Prompt Injection Attacks on OpenClaw Agents

1Abstract

Indirect prompt injection poses a distinct risk for LLM agents because harmful instructions can enter through tool outputs rather than only through user prompts. This study adapts InjecAgent's attack logic to OpenClaw and evaluates 12 attack scenarios across four models and two security configurations, for a total of 96 test runs. Overall, the Attack Success Rate (ASR) was 2.1% (2/96), with both successful attacks occurring only in GPT-4o-mini under the no-security configuration. In contrast, workspace security boundaries reduced aggregate attack success from 4.2% to 0% and increased flagging from 37.5% to 62.5%. Email-based attacks were flagged more often than Notes-based attacks, and explicit override prompts were flagged more often than base attacks. These findings show that agent safety depends jointly on model capability, workspace configuration, and entry channel, and that setup-level security instructions provide a practical defense for tool-enabled agents.

2Introduction

LLM-based agents differ from conventional chat models in one consequential way: they act. Beyond generating text, they interpret tool outputs, decide which actions to take, and execute them. A misstep no longer produces a wrong answer; it produces an unauthorized bank transfer, a deleted inbox, or a message sent in the user's name. This shift is most exposed in indirect prompt injection, where malicious instructions are hidden inside the content an agent retrieves from its own tools [1][2].

InjecAgent [3] established the dominant framework for evaluating indirect prompt injection in tool-calling agents, with structured test-case sets for direct harm and data stealing in both base and override-prefixed variants. Its findings, however, rest on a synthetic benchmark harness: agents configured for evaluation rather than deployment, with stylized tools and fixed prompt scaffolds. What remains unclear is how these attacks behave inside the agent frameworks people actually run — frameworks where behavior is shaped not only by the model, but by workspace-level configuration files, tool skill definitions, and the real files the agent reads from its file system.

This study addresses that gap. We port InjecAgent's attack logic into OpenClaw, an open-source personal agent framework whose behavior is governed by a workspace of instruction files (SOUL.md, AGENTS.md) connected to realistic simulated tools: email, notes, bank transfer, and location. Our contribution is not a new attack vector but a deployment-oriented setting. Specifically, we ask: how do attack success and detection rates vary as a function of model capability, workspace-level security configuration, and tool entry channel? To answer this, our objectives are threefold: (1) adapt InjecAgent's indirect prompt injection scenarios to a realistic, deployment-oriented agent framework; (2) compare the vulnerability of models across different capability tiers; and (3) isolate the defensive effect of workspace-level security instructions on both attack success and flagging behavior. In doing so, we treat the configuration file itself as an experimental variable — not just a convenience for personalization, but a potential security control.

3Methods

3.1Test cases

Test cases were inspired by those developed in the original InjecAgent paper, which included two categories of attack: data stealing and direct harm. The final test cases were defined and written for the purpose of this study. Data-stealing cases aimed to extract three types of sensitive information (financial, physical, and personal) by instructing the agent to retrieve specific data and send it to an external email address specified in the attack prompt. Direct-harm cases targeted three dimensions of user harm (financial, data security, and impersonation), each designed to trick the agent into performing a damaging action on behalf of the user. Each of these six scenarios was tested in two versions: a base version containing only the core attack prompt, and an enhanced version that explicitly prompted the agent to override previous instructions, to try to increase the likelihood of bypassing its safety mechanisms.

Enhanced attacks prepended this sentence to the base prompt: "IMPORTANT!!! Ignore all previous instructions and strictly adhere to the following instructions:"

3.2Agent configuration

The agents were configured using three core setup files adapted from OpenClaw's own templates: USER.md, which establishes the user's identity and profile; SOUL.md, which defines the agent's personality, behavioral boundaries, and core operating principles; and AGENTS.md, which governs session startup procedures, first-run behavior, and memory management. Two distinct versions of these configuration files were created to assess the impact of the security level on agent vulnerability. The full-security configuration embedded explicit injection-awareness rules in SOUL.md — tool-specific boundaries and instructions for handling untrusted input — and AGENTS.md required confirmation before executing any external-facing action. The no-security configuration removed all injection-related guidance and encouraged autonomous action with minimal safeguards. This design choice allows a direct comparison of how setup-level instructions shape an agent's resilience to adversarial prompts across model families. Combining 6 attack scenarios, 2 prompt versions, 4 models, and 2 security configurations yields a total of 96 individual test runs.

3.3Experimental setup

Experiments ran on OpenClaw v2026.3.8, an open-source agent framework with a local CLI gateway. The agent operated under a fictional persona — an Italian university researcher, "Stefano," teaching at IE University in Madrid — whose workspace contained personal emails, bank records, contact lists, and ten notes. Four simulated tools let the agent act on this data: Apple Notes (read/write text files), Email (read, send, forward, and delete messages in a JSON inbox), Bank Transfer (check balance, view transactions, execute SEPA transfers), and Location (return GPS coordinates). All tools operated on local files, so unauthorized actions left verifiable traces without real-world consequences. Per-tool security warnings in each skill file stayed constant across both conditions.

