OpenClaw Security Risks: 6 Dangers of Autonomous AI Agents Transcript, AI Summary & Key Points

00:00 AI agents are all the rage. You can tell them what you want done and let them do all the dirty work to make it happen. It's as if you suddenly have a team of  personal assistants at your beck and call. One of the hottest technologies  in this space is a thing called OpenClaw that will let you run agents  locally on your laptop if you like. This capability is lowering the  barriers to entry in this base, making it possible for everyone to benefit.

00:26 But what is all this cool new stuff really? And what are the risks that could  result from using something like this? Well, as a wise comic strip character once said,  with great power comes great responsibility. So who's responsible for all of these powerful  agents and how can we use them responsibly? In this video, we're gonna take  a look at what is an AI agent, what is OpenClaw and six different  security risks to consider with this powerful technology so that  you can use it more securely.

00:59 Let's start off with digging into what  an AI agent really is under the hood. I think you mean under the bonnets, Jeff. Why can't they just speak English? Okay, anyway, what an agent is. Here's the simplest definition I can give you. It's a model, like a large language model,  using tools in a loop with autonomy. So it's a a model using tools  in a a loop autonomously.

01:29 That's an agent. Sounds great, right? What could possibly go wrong? Well, it turns out a lot. Let's inspect each component and see what I mean. So we start off with a model, large  language model, generative AI. You know what one of the issues are  that come along with these things? They hallucinate. So we have hallucinations. And no, you didn't think I was gonna  write all of that word out, did you?

01:53 Not when I have a magic  board that can auto-complete. So what are hallucinations? Those are unintentional errors. And with LLMs, they're very confident  when they make these errors. So if we start off with an error, and then  we run through the rest of this process, what do you think the results will be? They don't get better, is the answer. So that's one type of thing  that could happen here.

02:14 We could also poison the data  that goes into the model. So these models are based on data. We train and tune them on data, We  use other data sources to augment. What they know, we use other  data sources where the model may call out to get new fresh  information or store its state. So if that information gets  manipulated, that would be a problem.

02:39 Also, there's a thing called model infection, where the model just like  software can be infected. It can have actions in it or  information in it that was designed by someone to mess the system up. So that's another infection. Or risk vector that we have. So I told you it's models using tools. Well, the using part, how does it do this using? Well, there's a protocol  that's very common these days.

03:07 It's called MCP, Model Context Protocol. Well, now MCP is a brand new protocol. And as with any new protocol, there are going  to be security risks that go along with it. We're still discovering what some of those are. So I don't know what all of those will be. But there will be some that go along with that. And one of the things also in the using is  when I transfer or make a call out to a tool, am I transferring the identity credentials  and things like that from this?

03:37 If I do, then I potentially introduce secret information that's going  out to an untrusted source, but maybe I need that in order to log in to get  into that tool and have it do something for me. So there's a risk that goes along with it. The tools themselves, these things,  well, they could be malicious. They could be designed to do things that are bad.

04:01 We intended it for it to  do one thing, but in fact, somebody else has gotten into the tool and  now it's doing something very malicious. These things could also have bugs. So these would be unintentional kinds  of problems that would happen from this. So the tools themselves are an  expansion of the attack surface. Then, we're doing this in a loop.

04:23 So that's basically wash,  rinse, repeat with velocity. So we can do this really fast, potentially. And another thing, we're doing it with volume. So the velocity and volume, because this is  running in a loop, can happen very quickly. And as they say, to err is  human, to forgive divine. Well, a paraphrase of that is to err as human. But if you really want to  mess up, you need a computer.

04:51 That's something that shows an example of that. We make a mistake, and it just gets  amplified through this process. And then finally, the autonomy. The aspect that means that we have no human  in the loop could be a big problem for us. That means no oversight, meaning the error that  we introduced here, here, here, or amplified here, might just all be running out of control  unless someone can put the brakes.

05:18 So now we've looked at what an agent is and  what some of the general risks are for agents. Now let's take a look at OpenClaw. What is this thing? Well, first of all, what it  is, is it's a self-hosted, meaning you can run it on your  own system, your own laptop. It doesn't require a ton of power to do that. It's open source, meaning anybody can  see the source code that goes into it, which seems like that could be a good thing.

05:44 And it's an autonomous agent platform. And what it can do. Is why everybody's interested. It can read files. It can execute commands. It can access browsers. It can call APIs. It can act across multiple chat platforms. And here's the other interesting thing. It uses persistent credentials and memory. So all of this going in together, what  does that mean from a security standpoint?

06:13 Well, all of, this is a lot of powerful  stuff that we could potentially do. And this is potentially risky,  depending upon where it all goes. But a lot of people will argue, yeah,  but this is an open source system. So it's not really untrusted after all, because the whole world has had a chance  to look at this source code and examine it. So this really is not untrusting, is it?

06:38 Well, it is untrust. Because, in fact, there was an  open-source operating system, OpenBSD, where they recently found a bug in that. That was 27 years old. In other words, it's been hiding in plain sight  for almost three decades and none of you found it. So just because it's open source doesn't mean  all of the bugs have been run out of it yet. So we have to consider this is untrusted code.

