New Attacks Trick Open Claw AI Agent Into Running Code and Leaking Secrets

Summary: Two research teams showed this week that OpenClaw, the self-hosted AI agent, can be driven to run attacker-controlled code or leak sensitive data through ordinary inputs: Imperva hid instructions in shared contacts, vCards, and location pins that the agent executed invisibly, while Varonis built a test agent called Pinchy that forwarded mock AWS keys and a synthetic export of 247 enterprise customers after two phishing emails. Imperva's flaw is patched in OpenClaw 2026.4.23, which moves contact names, vCard fields, and location labels into a separate untrusted-metadata channel, but Varonis found the social-engineering weakness is not something a patch fixes.
Why it matters: Both failures happened under a strict profile that told the agent to verify senders first - urgency beat the rule once, routine beat it the second time - and the Dutch data protection authority has told users and organisations not to run OpenClaw on systems holding sensitive data.

Read the original at The Hacker News ↗