Potential: The C2 mechanism established via the heartbeat.md vulnerability is a building block for a botnet. An attacker could compromise thousands of these intelligent agents, creating a far more sophisticated botnet than traditional ones. These AI agents could be tasked with complex, adaptive attacks, such as searching for crypto wallets or executing novel ransomware attacks on the fly.

• Applying Traditional Security Principles: To mitigate these risks, traditional security concepts must be adapted for AI agents:

  • Least Privilege: Granting an entity only the permissions necessary for its task. This is fundamentally at odds with OpenClaw’s design, which aims to give the agent maximum access to be a useful, general-purpose assistant.
  • Access Control and Confirmation: Instead of full autonomy, critical actions (like modifying heartbeat.md) should require explicit confirmation from the human user, similar to how an OS asks for permission to access a microphone or location.
  • Observability and Guardrails: A mature system needs centralized hooks to monitor and intercept communications with the LLM. In OpenClaw, LLM calls are scattered throughout the code, making it difficult to implement effective security guardrails.

The Future Outlook

OpenClaw, despite its flaws, is a valuable open experiment. The security community has learned an immense amount from its public development and deployment—lessons that would have been obscured inside a closed, corporate-built system. The future will likely see a mix of such open-source agents and more locked-down versions from major tech companies. The key takeaway is the need to balance the powerful features of autonomous agents with robust security architecture, learning from both traditional cybersecurity and the unique challenges posed by AI.

• Tags:
• Autonomous Agents
• AI Security
• Prompt Injection
• Vulnerability
• Feature
• LLM Security
• OpenClaw
• Botnet