Source-linked AI summary
Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents
Ben Dong, Hui Feng, Qian Wang
TL;DR
The paper addresses limited security evaluation of open, extensible agent ecosystems by studying whether a malicious skill can amplify token use in a real deployment. It implements and evaluates Clawdrain, a Trojanized OpenClaw skill using a multi-turn Segmented Verification Protocol. The evaluation finds feasible token-drain attacks with ∼6–7× amplification in successful configurations and ∼9× in a costly failure case, while deployment behavior and interface design shape their magnitude and observability.
Problem
OpenClaw’s persistent reinjection of skill documentation and tool outputs creates an underexamined supply-chain surface that can affect prompt budget, control flow, and context growth.
Method
The paper designs, implements, and deploys Clawdrain, a Trojanized OpenClaw skill that induces a multi-turn Segmented Verification Protocol and measures its behavior in a production-like environment.
Results
∼6–7× amplification occurs in successful SVP configurations, while a failed configuration reaches ∼9×; deployed agents also autonomously compose tools to route around brittle protocol steps.
Takeaways & Limitations
Token-drain attacks remain feasible against production-like agents, while tool composition, recovery behavior, and interface design shape amplification and stealth.
Takeaways & Limitations
The study defers systematic measurement of the standalone and combined costs of additional deployment vectors, and failure-mode verbosity can expose the attack to security-aware users.
Abstract
from arXiv · showhide
Modern generative agents such as OpenClaw - an open-source, self-hosted personal assistant with a community skill ecosystem, are gaining attention and are used pervasively. However, the openness and rapid growth of these ecosystems often outpace systematic security evaluation. In this paper, we design, implement, and evaluate Clawdrain, a Trojanized skill that induces a multi-turn "Segmented Verification Protocol" via injected SKILL.md instructions and a companion script that returns PROGRESS/REPAIR/TERMINAL signals. We deploy Clawdrain in a production-like OpenClaw instance with real API billing and a production model (Gemini 2.5 Pro), and we measure 6-7x token amplification over a benign baseline, with a costly, failure configuration reaching approximately 9x. We observe a deployment-only phenomenon: the agent autonomously composes general-purpose tools (e.g., shell/Python) to route around brittle protocol steps, reducing amplification and altering attack dynamics. Finally, we identify production vectors enabled by OpenClaw's architecture, including SKILL.md prompt bloat, persistent tool-output pollution, cron/heartbeat frequency amplification, and behavioral instruction injection. Overall, we demonstrate that token-drain attacks remain feasible in real deployments, but their magnitude and observability are shaped by tool composition, recovery behavior, and interface design.
1 Introduction
OpenClaw’s persistent reinjection of skill documentation and tool outputs creates a supply-chain surface for token-amplification attacks. Clawdrain evaluates this risk in a production-like deployment and finds substantial amplification, with additional cost surfaces beyond output tokens.
- Threat surface: Persistent skill documentation and tool outputs can shape prompt structure, control flow, and context growth across agent turns.This enables adversaries to encode multi-step protocols, verbosity directives, or behavioral instructions that drive extended reasoning and repeated tool calls.
- Attack and evaluation: Clawdrain is a Trojanized query skill that uses a multi-turn Segmented Verification Protocol with PROGRESS, REPAIR, and TERMINAL responses.The protocol induces iterative calibration and repair cycles while preserving correct final outputs.
- Deployment effects: Real deployments can blunt or intensify drain attacks depending on tool composition, recovery behavior, and interface design.The study also observes emergent scripting workarounds and interface-dependent stealth.
- Beyond output tokens: Additional deployment vectors include oversized skill documentation, persistent verbose tool outputs, and cron or heartbeat frequency amplification.These vectors create less visible input-token, transcript, and execution-frequency cost surfaces.
Contributions
The paper contributes an implemented SVP-based malicious skill, deployment-grounded measurements, and an analysis of emergent behavior, stealth, and broader amplification surfaces.
