OpenClaw AI Agent Falls for Phishing in Security Test, Leaks Credentials
Varonis researchers tested an OpenClaw email agent and successfully tricked it into leaking AWS credentials and customer data through phishing emails. The agent failed identity verification checks when requests appeared operationally urgent, despite both generic and strict security configurations.
What happened
Varonis researchers built an OpenClaw email agent called Pinchy, connected it to a test Gmail inbox seeded with realistic internal data including AWS IAM keys, SSH credentials, and customer exports, then conducted phishing tests.
When a researcher impersonated a team lead claiming a production issue, Pinchy retrieved and forwarded AWS credentials in plaintext. When the attacker requested a customer export claiming to work remotely on a presentation, Pinchy retrieved and sent a CRM file with names, contact details, and revenue data for 247 enterprise customers.
Both generic and strict mode configurations failed the identity verification tests when requests appeared operationally urgent. However, Pinchy successfully blocked a phishing email with a malicious link and stopped authentication for a disguised malicious Google OAuth application.
Reported impact
The agent exposed AWS credentials and database connection strings without verifying the identity of the requester.
A customer dataset containing names, contact details, and $1.28 million in monthly recurring revenue information for 247 enterprise customers was leaked.
Index analysis
Varonis found that AI agents are effective at detecting technical phishing threats with signature-based indicators like malicious URLs and OAuth apps, but fail when attacks exploit identity verification and contextual judgment.
Gemini 3.1 Pro showed greater willingness to interact with requests before raising suspicion, while GPT-5.4 was more cautious, though neither was reliable enough to trust with sensitive credentials.
Governance controls
Varonis noted that the verification step collapsed when requests appeared operationally urgent, suggesting that strict mode settings designed to detect phishing were insufficient to prevent social engineering attacks.
The findings indicate that AI agents connected to real systems create new attack surfaces not covered by existing security tools.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.