PaperlayerView exact revision on arXiv

Source-linked AI summary

OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents

Frank Li

arXiv:2603.11853v1cs.CR

TL;DR

Tool-augmented agents create distributed security risks that single-boundary filtering cannot adequately address. OpenClaw PRISM provides a zero-fork runtime layer with lifecycle-wide interception, hybrid scanning, risk accumulation, policy enforcement, and tamper-evident operations. Preliminary same-slice benchmarks report 73/80 correct outcomes for Full PRISM in a live local-model run, while the authors characterize detection as layered and best-effort rather than perfect.

  • Problem

    Tool-augmented agents expose risks through fetched content, tool use, outbound messages, and local control files, creating a need for runtime defenses beyond user-input filtering.

  • Method

    PRISM combines a zero-fork plugin and optional sidecars with ten lifecycle hooks, hybrid heuristic-plus-LLM scanning, scoped decaying risk, policy controls, and tamper-evident operations.

  • Results

    73/80 correct outcomes were achieved by Full PRISM in the live local-model unified benchmark, compared with 55/80 for Plugin + scanner.

  • Takeaways & Limitations

    PRISM targets deployable, auditable runtime defense for existing agent gateways rather than benchmark-only detection.

  • Takeaways & Limitations

    Detection remains incomplete because heuristic and LLM-assisted scanners can miss adaptive or novel adversarial inputs, while policy quality requires ongoing maintenance.

Abstract

from arXiv · show

Tool-augmented LLM agents introduce security risks that extend beyond user-input filtering, including indirect prompt injection through fetched content, unsafe tool execution, credential leakage, and tampering with local control files. We present OpenClaw PRISM, a zero-fork runtime security layer for OpenClaw-based agent gateways. PRISM combines an in-process plugin with optional sidecar services and distributes enforcement across ten lifecycle hooks spanning message ingress, prompt construction, tool execution, tool-result persistence, outbound messaging, sub-agent spawning, and gateway startup. Rather than introducing a novel detection model, PRISM integrates a hybrid heuristic-plus-LLM scanning pipeline, conversation- and session-scoped risk accumulation with TTL-based decay, policy-enforced controls over tools, paths, private networks, domain tiers, and outbound secret patterns, and a tamper-evident audit and operations plane with integrity verification and hot-reloadable policy management. We outline an evaluation methodology and benchmark pipeline for measuring security effectiveness, false positives, layer contribution, runtime overhead, and operational recoverability in an agent-runtime setting, and we report current preliminary benchmark results on curated same-slice experiments and operational microbenchmarks. The system targets deployable runtime defense for real agent gateways rather than benchmark-only detection.

1 Introduction

Tool-augmented agents distribute security risks across prompts, retrieved content, tools, state, and outbound actions, making single-boundary defenses insufficient. OpenClaw PRISM addresses this with a zero-fork, lifecycle-wide runtime layer that combines staged detection, policy enforcement, operational controls, and evaluation artifacts.

  • Motivation: Tool-augmented agents expose attack surfaces across direct prompts, fetched content, tool results, prompt construction, outbound messages, and local control files.Risks include prompt override, tool abuse, credential leakage, and control-file tampering.
  • Motivation: Single-checkpoint defenses can miss indirect prompt injections and low-grade signals that accumulate across conversational turns.Tool misuse and credential exfiltration also require policy enforcement beyond text classification.
  • Architecture: PRISM distributes enforcement across ten lifecycle hooks spanning message ingress, prompt construction, tool execution, persistence, outbound messaging, sub-agent spawning, and startup.Its hybrid pipeline uses heuristic scoring first and can escalate suspicious content to an LLM-assisted classifier.
  • Controls: The runtime layer unifies graduated risk accumulation, tool and network governance, protected-path controls, outbound secret filtering, and tamper-evident operations.Operational features include chained audit records, integrity verification, hot-reloadable policies, and dashboard allow workflows.
  • Architecture: PRISM attaches to OpenClaw gateways without upstream code changes, combining an in-process plugin with optional sidecar services.The design targets deployability, long-running supervision, auditing, and operator tuning.
  • Evaluation and scope: The paper outlines evaluation artifacts for security effectiveness, false positives, layer contribution, runtime overhead, and operational recoverability, while positioning deployment-time governance as the target.The introduction frames PRISM as an operational runtime layer rather than a benchmark-only detector.

2 Background and Threat Model

PRISM models an agent gateway as a multi-stage runtime in which users, external content, tools, persisted state, and operators interact with security-relevant assets. Its threat model covers prompt override, unsafe execution, secret exposure, escalation, and tampering, while excluding broader compromise outside the gateway boundary.