- Attack implementation: The authors design and implement a malicious OpenClaw skill that induces SVP-based token amplification in a realistic agent framework.The evaluation demonstrates compliance by Gemini 2.5 Pro with injected multi-turn drain protocols.
- Measurement: The study quantifies amplification across three SVP configurations, including a costly-failure case that exceeds successful runs in total token consumption.
- Deployment behavior: The paper characterizes tool composition and scripting that partially mitigate calibration-based drains and expose a simulator–deployment gap.
- Broader attack surface: The analysis covers interface-dependent stealth and deployment-grounded amplification vectors beyond output length.
2 Background and Related Work
OpenClaw’s composable, stateful tool-calling architecture expands agent capabilities while creating adversarial supply-chain and resource-amplification surfaces. Prior work and this threat model connect prompt manipulation to control-flow, token, and execution-frequency abuse.
- OpenClaw architecture: OpenClaw extends a base LLM with callable skills whose documentation and tool outputs persist in conversation history and are re-sent as context each round.This supports composability and stateful reasoning but also makes injected content persistent.
- Security surface: Third-party skills can influence prompt budget, control flow, and context growth, making the skill layer a software supply-chain interface for LLM agents.
- Resource amplification: Token usage is billable and operationally scarce, so resource-amplification attacks target latency, throughput, and effective context capacity rather than only conventional system resources.
- Related work: Prior output-token amplification work used final-answer correctness as a narrow stealth criterion, while deployed agents require a richer threat model.
- Deployment effects: General-purpose tool composition can bypass brittle protocol steps, interface visibility varies across GUI, text-only, and autonomous modes, and background execution can conceal amplification.
- Prompt manipulation: Prompt-based jailbreaking can manipulate instruction following to bypass safety constraints, override directives, or induce unintended actions.
- Resource and control-flow manipulation: In tool-calling agents, embedded protocols and verbosity directives can extend reasoning, repeat tool calls, expand data, alter execution frequency, or trigger background actions without user awareness.
3 The Clawdrain Attack
The paper formalizes Clawdrain as a Trojanized OpenClaw skill and instantiates the Segmented Verification Protocol as a concrete amplification mechanism for deployed-agent evaluation.
- Attack design: Clawdrain is formalized as a Trojanized skill that implements a concrete, testable multi-turn protocol for resource amplification in a deployed agent.
3.1 Threat Model
The threat model assumes an adversary can introduce a Trojanized skill through several supply-chain or local channels into an OpenClaw deployment. The attack seeks excess token consumption and degraded throughput while preserving plausible behavior, correct answers, and limited user visibility.
- Adversary access: Adversaries may introduce malicious skills through a public registry, compromised dependencies, local filesystem access, or agent-generated installations.The registry contains over 5,700 third-party skills, while dependency compromise and prompt-influenced agent generation provide additional routes.
- Adversary goals: The adversary aims to increase operational cost and degrade throughput while preserving plausible benign behavior and correct final answers.Stealth is treated as a secondary goal, requiring that attacks not be easily detected during normal operation.
- Visibility settings: Attack observability varies across chat GUI, narrated TUI, and autonomous cron or heartbeat execution.Chat users can see tool calls and outputs, narrated mode exposes only high-level messages, and scheduled execution can lack user-facing output.
- Agent capabilities: The agent is assumed to access general-purpose tools such as shell or Python and may autonomously compose them during protocol execution.This assumption matters because tool composition can fundamentally change multi-turn drain dynamics.
3.2 Attack Design: The Segmented Verification Protocol
Clawdrain is a Trojanized skill that uses the Segmented Verification Protocol to induce repeated tool calls while preserving a correct, plausibly legitimate final answer. Its injected instructions and validation script require long calibration sequences, retries, and multiple protocol stages.
- Protocol overview: Clawdrain implements the Segmented Verification Protocol (SVP), designed to expand the transcript, preserve correct final answers, and appear legitimate to the agent.The protocol combines instructions embedded in SKILL.md with a companion validation script.
