OpenClaw agent-phishing disclosures

campaign · campaign:openclaw-prompt-injection-agent-phishing-2026

OpenClaw AI agent abuse research: indirect prompt injection (Imperva) and agent phishing (Varonis).

Coverage timeline

first 2026-06-12 → last 2026-06-12

Peak priority

notable

1 notable

Sources cited

3 hosts

Sections touched

research

Co-occurring entities

no co-occurrence

ATT&CK techniques

pinned v19.1 · see below

Hunting pivots

ATT&CK techniques

1 technique observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-06-12/imperva-and-varonis-indirect-prompt-injection-and-agent-phis · ATT&CK page ↗

Story timeline

2026-06-12Imperva and Varonis: indirect prompt injection and "agent phishing" against the OpenClaw AI agent — fixed in v2026.4.23, but the attack class generalises
research

Where this entity is cited

research1

Source distribution

attack.mitre.org1 (33%)
imperva.com1 (33%)
varonis.com1 (33%)

explore in graph

All cited sources (3)

Entries about OpenClaw agent-phishing disclosures (1)

2026-06-12 · view entry permalink →

NOTABLE

Imperva and Varonis: indirect prompt injection and "agent phishing" against the OpenClaw AI agent — fixed in v2026.4.23, but the attack class generalises

Two independent teams published complementary findings against OpenClaw, the self-hosted AI-agent platform that plugs into messaging systems, mailboxes, file systems and APIs. Imperva showed that shared contact names, vCard fields and location-pin labels flow into the LLM prompt with no untrusted-content boundary: a crafted contact — its injected command hidden behind 65 whitespace characters so the UI truncates it — executed python3 on the victim's host the moment the victim shared the contact with their agent (Imperva, 2026-06-10). Varonis demonstrated "agent phishing": a plain email from a plausible sender persuaded a mailbox-connected agent to forward mock AWS IAM keys and a customer export to an external address, with no exploit involved — the agent simply lacks sender-identity verification before acting (Varonis, 2026-06-09). Both teams note OpenClaw's default memory persistence lets one successful injection survive across sessions. The vendor fix (v2026.4.23) moves messaging-object metadata into a separate untrusted channel — but the structural lesson stands: wherever an agent ingests third-party-controlled strings (contacts, calendar invites, ticket bodies), that channel is an injection surface (T1059). Defender takeaway: pin OpenClaw ≥ v2026.4.23; inventory which AI agents hold mailbox send-permissions or shell access; gate agent-initiated outbound actions behind approval workflows the same way you gate privileged operations.

research12 Jun 05:00Zmulti-sourceOpen finding ↗

Sources: Imperva · Varonis