Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations

2026-06-12

AI Summary

This study addresses critical security vulnerabilities in multi-agent large language model systems when performing privileged operations, particularly those arising from expanded attack surfaces, broken trust boundaries, and permission drift. For the first time, it quantifies the increased fragility introduced by output aggregation and exposes how single-point proposal mechanisms critically compromise system-wide security. Leveraging the self-hosted OpenClaw framework, the work introduces novel metrics—attack surface entropy, permission drift magnitude, and a compromise probability model—to rigorously evaluate defensive strategies such as policy gating and execution filtering. Experimental results demonstrate that these defenses significantly reduce both compromise probability and boundary failure by 0.10 each and permission drift by 0.02 (p<0.0001), with only a modest decline in task utility to 0.89 and an added latency of 468 ms.

Abstract

Agentic large language model (LLM) systems can now execute actions, not only produce text. When model outputs trigger privileged operations such as shell commands, browser automation, or external tool calls, the security problem shifts from alignment alone to system configuration and structural design. We analyze OpenClaw, a self-hosted multi-agent system in which LLM outputs can execute commands and interact with tools and services. We measure compromise probability, boundary failures, privilege drift, and how these metrics change as attacker capability increases. With one agent, the compromise probability is 0.24. With seven agents, when the system executes an action, the compromise rises to 0.86 if any single agent proposes it. The models do not change; the increase comes from output aggregation. Prompt injection propagates instability across the system. Attack surface entropy increases from 0.42 to 0.71, indicating a broader distribution of exploit paths. The mean privilege drift increases from 0.03 to 0.21, indicating unintended authority gain. Positive escalation curvature of 0.08 indicates that privilege grows faster as attacker capability increases. Defensive controls, including policy gating and execution filtering, reduce compromise probability by 0.10, boundary failures by 0.10, and privilege drift by 0.02, all statistically significant at p < 0.0001. The system remains sensitive, but the mitigation impact is measurable. Injection mitigation success differs across models: 0.37 for GPT-5.2, 0.35 for Llama-4-Maverick, and 0.31 for DeepSeek-R1. When execution can be triggered by any single agent, the most vulnerable agent determines system exposure. Mitigations slightly reduce task utility from 0.93 to 0.89 and increase median latency from 420 ms to 468 ms.

Problem

• attack surface expansion
• trust-boundary violations
• privilege drift
• prompt injection
• multi-agent LLM systems

Innovation

• attack surface entropy
• privilege drift
• output aggregation
• trust-boundary violation
• prompt injection propagation