- Protocol structure: Each invocation requires a segment index and a complete comma-separated sequence of L integers from 1 to L, with abbreviation and range notation forbidden.The full autoregressive sequence is the primary source of output-token amplification.
- Protocol signals: The companion script returns PROGRESS for valid nonterminal segments, REPAIR for malformed sequences, and TERMINAL for the final valid segment.REPAIR preserves the current segment, while TERMINAL releases the correct benign payload and ends the protocol.
- Amplification mechanism: At least T_max successful tool calls, plus any REPAIR retries, are required before the final answer, with theoretical cost Ω(L×T_max) output tokens.Each call generates approximately L output tokens, in addition to growing session-history overhead.
- Legitimacy framing: The SVP is framed as data-provider freshness verification, using a cryptographic-handshake rationale to make the multi-step protocol appear legitimate.The experiments report that Gemini 2.5 Pro accepted this framing without question.
- Design methodology: The study hand-crafted the SVP through two manual refinement rounds and evaluated configurations varying prompt specificity and parameter aggressiveness.The configurations include SVP v1 with L=50 and T_max=2, SVP v2 with L=1000 and T_max=3, and SVP v3 with L=2000 and T_max=5.
3.3 Beyond Output Tokens: The Deployment Attack Surface
OpenClaw exposes deployment attack surfaces beyond output-token amplification through persistent prompt injection, history accumulation, and autonomous execution. These vectors can be combined without requiring a multi-turn protocol or an obvious tool-call anomaly, but their systematic costs remain future work.
- Additional attack surfaces: Output-token amplification is only one of several resource-amplification vectors available in OpenClaw deployments.The paper characterizes additional surfaces that simulator-based evaluations may miss.
- Input-token amplification: Every enabled skill’s SKILL.md is injected into the system prompt on every API call, so oversized documentation silently inflates input cost across sessions.This input-token amplification occurs regardless of whether the skill is invoked.
- Context-history accumulation: Tool-call inputs and outputs persist in session history and are resent on subsequent turns, causing verbose responses to compound into superlinear context growth.Persistent history makes tool-output pollution a continuing cost surface rather than a one-time expense.
- Execution-frequency amplification: Cron and heartbeat triggers can invoke skills autonomously at fixed intervals, multiplying per-invocation cost without user interaction or awareness.Execution-frequency amplification adds cost through repeated background execution.
- Scope boundary: These vectors can be combined without a multi-turn protocol or observable tool-call anomaly, while their standalone and combined costs are deferred to future work.The paper incorporates their interaction with compaction into its adaptive drain design but does not systematically quantify them here.
- Behavioral injection: System-level SKILL.md injection can also carry behavioral directives that alter global agent behavior, including verbosity across responses.The paper identifies possible integrity and confidentiality implications as a future direction.
3.4 Adaptive Drain Mechanisms
The fixed SVP is brittle because capable agents can use scripting to bypass repetitive calibration, so Clawdrain adds mechanisms targeting workaround resistance and context-compaction effects. These adaptations shift the attack focus from raw per-turn output toward recovery behavior and safety-constraint erosion.
- Motivation: A capable agent can collapse the fixed drain by scripting a reusable workaround, motivating adaptive mechanisms.The paper treats resistance to tool composition as a central adaptive-design problem.
- Workaround resistance: Selective REPAIR rejects shortcut-generated sequences and can require a per-turn timestamp-derived nonce, forcing autoregressive generation to sustain approximately L tokens per turn.The mechanism prevents cached or scripted responses from bypassing the intended cost.
- Compaction-aware escalation: A context-aware Trojan can accelerate lossy compaction with documentation bloat and verbose outputs, then escalate after prior user safety constraints are evicted.The two-phase design first operates modestly and later initiates the full SVP loop or previously forbidden actions.
- Adaptive objective: Adaptive mechanisms shift attacker optimization toward defeating tool composition, accelerating compaction, and exploiting costly recovery behavior.The resulting target is broader than maximizing tokens in each individual turn.
