Source-linked reporting, primary issue reports and security research. Every case distinguishes a reported event, a research finding and a confirmed breach.
Why it matters: if an assistant can run unrestricted host commands, a mistaken instruction may become a system change. Response: move sensitive actions behind independently enforced policies and operator review. OpenClaw default model ↗
Why it matters: researchers documented malicious marketplace skills that attempted credential theft or prompted dangerous installs. Response: scrutinize skills, restrict execution and network reach, and independently approve sensitive operations. Unit 42 research ↗
Why it matters: a user's reported inbox-deletion incident illustrates why intent in a prompt is not the same as an enforceable approval for destructive actions. The reported incident was not independently verified by TechCrunch. Incident chronology ↗
Why it matters: networks, sandboxes, resource budgets, approvals and audit logs may live in different control planes. Clawsolator's design goal is a readable, reproducible path from request to outcome. See the XMAN workflow ↗
What context compaction and missing independent authorization can mean for personal data.
What an unsandboxed same-user exec path can do to a multi-agent installation.
What happens when a third-party extension becomes the attacker’s route into a machine.
Exposure is not the same as compromise—but it broadens the attack surface.
We do not convert an allegation into a verified compromise. We do not describe a fixed issue as an active unpatched flaw. And we do not claim that a demonstration alone proves security.
Google Research indexes a 2026 study of session/state, tool execution, external content, channels and extensions.
OpenClaw publishes fixes and maintains explicit trust-model guidance; its security work is real and ongoing.
The Cloud Security Alliance outlines how externally sourced content can influence tool-capable agents.
The lesson is to build boundaries that keep working when the agent does not.
Reported unintended deletion illustrates why conversational rules are not an enforced destructive-action gate.
Read the email incident →A reported cross-agent delete shows how shared OS authority makes separate agent names a false security boundary.
Read the GitHub report →Research identifies internet-exposed installations; exposure is a risk marker, not proof that each installation was breached.
See exposure findings →Useful-looking extensions can carry unsafe commands. Skill review belongs before tools receive credentials or host capabilities.
Understand malicious skills →They show different failure modes, including reported unapproved actions, malicious extensions and exposed management surfaces. A report is not proof that every default installation is compromised; identify the exposure, version, action scope and evidence in each case.
Not by itself. If a connected email tool is authorized to delete messages, a container does not take away that service permission. Destructive API actions need their own scoped credentials, confirmation gates and independent policy checks.
Published incidents vary in evidence quality. Linking to primary advisories and original reporting lets engineers distinguish confirmed vulnerabilities from reported behavior and determine whether security updates or permissions would have changed the outcome.