  • Runtime model: The runtime passes security-relevant information through user messages, retrieved content, prompt construction, tool parameters, tool results, and outbound responses.PRISM therefore treats multiple lifecycle stages as potentially attackable rather than assuming a single input channel.
  • Runtime entities: PRISM comprises the OpenClaw gateway, an in-process plugin, and optional scanner, invoke-guard, dashboard, and file-monitor sidecars.The plugin intercepts lifecycle events while sidecars extend scanning, enforcement, operations, and monitoring.
  • Assets: Security-relevant assets include hidden control context, tool execution privileges, local configuration state, and secret material.Attacks may induce unsafe execution, disclose sensitive values, poison persistent state, or tamper with control and audit surfaces.
  • Adversaries and goals: The threat model includes attackers controlling user text or external content to attempt instruction override, hidden-context exfiltration, unsafe tool use, and indirect prompt injection.The addressed goals also include policy bypass, secret exfiltration, long-horizon escalation, and control-file tampering.
  • Scope boundaries: PRISM excludes model poisoning, training-time corruption, arbitrary model-internal compromise, full host compromise, kernel or hardware attacks, and external supply-chain compromise.It is not intended to be a complete operating-system sandbox or general-purpose outbound firewall.
  • Scope boundaries: The design assumes baseline integrity of the gateway process, host environment, and deployment stack beyond PRISM’s own enforcement boundary.Within that assumption, PRISM aims to make mediated attacks more detectable, interruptible, and auditable.

3 System Design

PRISM is a zero-fork runtime security architecture that combines an in-process gateway plugin with optional sidecars and distributes enforcement across the agent lifecycle. Its defenses combine hybrid scanning, policy controls, risk-aware interception, sanitization, audit integrity, and operational recovery.

  • Architecture Overview: PRISM inserts security logic without modifying OpenClaw source, using a gateway plugin for interception and sidecars for scanning, governance, operations, and monitoring.The architecture keeps heavier operational functions outside the plugin’s critical path.
  • Lifecycle-Wide Enforcement: Ten lifecycle hooks grouped into five phases distribute controls from message ingress through tool execution, persistence, outbound messaging, maintenance, and startup recovery.The phases support escalation from observation and warning to enforcement, redaction, and stateful recovery.
  • Lifecycle-Wide Enforcement: Before tool execution, PRISM can block elevated-risk tools, reject shell metacharacters and trampoline commands, enforce executable and path policies, and restrict network destinations.This hook is the principal synchronous point where detection becomes explicit runtime control.
  • Lifecycle-Wide Enforcement: Post-execution controls heuristically screen tool results, invoke the scanner selectively, add bounded risk on scanner failure, and sanitize suspicious output before persistence.These controls reduce the chance that malicious tool-returned text survives unchanged into later prompt context.
  • Two-Tier Injection Scanning: PRISM combines broad low-latency heuristic scoring with a sidecar tier that can use a bounded local LLM judge, while retaining heuristic-only fallback when model classification fails.The LLM judge is a secondary signal source rather than the system’s sole security anchor.
  • Tool, Network, and Audit Governance: Governance extends beyond injection scanning to tools, protected paths, outbound destinations, secret filtering, and tamper-evident audit operations.Path checks normalize strings but do not claim symlink-aware filesystem containment.

4 Implementation

PRISM is implemented as a modular TypeScript monorepo whose plugin runs inside the gateway while optional sidecars can be independently supervised, configured, and deployed. Shared security logic and operational tooling support consistent enforcement, testing, policy management, and audit verification.

  • Implementation Architecture: The TypeScript monorepo targets Node.js ≥22, uses pnpm, and separates the in-process plugin from four optional standalone sidecar services.The sidecars can be supervised, upgraded, and restarted independently.
  • Shared Runtime Logic: Shared utilities centralize heuristics, canonicalization, audit-chain verification, path normalization, and common types across runtime components and the evaluation harness.This ensures experiments exercise the same security logic used in live deployment.
  • Implementation Architecture: The workspace contains seven packages built into ESM artifacts, with approximate production source-line counts summarized in Table 1.The reported counts exclude test files.
  • Configuration and Deployment: Declarative configuration lets operators tune risk TTL, protected paths, execution rules, scanner timeouts, secret patterns, and domain tiers without changing source code.This makes PRISM a configurable runtime layer rather than a fixed benchmark binary.
  • Configuration and Deployment: The reference deployment builds the workspace, provisions secrets and policies, and supports systemd, launchd, or manual supervision for long-running gateways.All network-exposed components default to loopback bindings, and individual sidecars can be enabled incrementally.
  • Operational Interfaces: Operator tooling provides service control, status inspection, post-upgrade verification, offline policy simulation, and audit inspection and verification.These interfaces complement authenticated machine-facing HTTP endpoints for scanning, tool control, dashboard management, and health inspection.
  • Testing and Engineering Maturity: The repository includes 13 test files containing 142 test cases covering heuristics, audit verification, lifecycle behavior, proxy policy, scanner paths, dashboard workflows, and monitor reconciliation.The authors characterize this as broad engineering coverage, not formal proof of security or production-scale validation.

5 Evaluation

PRISM is evaluated as a deployable runtime defense across attack surfaces, protection layers, overhead, and operational recovery rather than as a standalone classifier. Preliminary same-slice and harness experiments show stronger protection with scanner and full-runtime configurations, while remaining limited in scope and deployment realism.

