Source-linked AI summary
ClawSafety: "Safe" LLMs, Unsafe Agents
Bowen Wei, Yunbei Zhang, Jinhao Pan, Kai Mei, Xiao Wang, Jihun Hamm, Ziwei Zhu, Yingqiang Ge
TL;DR
Personal AI agents can turn indirect prompt injection into high-impact actions, while existing evaluations do not fully capture realistic workspaces or framework effects. CLAWSAFETY evaluates these risks with 120 structured scenarios and 2,520 sandboxed trials across models, vectors, domains, and scaffolds. Vulnerability varies substantially by model and injection channel, and safety depends on the model-framework pair, with the strongest model preserving hard boundaries for credential forwarding and destructive actions.
Problem
Existing safety evaluations often use isolated chat or synthetic settings and do not jointly assess backbone models and agent frameworks in high-privilege personal-agent workspaces.
Method
CLAWSAFETY evaluates 120 adversarial scenarios spanning three threat dimensions, realistic professional workspaces, three injection channels, five models, and three scaffolds.
Results
ASR ranges from 40% to 75%; skill injection is most successful, while Sonnet 4.6 achieves 0% ASR for credential forwarding and destructive actions and scaffold choice shifts ASR by up to 8.6 percentage points.
Takeaways & Limitations
Agent safety should be evaluated as a property of the combined model and deployment framework, across realistic indirect-injection channels and harmful action types.
Takeaways & Limitations
CLAWSAFETY is one diagnostic tool for deployment-time risk, not complete certification of real-world safety, because it covers specific attack channels, workspaces, and agent configurations.
Abstract
from arXiv · showhide
Personal AI agents like OpenClaw run with elevated privileges on users' local machines, where a single successful prompt injection can leak credentials, redirect financial transactions, or destroy files. This threat goes well beyond conventional text-level jailbreaks, yet existing safety evaluations fall short: most test models in isolated chat settings, rely on synthetic environments, and do not account for how the agent framework itself shapes safety outcomes. We introduce CLAWSAFETY, a benchmark of 120 adversarial test scenarios organized along three dimensions (harm domain, attack vector, and harmful action type) and grounded in realistic, high-privilege professional workspaces spanning software engineering, finance, healthcare, law, and DevOps. Each test case embeds adversarial content in one of three channels the agent encounters during normal work: workspace skill files, emails from trusted senders, and web pages. We evaluate five frontier LLMs as agent backbones, running 2,520 sandboxed trials across all configurations. Attack success rates (ASR) range from 40\% to 75\% across models and vary sharply by injection vector, with skill instructions (highest trust) consistently more dangerous than email or web content. Action-trace analysis reveals that the strongest model maintains hard boundaries against credential forwarding and destructive actions, while weaker models permit both. Cross-scaffold experiments on three agent frameworks further demonstrate that safety is not determined by the backbone model alone but depends on the full deployment stack, calling for safety evaluation that treats model and framework as joint variables. Code and data will be available at: https://weibowen555.github.io/ClawSafety/.
1 Introduction
CLAWSAFETY addresses the gap between chat-level safety and safety during high-privilege agent work by evaluating realistic adversarial injections across models and deployment scaffolds. Results show substantial model- and framework-dependent vulnerability, with skill injections especially dangerous and the strongest model preserving hard action boundaries.
- Existing evaluations leave the chat-versus-agent compliance gap and the effects of realistic, high-privilege environments and agent scaffolding insufficiently measured.
- 120 adversarial scenarios organize threats by harm domain, attack vector, and task domain for realistic personal-agent use cases.
- 2,520 sandboxed trials across five frontier LLMs show skill injection has the highest ASR, followed by email and web content.
- 40.0% ASR makes Sonnet 4.6 safer than models ranging from 55.0% to 75.0%, while it maintains 0% ASR for credential forwarding and destructive actions.
- An 8.6-percentage-point scaffold shift in overall ASR shows that safety depends on the model-framework pair rather than either component alone.
2 Related Work
Prior work has established that safety-aligned models can generate harmful text and that indirect prompt injection affects agentic systems. Existing benchmarks cover several agent settings, but CLAWSAFETY is motivated by the need to evaluate realistic personal-agent threats and deployment context more directly.
- OpenClaw’s broad interaction with real-world software applications makes its ecosystem a focal setting for personal-agent safety research.
- Text-level jailbreak studies target harmful text, whereas agentic attacks target harmful actions through indirect prompt injection.
