OpenClaw agent skills suffer widespread vulnerabilities and data exfiltration
Cisco researchers identified critical security flaws in the OpenClaw agent ecosystem, affecting 26% of analyzed skills. The most notable failure involved a popular skill that exfiltrated user data via prompt injection.
The What Would Elon Do? skill used prompt injection to silently exfiltrate user data via curl to an attacker-controlled server.
Key facts
- What
- Cisco researchers identified critical security flaws in the OpenClaw agent ecosystem, affecting 26% of analyzed skills.
- Incident date
- Jan 28, 2026
- Who
- OpenClaw
- Failure mode
- Prompt Injection
- AI surface
- Agentic Workflow
- Severity
- Catastrophic
What happened
Cisco researchers identified that 26% of 31,000 analyzed OpenClaw agent skills contained vulnerabilities. The top-ranked skill, What Would Elon Do?, exfiltrated user data to an attacker-controlled server using prompt injection to trigger malicious actions. This demonstrates a fundamental weakness in the agentic AI supply chain and plugin autonomy.
What broke inside the model
- 01 · TriggerA third-party skill carries embedded instructions for the agent that runs it.
- 02 · Model stepThe agent executes the skill's code and prompts with its own privileges.
- 03 · Control gapSkills are not sandboxed; injected instructions can reach the network unchecked.
- 04 · FailureThe skill initiates unauthorized curl requests carrying local data.
- 05 · ConsequenceUser data exfiltrates from inside the agent runtime.
The failure stemmed from an insecure architecture that allowed third-party skills to execute code with the agent's privileges. Prompt injection enabled the skill to bypass constraints and initiate unauthorized network requests via curl for data exfiltration.
What it cost
Sources
- PrimaryPersonal AI Agents like OpenClaw Are a Security Nightmareblogs.cisco.com
- PrimaryOpenClaw's 230 Malicious Skills: What Agentic AI Supply Chains...authmind.com
Cite this entry
https://failureindex.ai/failures/openclaw-skills-suffer-widespread-vulnerabilities-exfilAI Failure Index. "OpenClaw agent skills suffer widespread vulnerabilities and data exfiltration" (FI-0243). Realm Labs. https://failureindex.ai/failures/openclaw-skills-suffer-widespread-vulnerabilities-exfil (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0243. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.