  • Evaluation goals: The evaluation measures security effectiveness, false positives, layer contribution, runtime overhead, and operational recoverability across distributed runtime defenses.Its design follows PRISM’s lifecycle architecture rather than collapsing outcomes into a single prompt-injection score.
  • Experimental scope: The preliminary harness supports only partial engines and is not a substitute for full end-to-end baseline comparison.Current experiments cover heuristic, scanner, policy, and selected hook-level behaviors, while larger gateway experiments remain future work.
  • Interpretation: The preliminary results remain non-final because benchmark-path timings and curated slices do not replace deployment-level end-to-end evaluation.The corpus and harness are explicitly described as preliminary, with expanded attack suites and real gateway overhead instrumentation still planned.
  • Text and policy benchmarks: The controlled mock-assisted scanner run reached accuracy 0.867, precision 0.800, recall 1.000, and F1 0.889 on 30 scanner cases.The scanner engine improved from 15/30 correct classifications in the default run to 26/30 under explicitly embedded model verdicts.
  • Live benchmark: 0.955 live attack block rate was achieved by Full PRISM on the 80-case local-model slice, versus 0.000 for No PRISM.Full PRISM reached 73/80 correct outcomes, while No PRISM, Heuristics only, and Plugin only reached 36/80, 46/80, and 49/80.
  • Overhead: In the live 80-case slice, scanner-backed configurations increased p95 latency to 12.5 s for Plugin + scanner and 15.8 s for Full PRISM.No PRISM, Heuristics only, and Plugin only remained below 1 ms at p95, while peak RSS deltas stayed below 1.4 MiB across rows.

6 Related Work

PRISM is positioned as a deployable runtime-security architecture for agent gateways, combining lifecycle interception, policy enforcement, detection, and auditing rather than introducing a new classifier or cryptographic primitive.

  • Unlike boundary-only firewalls, PRISM distributes enforcement across ingress, prompt construction, tool checks, post-tool scanning, persistence, and outbound handling.
  • PRISM differs from general guardrail frameworks through its zero-fork integration with one concrete OpenClaw gateway stack.
  • PRISM emphasizes explicit interception points, policy-backed runtime controls, and recoverable operations rather than relying on a single supervisory model.
  • PRISM addresses agent security as a runtime systems problem spanning prompt injection, tool use, memory-related stages, and operational controls.
  • Its contribution integrates detection with high-risk tool blocking, protected paths, private-network restrictions, domain tiers, outbound secret filtering, and operator workflows.
  • PRISM couples tamper-evident auditing, health probes, configuration reloads, and allow workflows to operator review, policy management, and recoverability.

7 Discussion and Limitations

PRISM is presented as a practical, framework-specific runtime layer rather than a complete security boundary, with incomplete detection, policy-maintenance requirements, scoped filesystem protections, and limited validation.

  • Discussion: PRISM distributes enforcement and connects detection, policy enforcement, auditing, and operator workflows through a zero-fork gateway integration.
  • Limitations: Detection remains incomplete: heuristics may miss adaptive attacks, while the optional LLM scanner is a best-effort classifier rather than a formally trustworthy arbiter.
  • Limitations: PRISM centralizes policy controls but still requires ongoing review of allowlists, denylists, protected paths, domain tiers, and DLP patterns.
  • Limitations: Path protections use string-level normalization without symlink resolution, so PRISM should not be treated as a complete filesystem sandbox.
  • Limitations: The OpenClaw-specific hook and deployment assumptions limit direct portability to other agent frameworks.
  • Limitations: PRISM does not replace OS-level sandboxing, kernel isolation, hardware-rooted integrity, or general outbound network controls outside directly mediated paths.
  • Limitations: Large-scale multi-tenant validation, long-duration operational studies, and broader benchmark coverage remain future work.
  • Discussion: The paper presents PRISM as a practical step from isolated filters toward a lifecycle-aware, policy-enforced, auditable runtime layer.

8 Conclusion

The conclusion frames agent security as a distributed systems problem requiring lifecycle-aware controls, policy enforcement, auditability, and operational recovery. PRISM demonstrates this approach for OpenClaw gateways while remaining incomplete and framework-specific.

  • Agent security risks span message ingress, prompt construction, tool invocation, tool-returned content, outbound messaging, and local control files.
  • PRISM combines ten lifecycle hooks, hybrid heuristic-plus-LLM scanning, scoped risk accumulation, policy controls, and tamper-evident auditing.
  • The paper argues that runtime interception, staged policy response, audit integrity, and recoverable operator workflows matter in long-running tool-using gateways.
  • PRISM is not a complete defense, formal guarantee, or substitute for lower-layer hardening such as OS sandboxing.
  • Future work includes broader indirect-injection and tool-abuse benchmarks, cross-framework evaluation, and combining deployable controls with formal safe-tool-use specifications.
Loading 2603.11853v1…