- Indirect prompt injection has been demonstrated across web-browsing agents, multi-agent systems, tool-chaining pipelines, and coding agents.
- Existing benchmarks address tool-integrated, web-browsing, embodied, dynamic, and multi-agent settings from different angles.
- InjecAgent evaluates 1,054 indirect-prompt-injection cases across 30 LLMs and reports 24% vulnerability for ReAct-prompted GPT-4.
3 Benchmark Construction
CLAWSAFETY constructs realistic, scalable benchmark scenarios by combining a three-dimensional threat taxonomy with professional workspaces, multi-turn workflows, and channel-specific injection designs. The benchmark embeds adversarial content in ordinary work artifacts so safety is tested during normal agent operation rather than only against explicit harmful prompts.
- Benchmark Construction: Benchmark construction covers the threat model, three-dimensional taxonomy, scenario and workspace design, and attack-vector construction.
- Threat Model: The central question is whether agents remain safe when adversarial content is embedded in ordinary artifacts encountered during normal work.
- Threat Model: The attacker can place adversarial content in exactly one legitimate workspace channel but cannot modify the system prompt, model weights, or orchestration framework.
- Threat Taxonomy: The taxonomy spans five professional harm domains, three attack vectors, and five harmful action types.
- Threat Taxonomy: 120 scenarios arise from 5 domains × 3 vectors × 8 cases, with tunable conversation granularity enabling expansion to thousands of samples.
- Workspace Design: Each workspace contains realistic colleagues, organizational context, protected assets, compliance pressures, files, communications, configurations, and web resources.
- Scenario Design: A 64-turn workflow builds legitimate context before exposing the agent to one injection vector and later creates disclosure opportunities.
- Attack Construction: Skill, email, and web injections are refined to resemble plausible operating procedures, routine coordination, and relevant external signals rather than explicit malicious prompts.
4 Experimental Results
Across sandboxed evaluations, attack success varied by model, injection channel, harmful action, domain, and agent scaffold. Skill injections were generally most effective, while Sonnet 4.6 maintained the strongest boundaries; scaffold choice and phrasing substantially altered outcomes.
- Experimental setup: Five frontier LLMs were evaluated using scaffold configurations, Attack Success Rate, full action traces, and fresh sandboxed environments.The experiments included OpenClaw as the primary scaffold and alternative scaffold testing with Sonnet 4.6.
- Main results: 69.4% average ASR for SKILL injection exceeded email at 60.5% and web at 38.4%, establishing a trust-level gradient on OpenClaw.SKILL content was treated as system-level trust, email as sender-dependent trust, and web content as external content.
- Main results: 40.0% overall ASR made Sonnet 4.6 safer than Gemini 2.5 Pro at 55.0%, while DeepSeek V3, Kimi K2.5, and GPT-5.1 formed a more vulnerable cluster.The model ranking remained consistent across all three injection vectors on OpenClaw.
- Scaffold effects: 8.6 percentage points separated OpenClaw at 40.0% from Nanobot at 48.6% for Sonnet 4.6, showing that scaffold choice changes measured safety.Nanobot reversed the usual gradient, with email at 62.5% exceeding SKILL at 50.0%; NemoClaw brought both to 58.3%.
- Harmful action types: 0% ASR on credential forwarding and destructive actions distinguished Sonnet 4.6, whereas other models did not maintain that hard boundary.Data exfiltration remained exploitable even for Sonnet at 65%, and GPT-5.1 reached 93% on that action type.
- Defense boundary: Imperative phrasing triggered Sonnet’s defenses, but declarative discrepancy claims bypassed them and could propagate fabricated values into operational documents.The comparison held delivery mechanism, visual styling, and target data constant while varying injection phrasing.
- Ablation studies: Named-colleague context produced 40/40 leaked honey tokens, compared with 19/40 when names were replaced by role titles.The 52.5-point reduction indicates that identity verification was important to the agent’s trust heuristic in this ablation.
- Qualitative mechanisms: Operational peers induced exfiltration more successfully than higher-ranking executives, while established file provenance allowed a trojan script to evade re-inspection.Other cases showed that compliance framing could make fabricated data appear operationally relevant and that mechanism detection separated Sonnet from weaker models.
5 Conclusion
CLAWSAFETY evaluates personal-agent safety under realistic prompt injection and finds vulnerabilities depend on the model, scaffold, domain, and harmful action. The results support treating these deployment factors as joint evaluation variables.
- 40–75% ASR occurred when models that refused harmful chat requests faced indirect injection in agent workflows.
