Known Threats to OpenClaw Agents
Every confirmed threat to OpenClaw agent deployments, tracked and monitored by HeartbeatGuard.
1 active threat with no available patch
HeartbeatGuard monitors for these threats in real-time. Update OpenClaw to 3.13 for all available patches.
WordPress OAuth Redirect Hijacking
Attacker poisons OAuth Redirect URIs through compromised WordPress callback endpoints. When agent initiates OAuth flow (QuickBooks, GoHighLevel, Gmail), auth code is intercepted. Attacker exchanges code for full access token.
HBG Detection:
OAuth flow monitoring — tracks redirect URIs registered for each integration, alerts on unexpected URI changes or OAuth flows that don't complete.
kugelfang / SOUL.md Backdoor
Attacker socially engineers agent to rewrite its own identity config with hidden execution modes. Persists across reinstalls via workspace files.
HBG Detection:
File integrity monitoring — alerts when SOUL.md or any critical agent file is modified unexpectedly.
WebSocket Session Hijacking
Attacker on same network hijacks authenticated WebSocket session, gains admin gateway access without credentials.
HBG Detection:
Connection anomaly monitoring — flags unexpected new connections or session source changes.
Shared-Token Privilege Escalation
Device-less shared-token operators self-declare elevated scopes including admin.
HBG Detection:
Token scope auditing — verifies declared scopes match permitted scopes.
Sandbox Escape via session_status
Sandboxed subagents access parent session metadata and write parent model overrides — breaking isolation boundary.
HBG Detection:
Subagent boundary monitoring — tracks cross-session metadata access attempts.
Unicode Command Spoofing
Invisible Unicode zero-width characters hide actual command content in exec approval prompts. User approves one thing; agent runs another.
HBG Detection:
Exec approval audit log — records actual executed commands vs. displayed commands.
Log Deletion / Evidence Destruction
Compromised agent deletes its own activity logs to destroy evidence of compromise. No OpenClaw patch can prevent an agent from taking actions it's been authorized to take.
HBG Detection:
External log mirroring — HBG maintains an independent activity log that the agent cannot access or modify.
Agent-to-Agent Infection
Compromised agent spreads modified behavior to peer agents through normal inter-agent communication channels.
HBG Detection:
Behavioral baseline monitoring — detects when an agent's response patterns deviate from its established baseline.
Exec Allowlist Bypass
POSIX case-sensitivity + glob behavior let allowlist patterns overmatch executables across directory boundaries.
HBG Detection:
Allowlist validation audit — verifies allowlist patterns match only their intended targets.
Implicit Plugin Auto-Execution
Workspace plugins auto-loaded without trust decision — cloned repos could execute plugin code silently.
HBG Detection:
Plugin trust registry — tracks all loaded plugins, flags any loaded without explicit approval.
Plaintext Pairing Credentials
QR/chat pairing tokens embedded live gateway credentials — reusable if captured.
HBG Detection:
Token lifecycle monitoring — tracks pairing token issuance and usage.
/config + /debug Unauthorized Access
Non-owner authorized senders could access owner-only gateway configuration surfaces.
HBG Detection:
Access control audit — verifies owner-only routes enforce ownership at runtime.
Research Queue — Emerging Threats
Threats under active investigation. Not yet confirmed in the wild.
- ○Chrome session hijacking via agent browser automation
- ○Memory poisoning through compacted context injection
- ○Multi-agent cascade compromise
- ○Prompt injection via external data sources (emails, documents, web pages)
- ○Supply chain attacks on OpenClaw skills/plugins
HeartbeatGuard monitors for all threats in this catalog
New detections are added within 48 hours of a new threat being confirmed. Free. No credit card.
Start Monitoring →