← Catalog
Research high discovered 2026-02-03

OpenClaw: Command & Control of an AI Agent via Prompt Injection

A booby-trapped webpage delivered an indirect prompt injection that made an autonomous AI agent silently execute a script, then plant persistent instructions into its future context — turning the agent itself into a command-and-control channel.

Execution Privilege Escalation Defense Evasion Discovery Persistence Command and Control

What happened

HiddenLayer demonstrated (MITRE ATLAS AML.CS0051) how a webpage can embed an indirect prompt injection that causes an autonomous AI agent — “OpenClaw” — to silently execute a malicious script. Once run, the script plants persistent malicious instructions into the agent’s future context, so the adversary retains control across later sessions.

This is one of the clearest examples of command-and-control on an AI agent: rather than a one-shot hijack, the attacker establishes durable tasking by poisoning the agent’s own memory, then discovers system information and drives the agent’s tools to act on their behalf over time.

Why it maps to ATLAS

  • AML.T0051.001 — LLM Prompt Injection: Indirect: the payload arrives via web content the agent browses.
  • AML.T0054 — LLM Jailbreak: guardrails are bypassed to get the agent to comply.
  • AML.T0069 — Discover LLM System Information (Discovery): the agent’s environment is enumerated.
  • AML.T0053 — AI Agent Tool Invocation: the injection drives the agent’s tools/script execution.
  • AML.T0080.001 — AI Agent Context Poisoning: Thread (Persistence): persistent instructions are planted in context.
  • AML.T0108 — AI Agent (Command & Control): the compromised agent becomes the C2 channel.

Detection notes

The novel risk here is persistence via context. Watch for the agent writing instructions into its own memory, for injected commands recovered from browsed pages, and for recurring attacker-directed behavior across sessions. Agent memory writes should be reviewable and revocable, and browsed content must never share a trust boundary with tool execution.

Detection

Log sources

  • Agent browsing / retrieved-content logs
  • Tool-invocation + script-execution traces
  • Agent memory / context-store writes

Signals

  • Injected instructions recovered from visited web content
  • Agent writing persistent instructions into its own memory/context
  • Recurring attacker-directed actions across later sessions (C2 behavior)

Mitigations

  • Treat browsed content as untrusted; isolate it from tool execution
  • Make agent memory/context writes reviewable and revocable
  • Constrain and confirm script execution; monitor for persistent tasking