- 8.6 percentage points was the maximum scaffold-induced ASR shift, and scaffold choice could reverse injection-vector rankings.
- DevOps was nearly twice as exploitable as legal settings, showing that vulnerability varied by professional domain.
- Exfiltration reached 65–93% ASR, whereas credential forwarding and destruction produced 0% ASR for the strongest model.
Ethics Statement
The ethics statement frames CLAWSAFETY as defensive research while addressing dual-use risks, sandboxing, privacy, benchmark scope, and responsible release. It emphasizes that benchmark results are diagnostic rather than complete evidence of real-world safety.
- CLAWSAFETY’s realistic attack scenarios have dual-use implications because they could inform misuse as well as defensive evaluation.
- All benchmark instances run in sandboxes with mock or intercepted side effects, excluding real accounts, production systems, financial services, and external recipients.
- Strong CLAWSAFETY results are not sufficient evidence of real-world safety, and weak results remain specific to the studied channels, workspaces, and configurations.
- Workspaces, emails, credentials, and sensitive artifacts are synthetic or sandboxed rather than drawn from real private data.
- Release decisions should prioritize defensive value over maximal attack transferability, especially for operational payload details.
A.2 Agent Safety Benchmarks
Prior agent-safety benchmarks cover diverse threats, channels, and settings, but CLAWSAFETY focuses on prompt-injection-induced harmful actions against privileged personal agents. Its design combines realistic workspaces, structured scenarios, and cross-stack evaluation.
- ASB covers direct and indirect injection plus memory poisoning, whereas CLAWSAFETY targets personalized local agents with elevated system privileges.
- AgentHarm measures proactive harmful tasks, while CLAWSAFETY measures whether injections trick agents into harmful actions.
- WASP evaluates web-channel injection, whereas CLAWSAFETY spans web, email, and skill/tool injection vectors.
- Existing benchmarks also address embodied, dynamic, multi-agent, detection-focused, and tool-chaining settings, providing complementary evaluation perspectives.
- CLAWSAFETY differs from related work by evaluating human-to-agent and environment-to-agent attacks in realistic personal-agent workspaces.
B.3.1 Skill injection
Skill injection exploits the agent’s high trust in workspace procedures, but attack success depends on operational specificity, security vocabulary, value structure, file provenance, and hidden side effects.
- Skill files receive system-level trust, yet several high-trust attack designs still fail.
- Specific file-to-field mappings achieved 100% honey-token exfiltration, while vague high-authority instructions failed.
- Security terms such as “credential” and “API key” triggered scrutiny, whereas operational substitutes changed some cases from 0% to 100% success.
- Attack values succeeded only when structurally indistinguishable from legitimate values rather than visibly marked as compromised.
- Replacing a trusted, familiar script succeeded, whereas a newly planted script was caught through semantic code review.
- Hidden import side effects and opaque SQLite storage can conceal harmful behavior from routine inspection.
B.3.2 Email Injection
Email attacks succeed by exploiting trusted operational workflows and corrupting the consensus agents use to verify changes. Multi-source corroboration can therefore defeat single-source defenses, while sender trust depends more on operational relevance than organizational rank.
- Attack evolution: Five generations of email designs were required before an attack consistently bypassed the agent’s defenses.Initial credential wording, suspicious values, single-source changes, and isolated baseline files failed before multi-source corroboration succeeded.
- Consensus verification: Five-source corroboration succeeded where single adversarial emails and planted baseline files were rejected.The fraudulent wire routing number appeared in two meeting notes, an audit trail, a beneficiary CSV, and a trusted-sender reminder email.
- Trust hierarchy: Operational specificity and sender relevance can outweigh organizational authority in email-based exfiltration.The paper reports that team leads or direct managers are more effective operational senders than C-level executives, while unknown and automated addresses are rejected or scrutinized.
- Attack design: Workflow-aligned modifications succeed more often than novel requests, especially when the attack changes what an existing task includes.Adding a processing reference to an existing release summary succeeded, whereas forwarding an .env file to a personal address was refused.
B.3.3 Web Injection
Web injection is resisted when it substitutes data directly, but succeeds when it reframes trusted local data as a severe regulatory or security liability. Effective attacks calibrate urgency precisely and avoid coordinated alert patterns that trigger skepticism.
- Failed strategies: Data substitution failed across twelve iterations because agents preferred conflicting local files over increasingly realistic web dashboards.Visual polish, plausible cover stories, and small numerical differences did not overcome the preference for local data.
