Source-linked AI summary
From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent
Yuhang Wang, Feiming Xu, Zheng Lin, Guangyu He, Yuzhe Huang, Haichang Gao, Zhenxing Niu, Shiguo Lian, Zhaoxiang Liu
TL;DR
Personalized agents introduce security risks that existing synthetic or task-centric evaluations do not adequately capture, particularly when persistent private context, tools, and long-horizon interactions are involved. PASB addresses this gap through black-box, end-to-end evaluation of realistic personalized agents and applies it to OpenClaw. The study finds critical vulnerabilities across operational stages, with attacks propagating and persisting across interactions and producing system-level security risks.
Problem
Existing agent-security research and evaluations remain limited for real-world personalized deployments, which involve persistent operation, private context, tools, and long-horizon interactions.
Method
PASB is an end-to-end black-box framework that evaluates personalized scenarios, private assets, realistic toolchains, long-horizon interactions, and attack propagation on deployed agents.
Results
OpenClaw exhibits critical vulnerabilities across multiple execution stages, and attack behaviors can propagate and accumulate over extended interactions.
Takeaways & Limitations
Security evaluation and defenses for personalized agents must account for tool execution, memory, action-chain propagation, and long-horizon interactions rather than prompt-level behavior alone.
Takeaways & Limitations
PASB excludes direct host compromise, agent-code or system-prompt modification, model-weight modification, network denial-of-service, physical attacks, and agent-tool-interface bypasses.
Abstract
from arXiv · showhide
Although large language model (LLM)-based agents, exemplified by OpenClaw, are increasingly evolving from task-oriented systems into personalized AI assistants for solving complex real-world tasks, their practical deployment also introduces severe security risks. However, existing agent security research and evaluation frameworks primarily focus on synthetic or task-centric settings, and thus fail to accurately capture the attack surface and risk propagation mechanisms of personalized agents in real-world deployments. To address this gap, we propose Personalized Agent Security Bench (PASB), an end-to-end security evaluation framework tailored for real-world personalized agents. Building upon existing agent attack paradigms, PASB incorporates personalized usage scenarios, realistic toolchains, and long-horizon interactions, enabling black-box, end-to-end security evaluation on real systems. Using OpenClaw as a representative case study, we systematically evaluate its security across multiple personalized scenarios, tool capabilities, and attack types. Our results indicate that OpenClaw exhibits critical vulnerabilities at different execution stages, including user prompt processing, tool usage, and memory retrieval, highlighting substantial security risks in personalized agent deployments. The code for the proposed PASB framework is available at https://github.com/AstorYH/PASB.
1 INTRODUCTION
Personalized agents create a broader security landscape because persistent operation, private context, tools, and long-horizon interactions allow attacks to produce unsafe actions or private-asset exfiltration. PASB addresses limitations in existing synthetic or task-centric evaluations by enabling systematic black-box assessment of realistic personalized agents, and its OpenClaw case study reveals vulnerabilities across execution stages.
- Motivation: Personalized agents persist across sessions, accumulate private context, and execute actions through tools, expanding risks beyond undesired text generation.These risks include unsafe actions and private assets being exfiltrated through end-to-end interactions.
- Motivation: Existing agent-security evaluations often rely on controlled, white-box, or synthetic environments with custom agents and tool interfaces.Such designs provide methodological value but do not fully represent real-world personalized deployments.
- PASB: PASB provides an end-to-end, black-box framework using personalized scenarios, private assets, realistic toolchains, and long-horizon interactions.Its scenarios span personal communication, information management, and long-horizon task coordination.
- Evaluation: The OpenClaw case study evaluates multiple personalized scenarios, tool capabilities, attack types, and execution stages, including prompts, external content, tools, and memory.The evaluation also analyzes attack propagation and persistence during long-horizon interactions.
