OpenClaw Command and Control via Indirect Prompt Injection
OpenClaw
Researchers demonstrated how a malicious webpage embedding an indirect prompt injection could cause OpenClaw to silently execute scripts and plant persistent instructions. The technique turned the assistant into an unauthorized command and control agent.
- first report
- 6 Feb 2026
- last update
- 6 Feb 2026
Timeline · 2
Sources · 2
News and write-ups
- 2026-02-06Exploring the Security Risks of AI Assistants like OpenClawHiddenLayer · hiddenlayer.com/research/exploring-the-security-risks-of-ai-assistants-like-open
Research and catalogues
- 2026-02-06OpenClaw Command & Control via Prompt InjectionMITRE ATLAS · atlas.mitre.org/studies/AML.CS0051
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijack
- severity
- 1 · Research / proof of concept
- targets
- Framework / tooling
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM06:2025 Excessive Agency
- dates
- happened 3 Feb 2026 · first reported 6 Feb 2026
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# OpenClaw Command and Control via Indirect Prompt Injection https://gcdradar.vercel.app/incidents/openclaw-command-and-control-via-indirect-prompt-injection · AIR-2026-0342 · closed 2026-02-20 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2026-02-06 (happened 2026-02-03) - AI role: Attack on AI - Products: OpenClaw ## Summary Researchers demonstrated how a malicious webpage embedding an indirect prompt injection could cause OpenClaw to silently execute scripts and plant persistent instructions. The technique turned the assistant into an unauthorized command and control agent. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-02-06: Exploring the Security Risks of AI Assistants like OpenClaw (https://hiddenlayer.com/research/exploring-the-security-risks-of-ai-assistants-like-openclaw) - 2026-02-06: OpenClaw Command & Control via Prompt Injection (https://atlas.mitre.org/studies/AML.CS0051) ## Sources - 2026-02-06 MITRE ATLAS: OpenClaw Command & Control via Prompt Injection https://atlas.mitre.org/studies/AML.CS0051 - 2026-02-06 HiddenLayer: Exploring the Security Risks of AI Assistants like OpenClaw https://hiddenlayer.com/research/exploring-the-security-risks-of-ai-assistants-like-openclaw Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedOpenClaw Scope-Gap Injection: Exploiting Evaluator Blind Spots in OpenClaw
Research · since 27 Oct 2026
AI - closedOpenClaw AutoRedClaw: Automated Red-Teaming for Persistent Claw-Style Agents
Research · since 21 Oct 2026
AI - closed9.8Langflow CVE-2026-27966: Langflow Remote Code Execution in CSV Agent
Patch now · Disclosed · since 27 Feb 2026 · updated 27 Feb 2026 · CVE-2026-27966
AI - closed9.9Semantic Kernel RCE Vulnerability in Microsoft Semantic Kernel Search Plugin
Research · since 7 May 2026 · updated 30 Jun 2026 · CVE-2026-26030
AI - closedClawdBot Poisoned ClawdBot Skill Distributed on Registry
Research · since 26 Jan 2026
AI - closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI