OpenClaw Made Crystal Clear · chapter 3: Security First, Not Last
The injection path
2026-10-22
Each stage has a real interruption point; none of them require trusting the model to notice the trick on its own.
Below: the paragraph from the book that builds this idea, then the diagram itself (Figure 3.2), and a recap. About a minute of reading.
That was not an isolated finding. IBM's X-Force threat intelligence team, in an April 2026 analysis credited to Sandra Hill and Christopher Ristig, counted over 255 GitHub Security Advisories filed against the OpenClaw ecosystem, covering command execution and leaked API credentials, and named two specific attack patterns researchers had already given labels to: "ClawJacked," indirect prompt injection used to hijack a running instance and exfiltrate data, and "ClawHavoc," a supply-chain campaign that distributed over 1,100 malicious skills disguised as legitimate ones. Separately, in March 2026, China's national CERT (CNCERT) issued a public warning, and researchers at PromptArmor documented a data exfiltration technique specific to chat-fronted agents: the agent can be manipulated into generating attacker-controlled links that leak confidential data the moment a chat client auto-fetches a link preview, no click required at all.
Recap
- The idea: Each stage has a real interruption point; none of them require trusting the model to notice the trick on its own.
- The picture: Figure 3.2, from chapter 3 ("Security First, Not Last") of OpenClaw Made Crystal Clear.
- Go deeper: the chapter builds this step by step, with recipes and sources at the end.
This diagram is one of many in OpenClaw Made Crystal Clear.
Every chapter opens with the gist, draws the hard ideas, and ends with recipes and sources.
Get the book