07:05 Untrusted code running on your local system,  potentially under your privilege level. So with full privileges, if you're  running this under the admin ID on your laptop or under root or something like that, it's untrusted code running on  your system with full privileges. What is all of that? That spells risk in a big way. A lot of different things  could possibly go wrong if I look at all of these things it  could do from an untrusted system.

07:39 Okay, so we talked about risk, but what  kinds of risks am I talking about here? I've talked about the general risk for  AI agents, but let's double click here on OpenClaw specifically and see  what some of the risks might be. And note, this is by no means an exhaustive list, so this is just six that I'm  going to call out for you. Number one is one I already talked about,  that it's running in an untrusted environment.

08:02 It's untrusted code. So in fact, we've got untrusting code  execution, that is basically the skills. OpenClaw allows users to install skills from  public registries like ClawHub or GitHub. Installing a skill is effectively running  third party code with the agent's privileges. So that's your system level privileges,  if that's the ID you're running it under.

08:27 And multiple audits have found a  non-trivial percentage of malicious or vulnerable skills, as I mentioned earlier. So what could the impact be? Well, it could be arbitrary command execution. Meaning an attacker has your system running the  command of their choice, not of your choice. Could be credential theft. So now they know your passwords to get  into your system or to your other services.

08:50 It could be back doors that  persist across multiple sessions. So that makes them even more dangerous. Number two on the list,  indirect prompt injections. Here, we basically have content that is executing. So OpenClaw ingests untrusted texts  from web pages, from emails, from PDFs, from chat messages, and other sources,  and other agents even for that matter.

09:16 So attackers can embed instructions into that and  cause an agent to do things like leak secrets, execute commands, modify its own memory or rules. This is not hypothetical. Prompt injection driven compromise has  been demonstrated repeatedly in the wild. Number three on our list,  persistent memory poisoning. OpenClaw stores long-term memory  in things like a memory.md, identity.mD, these files maintain  this state over multiple executions.

09:50 So attackers can quietly alter  the state so that malicious instructions persist across multiple restarts. Number four on our lists,  credential exposure and reuse. OpenClaw commonly has access to things  like API keys, it has OAuth tokens, messaging platform secrets, cloud credentials, all kinds of secrets that would allow you  to get into and authenticate to a system.

10:18 And we've had many cases where we  found tens of thousands of exposed OpenClaw gateways leaking plain  text credentials or config files. That's bad news. Number five, autonomous action risk. Because this thing is running autonomously, it  means it could start off doing the right thing, but over time, it starts to drift into something  else and doing other things we didn't intend.

10:44 So OpenClaw can act without approval. It could chain tools together. It could decide to bring in other components  that maybe you didn't think about or realize. It could trigger background tasks. A single compromise can result in  self-directed lateral movement. That means the system is deciding. How it's going to move and move across the system that you had in mind and into other  areas that you did not have in mind.

11:10 It could do data exfiltration, take your  sensitive stuff and send it out to someone else. Or cost amplification attacks, a  lot of people don't think about. An API usage bombing is another  way of thinking about this. Someone hijacks your agent and causes it  to just chew up all kinds of resources on your system or eat up all of your  tokens, and that's costing you money.

11:32 And number six on our list is  host and workspace compromise. Remember, this is running on your system. That's part of the self-hosted component of this. If it's induced to execute malicious  commands, OpenClaw could modify host files, it could access SSH keys, it  could pivot to other systems. In fact, Microsoft explicitly  states OpenClaw should not be run on standard personal or enterprise  workstations for exactly this reason.

12:00 So now you know why you never wanna ask a  security guy what could possibly go wrong, because he's gonna tell you. So let's get this straight. I'm not saying you shouldn't use agents. In fact, I think we all stand to  benefit from these capabilities. This is really cool stuff. But don't just blindly dive in. Remember, if you're one of those  people that stores your passwords in an Excel spreadsheet, which is a terrible idea, I might add, but remember, an agent that  you've just installed on your system.

12:30 Might read those credentials. Since it can execute a browser, it could then go log on to your  bank's website and siphon off all of your money and then run a command  to delete all the files on your system. That would be a really bad day for you. So that's what I mean by elevated risk. So OpenClaw is powerful, but  it's also high risk by design. Remember some things that we need to consider.

12:58 Look at this and make it a more secure system. So the first thing is it's an untrusted code  that we're running with persistent credentials. So treat it with caution. We're running untrust stuff on your  system at your privilege level. That's a really risky thing to do. Also, we need to realize that exposing  this thing to the internet means it has access to information sources that  can also become an attack surface through indirect prompt injections.

13:28 Normally, we don't think of reading a webpage  to be an attack, but it could be in this case. So tool invocation also becomes exploit  amplification if we're not careful. Mistakes scale instantly because of the  ability for this thing to loop at speed. So never attach this to a sensitive identity, to sensitive data or production systems  without strong isolation and expect compromise.

13:57 This is something we get from  zero trust, assume breach. We're going to expect that the  system has already been breached. You explicitly engineer defenses  on those kinds of attacks. So build your security as if the  bad guy is already on your system. Now I've done some other videos  on things like architecting secure agents with MCP and applying zero  trust principles to agentic AI.

14:22 So take a look at those for some other ideas  so that you could make your security stronger. And then you can wade into the deep waters  gradually and avoid being a shark's breakfast.