Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Systematic Taxonomy of Security Vulnerabilities in the OpenClaw AI Agent Framework

Surada Suwansathit, Yuxuan Zhang, Guofei Gu

Abstract

AI agent frameworks connecting large language model (LLM) reasoning to host execution surfaces--shell, filesystem, containers, and messaging--introduce security challenges structurally distinct from conventional software. We present a systematic taxonomy of 190 advisories filed against OpenClaw, an open-source AI agent runtime, organized by architectural layer and trust-violation type. Vulnerabilities cluster along two orthogonal axes: (1) the system axis, reflecting the architectural layer (exec policy, gateway, channel, sandbox, browser, plugin, agent/prompt); and (2) the attack axis, reflecting adversarial techniques (identity spoofing, policy bypass, cross-layer composition, prompt injection, supply-chain escalation). Patch-differential evidence yields three principal findings. First, three Moderate- or High-severity advisories in the Gateway and Node-Host subsystems compose into a complete unauthenticated remote code execution (RCE) path--spanning delivery, exploitation, and command-and-control--from an LLM tool call to the host process. Second, the exec allowlist, the primary command-filtering mechanism, relies on a closed-world assumption that command identity is recoverable via lexical parsing. This is invalidated by shell line continuation, busybox multiplexing, and GNU option abbreviation. Third, a malicious skill distributed via the plugin channel executed a two-stage dropper within the LLM context, bypassing the exec pipeline and demonstrating that the skill distribution surface lacks runtime policy enforcement. The dominant structural weakness is per-layer trust enforcement rather than unified policy boundaries, making cross-layer attacks resilient to local remediation.

A Systematic Taxonomy of Security Vulnerabilities in the OpenClaw AI Agent Framework

Abstract

AI agent frameworks connecting large language model (LLM) reasoning to host execution surfaces--shell, filesystem, containers, and messaging--introduce security challenges structurally distinct from conventional software. We present a systematic taxonomy of 190 advisories filed against OpenClaw, an open-source AI agent runtime, organized by architectural layer and trust-violation type. Vulnerabilities cluster along two orthogonal axes: (1) the system axis, reflecting the architectural layer (exec policy, gateway, channel, sandbox, browser, plugin, agent/prompt); and (2) the attack axis, reflecting adversarial techniques (identity spoofing, policy bypass, cross-layer composition, prompt injection, supply-chain escalation). Patch-differential evidence yields three principal findings. First, three Moderate- or High-severity advisories in the Gateway and Node-Host subsystems compose into a complete unauthenticated remote code execution (RCE) path--spanning delivery, exploitation, and command-and-control--from an LLM tool call to the host process. Second, the exec allowlist, the primary command-filtering mechanism, relies on a closed-world assumption that command identity is recoverable via lexical parsing. This is invalidated by shell line continuation, busybox multiplexing, and GNU option abbreviation. Third, a malicious skill distributed via the plugin channel executed a two-stage dropper within the LLM context, bypassing the exec pipeline and demonstrating that the skill distribution surface lacks runtime policy enforcement. The dominant structural weakness is per-layer trust enforcement rather than unified policy boundaries, making cross-layer attacks resilient to local remediation.

Paper Structure

This paper contains 67 sections, 5 figures.

Table of Contents

  1. Introduction
  2. AI agent frameworks as an execution surface.
  3. The need for a systematic taxonomy.
  4. Contributions.
  5. Paper organization.
  6. Modeling System Architecture and Attack Surface
  7. System Components
  8. Channel System.
  9. Gateway.
  10. Plug-ins & Skills System.
  11. Agent Runtime.
  12. Memory & Knowledge System.
  13. LLM Provider.
  14. Local Execution.
  15. Attack Surface Overview
  16. ...and 52 more sections

Figures (5)

  • Figure 1: OpenClaw system architecture with attack surfaces mapped to each component. Solid boxes represent system components; dashed orange regions denote attack surfaces from the taxonomy in Table \ref{['fig:taxonomy-matrix']}.
  • Figure 2: Advisory disclosure timeline. The two distinct waves correspond to an initial coordinated audit (Jan 31--Feb 16) and an accelerated follow-on discovery phase (Feb 18--25) that more than doubled the advisory corpus while patching from the first wave was actively in progress.
  • Figure 3: Severity distribution by attack surface. The Exec Policy Engine dominates in volume (46 advisories, 24.2%) while the Tool Dispatch Interface and Browser Tooling surface shows the highest proportion of High-severity findings relative to its total.
  • Figure 4: Two-axis taxonomy matrix mapping OpenClaw attack surfaces (rows) to kill chain stages (columns). Filled circles indicate that the surface is exploitable at that stage.
  • Figure 5: OpenClaw Kill Chain