Pwning OpenClaw and Other Agents with Prompt Laundering (ironcorelabs.com)

A recent blog post details a novel security vulnerability discovered in OpenClaw, an AI agent that gained significant popularity due to its integration with various services. The author, who aimed to assess the security implications of OpenClaw's capabilities, initially attempted to launch direct prompt injection attacks via email but faced challenges due to significant advancements in AI model security, particularly with ChatGPT 5.4. Despite earlier vulnerabilities, OpenClaw had made notable improvements by implementing security measures such as untrusted content tagging, drastically reducing the success rate of prompt injections from 20% to 0.2%. What emerged as particularly alarming was the concept of "prompt laundering." The author found that even when initial attack attempts were flagged as suspicious, the AI agent saved the content in its long-term memory, stripped of its warnings and indicators of untrustworthiness. This allowed malicious instructions to bypass oversight, effectively enabling the attacker to manipulate the agent's operations without alerting the user. By leveraging this technique, the author succeeded in tricking OpenClaw into executing commands from an ostensibly trusted email address, demonstrating severe implications for data security in AI integrations and highlighting the necessity for ongoing vigilance and enhancement in AI security frameworks.