The paper collects untrusted practitioner discussions about local execution, token handling, tool access and prompts, then codes reported issues against CWE categories. Multiple weakness labels may arise from one issue and discussions may include unresolved allegations. The authors screened more than 25,000 Reddit posts and retained 162 security-relevant…
Inspect the ClaimsCase · DiggingBeagle record
OpenClaw complaint study classified reported weaknesses without verifying 521 exploits
Researchers analyzed user reports and GitHub security issues to map recurring agent trust-boundary concerns, not verified compromises.
Scope
Reported forum complaints and an illustrative synthetic-secret walkthrough are not a validated sample of exploit success or affected users.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
The researchers manually categorize Reddit discussion and GitHub issue reports into CWE instances, plus a dummy-secret demonstration. The 521 weakness labels and 180 retained issues are a taxonomy of reported concerns, not 521 confirmed exploited vulnerabilities. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-030-A · CLM-CP22-030-B · CLM-ENRICH-20261028-009 · Then There Is Prompt Injection: The Wild Wide West of OpenClaw Agentic System Security
At a glance
Independent reproduction, issue closure status and deduplication against already documented advisories remain unverified.
Limits and uncertaintyFull account
The paper collects untrusted practitioner discussions about local execution, token handling, tool access and prompts, then codes reported issues against CWE categories. Multiple weakness labels may arise from one issue and discussions may include unresolved allegations.
The authors screened more than 25,000 Reddit posts and retained 162 security-relevant posts with 1,787 associated comments. They retained 180 of 358 GitHub security-tagged issues and coded 521 weakness instances across 59 CWE types, which are classifications rather than 521 independently exploited vulnerabilities. Primary evidence.
Reported forum complaints and an illustrative synthetic-secret walkthrough are not a validated sample of exploit success or affected users.
Use the study to prioritize concrete trust-boundary tests, but link any claim of exploitation to an individually reproduced issue and affected version.
Claims & evidence
CLM-CP22-030-AThe authors screened more than 25,000 Reddit posts and retained 162 security-relevant posts with 1,787 associated comments.supported
Basis: reported finding
- supportsThen There Is Prompt Injection: The Wild Wide West of OpenClaw Agentic System Securityprimary disclosure
Abstract; Reddit corpus selection
CLM-CP22-030-BThey retained 180 of 358 GitHub security-tagged issues and coded 521 weakness instances across 59 CWE types, which are classifications rather than 521 independently exploited vulnerabilities.supported
Basis: reported finding
- supportsThen There Is Prompt Injection: The Wild Wide West of OpenClaw Agentic System Securityprimary disclosure
Abstract; GitHub issue selection and CWE mapping
CLM-ENRICH-20261028-009The authors report 543 practitioner mitigation suggestions clustered into seven strategies, but their illustrative reconstruction uses dummy secrets rather than reproducing all tagged issues.supported
Basis: reported finding
- supportsThen There Is Prompt Injection: The Wild Wide West of OpenClaw Agentic System Securityprimary disclosure
Abstract, empirical analysis and illustrative reconstruction
Controls and mitigations
- Use the study to prioritize concrete trust-boundary tests, but link any claim of exploitation to an individually reproduced issue and affected version.
Unknowns and contradictions
- Independent reproduction, issue closure status and deduplication against already documented advisories remain unverified.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199