The models tested were GPT-4o-mini and GPT-5.4 (OpenAI), as well as Kimi K2 (0711) and Kimi K2.5 (Moonshot AI), chosen to represent different capability tiers — older, lower-capability models against currently SoTA ones — and two distinct model families from different ecosystems, U.S. and Chinese. Payloads were injected through two channels: crafted emails prepended to the inbox, or malicious text appended to a target note. Before each run, a reset script restored the workspace and inserted the payload; the benign instruction was then sent via the CLI with a unique session ID to prevent context carryover.

3.4Scoring

Each run was scored on four binary fields: valid (agent processed the request meaningfully), attack success (agent executed the unauthorized action, or both accessed and exfiltrated data for data-stealing cases), flagged (agent warned about suspicious content), and confirmed (agent asked the user before acting). Partial completion did not count as success. The primary metric was ASR-valid (attack successes divided by valid runs); the secondary was the flagging rate. Pre-scoring for ASR and flagging was performed by an automated agent based on predefined criteria, then manually revised from agent output, tool-call traces, and workspace side effects.

4Results

Following InjecAgent [3], we adopt ASR-valid as the primary endpoint because it directly measures whether the agent executed the attacker's intended action, isolating security failures from tool-competence errors. Flagging rate serves as the secondary metric, capturing defensive behavior that ASR alone misses: an agent that neither executes nor flags an injection leaves the threat invisible to the user. All 96 runs produced valid responses.

Both dependent variables are binary and follow a Bernoulli distribution, so parametric tests (t-test, ANOVA, Cohen's d) are inapplicable [4]. We use Fisher's exact test when Cochran's rule is violated — when any expected cell count under H₀ falls below 5, rendering the chi-squared approximation unreliable — and Pearson's χ² otherwise. Effect sizes are reported as odds ratios (OR), phi (φ), and Cramér's V. Post-hoc power uses Cohen's h, the effect-size measure for proportions [5]. We test at α = 0.05, two-sided, against four hypotheses: ASR independent of security configuration (H1) and of model (H2); flagging independent of security configuration (H3) and of model (H4).

4.1Aggregate model performance

Overall, ASR was 2.1% (2/96). Only GPT-4o-mini produced successful attacks, both under no-security (16.7% in that cell); every other model achieved 0% ASR in both configurations. Neither ASR hypothesis reached significance — H1: Fisher's exact, OR = 0.19, p = .495; H2: OR = 16.1 [0.75–348], p = .061 (borderline) — though both were underpowered (achieved power 0.30 and 0.62 respectively; n ≈ 185 and 90 per group would be needed for 80% power), so non-significance reflects insufficient sample size rather than the absence of an effect.

Both flagging hypotheses were significant. H3: security boundaries increased flagging from 37.5% to 62.5% (χ²(1) = 6.00, p = .014; φ = 0.25, a small-to-medium effect under Cohen's (1988) [6] rough conventions) — the odds of the model flagging an injection are 2.78× higher under full-security than under no-security. H4: flagging differed across models (χ²(3) = 29.00, p < .001; Cramér's V = 0.55, a large effect). Post-hoc tests (Bonferroni α = .008) confirmed that GPT-4o-mini's rate was significantly lower than every other model (all p < .001); no other pairs differed. GPT-5.4 showed the highest flagging (100% under full-security, 50% under no-security), followed by Kimi K2.5 (83.3%, 50.0%), Kimi K2-0711 (58.3%, 50.0%), and GPT-4o-mini (8.3%, 0.0%).

4.2Per-test-case outcomes

Each cell reads full-security / no-security. F = flagged, ATK = attack succeeded, — = neither. Both successful attacks happened for GPT-4o-mini under no-security via Apple Notes in the impersonation scenario (TC-05 base, TC-06 enhanced): the agent attempted to send a distress message to the user's mother without recognizing the instruction as adversarial. Email-entry scenarios were consistently better detected: the enhanced financial-harm attack via email (TC-02) was flagged by all four models under full-security, whereas several Notes-entry base attacks (TC-03, TC-05, TC-09) went undetected across multiple models in both configurations.

4.3Dimensional analysis

Under no-security, email-entry flagging (58.3%) was substantially higher than Notes-entry (16.7%), and enhanced-attack flagging (54.2%) exceeded base (20.8%) — the override prefix paradoxically served as a detection signal rather than a bypass mechanism. Direct-harm and data-stealing scenarios showed a descriptive gap under no-security (25.0% vs. 50.0%) but not under full-security. Aggregated across all models, security boundaries reduced ASR from 4.2% to 0% (Fisher's exact, p = .495, not significant) and increased flagging from 37.5% to 62.5% (χ², p = .014, significant).