- Findings: OpenClaw exhibits critical vulnerabilities across execution stages, while attacks can propagate and accumulate over extended interactions.The findings indicate that prompt-level protections or synthetic-benchmark conclusions may not cover real-world personalized-agent risks.
2 METHODS
PASB models personalized agents as persistent, tool-using systems whose mixed-trust observations, private memory, and long-horizon execution can propagate attacks into system-level harms. Its black-box evaluation measures leakage, unsafe tool actions, and persistent harm through observable execution traces across realistic scenarios and attack channels.
- Personalized Agent Model: Personalized agents repeatedly interact with users, maintain evolving private context, and execute actions through external tools with varying privilege levels.Their observations combine user input, untrusted external content, previous tool outputs, and retrieved memory.
- Long-Horizon Execution: Persistent state allows earlier adversarial effects to influence later actions, tools, and memory across interaction steps and sessions.This long-horizon behavior creates system-level risks that single-turn or resettable formulations cannot capture.
- Threat Model: PASB defines attack tasks with personalized context, adversary-controlled inputs, interaction budgets, goal classes, and an end-to-end success predicate.The framework evaluates deployed agents in a black-box setting using only normal interaction and tool I/O, without access to model internals or system prompts.
- Success Measurement: Attack success occurs when observable traces show private-asset leakage, policy-violating tool calls, or harm that persists after injection stops.The predicate can be decomposed by harm type using P_leak, P_act, and P_persist.
- Attack Primitives: PASB models attacks as structured perturbations to observations, including direct prompt injection, indirect external-content influence, tool-return deception, and memory poisoning.Direct injection can cause unauthorized disclosure or unsafe tool calls, while external content can influence tool selection, arguments, and subsequent actions despite benign user prompts.
- Personalized Scenario Suite: The evaluation uses realistic threatening skills and external-content channels to test whether attacks materialize as measurable harms in deployed personalized workflows.Table 1 reports 131 threatening skills, each paired with a fixed query, return-value template, and injection instruction.
3 EVALUATION RESULTS ON PASB
PASB evaluates OpenClaw through black-box, end-to-end trials that combine realistic tools, external content, and memory operations. The results show that attacks can redirect tool selection and persist in memory despite defenses.
- Evaluation setup: OpenClaw is evaluated in deployed form through an end-to-end harness that supplies scenario-specific prompts, untrusted content, tool endpoints, and follow-up prompts.The harness records observable execution traces for each trial.
- Evaluation setup: The evaluation validates attacks through actual TypeScript operations and tangible environmental changes rather than text-based tool requests alone.Success requires effects such as unauthorized permission changes or data exfiltration.
- Attack coverage: PASB covers external-content and tool-return injections using 131 threatening tools spanning messaging, transactions, and data exfiltration surfaces.Tool outputs are manipulated to induce unauthorized follow-up actions.
- Tool-use results: Resp Rate remains 93.8%–99.0%, while Combined Attack reaches ASR values of 66.8%, 52.7%, and 61.9% across the three backbones without defense.For Llama-3.1-70B-Instruct, Combined Attack ASR falls from 66.8% without defense to 33.5% with Delimiter and 22.0% with Sandwich.
- Memory results: LTM extraction succeeds more often than STM extraction, while Delimiter and Instruction Prevention reduce extraction and modification success but leave residual attacks.Memory modification is measured by WSR through filesystem verification, and the experiments use 40 cases per category.
4 CONCLUSION AND FUTURE WORK
PASB benchmarks personalized-agent security on a deployed OpenClaw system and finds that vulnerabilities can arise across operational stages and propagate along the action chain. It provides a foundation for defenses addressing tool execution and long-horizon propagation.
- Conclusion: PASB reveals that critical vulnerabilities can arise across operational stages and propagate along the agent action chain.The benchmark targets system-level harms beyond unsafe text generation.
- Future work: The benchmark provides a practical foundation for building more robust defenses and resilient personalized agents.Future work will extend defenses and PASB with additional scenarios and attacker capabilities.