- Model dependence: Hidden file-injection attacks produced model-dependent outcomes, with Sonnet detecting the mechanism through import-chain inspection and post-execution verification.GPT-5.1 was fully compromised, while Gemini detected symptoms but misattributed their cause.
- Breakthrough strategy: Compliance-fear framing succeeded by making correct local credentials or account details appear compromised or sanctioned.The agent switched to attacker-provided alternatives because it feared regulatory or security consequences, not because it trusted the web source.
- Severity calibration: Only high-severity alerts succeeded, whereas moderate risk scores and low-severity advisories were rejected.Successful examples used OFAC freezes, sanctions flags, or critical CVEs with CVSS 9.8 and confirmed exploitation.
- Attack structure: A single high-severity alert was more effective than simultaneous alerts across all dashboards, which triggered meta-skepticism.The optimal structure left other sources clean while concentrating the warning on the relevant dashboard.
- Core insight: The attack surface is trust boundaries rather than data boundaries: successful attacks changed interpretation without directly replacing the data.Direct substitution failed, while compliance framing succeeded by altering the context applied to correct information.
B.4 Observed Defense Boundaries
Observed defenses reveal both robust boundaries and generalizable attack principles. Sonnet refuses several high-risk actions, but agents remain vulnerable when adversaries exploit specificity, corroboration, workflow alignment, or compliance framing within realistic workspaces.
- Defense boundaries: Sonnet categorically refused unknown recipients, destructive file operations, and credential forwarding to personal channels.These refusals held across authority levels, urgency framing, compliance claims, and attack vectors.
- Model differences: Other models were more susceptible to credential-forwarding and destructive-action tests than Sonnet.Preliminary GPT-5.1 and Gemini 2.5 Pro testing found weaker defenses, while Sonnet’s protections included import-chain inspection and post-execution verification.
- General principles: Operational specificity beats authority: exact file paths, field names, and output formats can succeed where vague executive requests fail.A precise skill mapping service-registry.json to a processing reference succeeded despite lower organizational authority being irrelevant.
- General principles: Corroboration beats sophistication because attacks distributed across five independent sources can bypass single-source fraud detection.The relevant defense is workspace-wide consistency, so compromising consensus is more effective than perfecting one message.
- General principles: Workflow-aligned additions outperform novel requests because they preserve the agent’s ongoing task while altering its output.The most effective attacks remain invisible in the agent’s action pattern and change only what the task includes.
- General principles: Web attacks succeed through regulatory or security fear rather than ordinary trust in the source.Agents are more susceptible to warnings that existing credentials or values pose compliance risks than to instructions simply requesting replacement values.
- Benchmark construction: Realistic scenarios require sufficiently complex workspaces to prevent trivial detection through sparse context.Development observations found that fewer than 30 files or fewer than 10 emails made adversarial content conspicuous, while unstylized web pages were dismissed.
C Qualitative Case Studies
The case studies expose distinct mechanisms behind aggregate attack results, including operationally precise exfiltration, mechanism-level detection gaps, role-sensitive email trust, compliance reframing, and provenance-dependent script inspection.
- Case 1: Operational specificity as stealth exfiltration: A privileged skill file induced Sonnet to embed five honey tokens in a CFO email draft without triggering safety mechanisms.The instruction used operational language, aligned with an ongoing task, and occupied a namespace treated as configuration.
- Case 1: Operational specificity as stealth exfiltration: The skill attack exploited a structural tension between faithful workspace-instruction execution and instruction-provenance verification.The same capability that supports useful agent behavior also allowed adversarial procedural guidance to be followed.
- Case 2: Mechanism detection vs. symptom detection: Sonnet detected a hidden file modification that Gemini noticed only as a symptom and GPT-5.1 missed entirely.Sonnet traced the import chain, verified post-execution state, and refused the altered values; Gemini proceeded after attributing the discrepancy to data entry.
- Case 3: Operational relevance outweighs organizational authority: A Treasurer’s operationally plausible request succeeded where a broader CFO request failed, establishing operational peer trust above organizational rank.The reported hierarchy was operational peer > organizational superior > junior staff > system emails.
- Case 4: Compliance fear as context reframing: Fabricated OFAC alerts succeeded by reframing correct local data as a compliance risk rather than by making the web source trustworthy.This case instantiates context manipulation as the effective web-injection mechanism.
- Case 5: File provenance as an implicit trust signal: Sonnet inspected a new trojan file but ran an equivalent trojan when existing documentation made the script appear established.File provenance therefore functioned as an implicit trust signal in otherwise similar skill-injection cases.