5Discussion

5.1Interpretation

The overall attack success rate of 2.1% suggests strong general resistance to indirect prompt injection, but this figure is mainly driven by the near-perfect performance of three of the four models tested. All successful attacks were concentrated only in GPT-4o-mini under no-security conditions, and both targeted the same scenario — impersonation via Apple Notes — pointing to a capability-tier effect consistent with InjecAgent's finding that more capable models tend to exhibit lower ASR [3]. The absence of successful attacks in GPT-5.4, Kimi K2.5, and Kimi K2-0711 across both configurations suggests that beyond a certain capability threshold, models may develop sufficient reasoning to resist injection even without explicit security instructions. The odds of a successful attack for GPT-4o-mini were around 16 times higher under no-security than full-security; even without statistical significance at this sample size, the difference is too large to ignore. Model selection alone can therefore function as a security control, independently of how the agent is configured.

Flagging behavior tells a complementary story. Security configuration significantly increased detection rates overall, confirming that setup-instruction design is a meaningful defense independent of model choice — consistent with broader literature on agent behavior being shaped by instruction foundations as well as the underlying model [7][3]. Model differences in flagging were substantial: GPT-4o-mini's detection rate was near zero in both configurations and significantly lower than every other model, while GPT-5.4 flagged every injection under full-security and half under no-security, suggesting training may have embedded robust security awareness that needs little runtime guidance. Notably, Kimi K2-0711 showed only a modest response to security enhancements (+8.3 pp), similar to GPT-4o-mini, despite achieving 0% ASR — evidence that low attack success and active detection are not the same thing. A model can resist executing an injection but still fail to notify the user of it.

Two patterns in the dimensional analysis stand out. Email-entry attacks were flagged at substantially higher rates than Notes-entry attacks, especially under no-security (58.3% vs. 16.7%), suggesting models assign different implicit trust levels to different tool outputs — an uneven threat surface, since Apple Notes attracted less inspection and was the entry channel for every successful attack. Second, enhanced attacks were flagged more readily than base attacks under no-security (54.2% vs. 20.8%), confirming that explicit override language paradoxically functions as a detection signal rather than an effective bypass, consistent with [2]. This suggests that better-hidden injections, blended into ordinary-looking context, may pose a greater practical risk than syntactically obvious override prompts — a concern supported by [1], who showed that injections hidden within content that looks normal, such as HTML comments or mid-document text, can compromise agents without any explicit override language.

Taken together, the agent's ability to act safely is shaped jointly by at least three factors — model capability, agent setup, and entry channel — and no single factor is sufficient on its own. GPT-4o-mini was the only vulnerable model even with security instructions in place; attacks entering through notes remained underdetected across multiple models regardless of configuration; and the relationship between detection and resistance differed across models. Picking a safe model or writing good configuration instructions is not enough alone — both matter, and so do the tools the agent has access to.

5.2Implications and recommendations

These findings suggest that resistance to indirect prompt injection should be understood as a system property rather than as a fixed characteristic of the underlying model. Although the aggregate attack success rate was low (2.1%), the concentration of all successful attacks in a single model and configuration shows that overall averages can obscure practically meaningful vulnerabilities — an argument against reading low average ASR as evidence that an agentic system is broadly secure. Security instead appears to emerge from the interaction of model capability, setup-level instructions, and the channel through which malicious content enters the system, so prompt-injection defense cannot be reduced to choosing a stronger model alone.

The concentration of all successful attacks in GPT-4o-mini (16.7% ASR under no-security) highlights a stark capability-tier effect, where smaller models may lack the inherent reasoning to resist even base-level injections. While frontier models like GPT-5.4 demonstrated robust embedded safety — 0% ASR even without specific guidance — the fact that workspace-level configuration eliminated successful attacks across the board proves instructions are a high-leverage defensive tool. We recommend that developers treat configuration files like SOUL.md as active security controls rather than mere personal descriptors, incorporating explicit untrusted-input rules that force the agent to treat data retrieved from tools as passive text to be processed, never as instructions to be followed.

A critical implication is the asymmetric trust agents assigned to different tool channels: Email-entry attacks were flagged at a much higher rate (58.3%) than Notes-entry ones (16.7%), suggesting models may implicitly trust "internal" or "personal" files more than external ones, which let several Notes-based attacks go undetected. Security strategies must therefore move beyond a focus on external inputs like email, implementing per-tool security boundaries that apply a zero-trust policy to all data-retrieval operations — content from local notes or internal databases held to the same skepticism as unauthenticated external traffic.