4 Experimental Evaluation
The evaluation deploys Clawdrain as a drop-in replacement for a benign query skill in OpenClaw with Gemini 2.5 Pro, measuring token amplification across successful and failed SVP configurations. Successful runs reached 6–7× amplification, while a failed configuration reached approximately 9× because autonomous recovery consumed additional context.
- Experimental setup: The study evaluates three SVP configurations in a local OpenClaw v2026.2.9 deployment using Gemini 2.5 Pro and standard shell, filesystem, and web-search tools.The Trojan skill replaces the default query skill while preserving the same user-facing interface.
- Token-drain measurements: ∼28k context tokens formed the benign baseline, while SVP v1 and v2 reached ∼125k and ∼190k, respectively, producing 6–7× amplification with correct final results.Token counts came from fresh-session measurements using OpenClaw’s built-in session status reporting.
- Deployment comparison: 65–658× amplification reported in a constrained simulator exceeded the deployment results because this evaluation used L≤1000 and T_max≤3, while scripting bypassed autoregressive sequence generation at L=1000.The workaround reduced per-turn output from approximately L tokens to a short shell command.
- Costly failure: ∼9× amplification occurred in SVP v3 despite protocol failure, exceeding every successful run.With L=2000 and T_max=5, repeated repairs triggered fallback strategies and approximately 249k context tokens.
- Costly failure: In deployed agents, autonomous recovery can make a failed attack more expensive than a successful one, challenging evaluations that treat failed attacks as low-cost.The agent continued through alternative tools and recovery actions instead of simply stopping.
4.4 Emergent Tool Composition as Defense
The deployment reveals that general-purpose tool access lets the agent script around brittle calibration steps, partially reducing amplification in ways constrained simulators cannot observe. Interface choice also changes stealth, while recovery failures can expose the attack.
- Tool composition: At L=1000, arithmetic errors triggered repairs before Gemini 2.5 Pro generated the calibration sequence with Python and reused it in later calls.The agent switched from autoregressive generation to a shell-based reusable file after two failed attempts.
- Tool composition: Scripting reduced per-turn output from approximately 1000 tokens to a short command of approximately 30 tokens, lowering measured amplification to 6–7×.The workaround emerged from access to general-purpose shell tools rather than from SKILL.md instructions.
- Tool composition: Tool composition creates a simulator–deployment gap because constrained evaluations disallow the general-purpose tools that real agents can use to route around brittle protocol steps.The same capability partially mitigates calibration-based drains while introducing additional control-flow channels.
- Interface-dependent stealth: Stealth varies by interface: GUI traces expose calibration calls, narrated TUI suppresses raw tool details, and autonomous cron or heartbeat execution provides no user-facing output.The same skill therefore ranges from immediately visible to effectively unobservable depending on execution mode.
- Interface-dependent stealth: A failed attack can expose itself through recovery narration, as the SVP v3 agent reported a faulty verification system that could prompt security inspection.The attacker must balance drain maximization against visibility from failure-mode verbosity.
5 Conclusion
The evaluation shows that token-drain attacks remain feasible against production-like agents, but deployment behavior changes their practical impact. Tool composition, recovery behavior, and interface visibility shape amplification and observability, while additional cost surfaces extend beyond output tokens.
- Conclusion: Production-like agents can follow Trojanized multi-turn protocols that significantly increase token usage while still returning correct answers.The conclusion presents this as evidence that token-drain attacks remain feasible in realistic deployments.
- Conclusion: Autonomous tool composition can help agents avoid repeated calibration failures, revealing deployment behavior that simulator-based evaluations miss.This behavior changes the practical impact of the attack relative to constrained simulations.
- Conclusion: Stealth depends on interface, with autonomous background execution capable of making drains effectively invisible.Interactive interfaces may expose traces that background execution does not show to users.
- Deployment vectors: Real-world risk extends beyond output-token amplification to bloated skill documentation, persistent tool-output pollution, cron or heartbeat frequency, and behavioral instruction injection.These vectors create additional deployment-grounded cost or behavior surfaces.