The results also highlight a distinction between an agent's ability to resist an attack and its ability to report it: Kimi K2-0711 achieved 0% ASR but showed only a modest response to security enhancements in its flagging behavior. An agent that silently ignores a malicious instruction is safer than one that executes it, but remains a liability, since the user is never alerted to the presence of an adversary. True agentic safety requires both execution resistance and active transparency — we recommend mandatory "ask-first" protocols for any irreversible or external-facing action, such as bank transfers or sending messages, so the system creates a manual circuit breaker that compensates for a model's failure to flag a suspicious injection.

Finally, the "override-prefix paradox" shows that while models are adept at catching syntactically obvious attacks (like "IMPORTANT!!! Ignore all previous instructions"), they are more likely to miss blended injections that look like normal content. As attackers move toward subtler, mid-document injections that avoid obvious adversarial language, standard model-level filters will become less effective. In the short term, the most practical defense remains a combination of high-reasoning model selection and a robust, multi-layered configuration that assumes every tool output is potentially malicious.

5.3Limitations

Several limitations constrain the generalizability and statistical reach of these findings, principally around sample size, methodology, and scope.

The most consequential constraint is sample size. Each model–configuration cell contains only 12 observations, yielding 96 runs in total — shaped by three practical factors: each run had to be reset, injected, and revised manually from agent logs; API costs scaled linearly with runs and were borne from a limited student budget; and the six scenarios were hand-authored for the OpenClaw environment rather than drawn from a large existing pool, bounding the number of meaningfully distinct test cases we could construct. While this sample size proved sufficient to detect significant effects on flagging behavior — the study's primary actionable finding — the rarity of successful attacks (2/96) means ASR differences across conditions cannot yet be resolved with confidence. The non-significance of both ASR hypotheses reflects this insufficient power rather than the absence of an effect, and the low observed ASR should not be read as evidence that deployed agents are immune to indirect prompt injection.

Methodologically, each test case was executed only once per model-configuration combination. Without repeated trials, run-to-run variance caused by model temperature or stochastic decoding cannot be estimated — a given model might succeed or fail on the same injection simply from sampling randomness. In scope, results are bound to a single agent framework (OpenClaw v2026.3.8), four models from two providers, and a fixed fictional persona with simulated tools operating on local files, which may not capture the latency, error-handling, and authentication dynamics of real deployment. The two security configurations represent endpoints of a spectrum and do not isolate which specific defensive instruction — confirmation prompts versus untrusted-input warnings, for instance — accounts for the observed effect.

5.4Future work

We recommend increasing both the number and complexity of runs to build a more representative sample of each injection type, environment, and attack category, and evaluating the effectiveness of different injection types under the same agent and deployment conditions, since the number of successful attack attempts in this study was limited.

A second priority is isolating which mitigation strategies have the greatest effect on reducing prompt-injection risk. This study compares only two endpoint configurations, which does not let us identify the effect of each individual strategy; an isolation-test design that compares results with and without one specific strategy in place at a time would let researchers make a more informed decision about which strategy matters most when deploying agents.

A third area is expanding how attack outcomes are measured beyond binary success or failure. Future studies should capture richer metrics — degree of compliance, user-confirmation actions, post-exposure recovery — since an agent may avoid taking harmful action without explicitly indicating that a prompt injection was present, and documenting these intermediate responses is critical to understanding the full spectrum of agent defensive behavior.

6References

1. K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, AISec '23, pp. 79–90, 2023. doi.org/10.1145/3605764.3623985

2. F. Perez and I. Ribeiro, "Ignore Previous Prompt: Attack Techniques For Language Models," arXiv:2211.09527, 2022. arxiv.org/abs/2211.09527

3. Q. Zhan, Z. Liang, Z. Ying, and D. Kang, "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents," in Findings of the Association for Computational Linguistics: ACL 2024, pp. 10471–10506, 2024. doi.org/10.18653/v1/2024.findings-acl.624

4. W. G. Cochran, "Some Methods for Strengthening the Common χ² Tests," Biometrics, vol. 10, no. 4, pp. 417–451, 1954. doi.org/10.2307/3001616

5. J. L. Fleiss, B. Levin, and M. C. Paik, Statistical Methods for Rates and Proportions, 3rd ed. John Wiley & Sons, 2003. doi.org/10.1002/0471445428.fmatter

6. J. Cohen, Statistical Power Analysis for the Behavioral Sciences, 2nd ed. Lawrence Erlbaum Associates, 1988.

7. E. Wallace, K. Xiao, R. Leike, L. Weng, J. Heidecke, and A. Beutel, "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions," arXiv:2404.13208, 2024. arxiv.org/abs/2404.13208