OpenClaw AI agent vulnerabilities enable malicious skill packages to steal user data
Researchers demonstrated that OpenClaw AI agents are vulnerable to malicious skill packages that steal user credentials and personal data by posing as legitimate services. The vulnerability stems from the system's need for high permissions to function and the proliferation of third-party extensions from unofficial sources, leaving user information exposed to potential exfiltration.
What happened
Researchers at Beijing Jiaotong University demonstrated that OpenClaw AI agents are vulnerable to malicious skill packages that steal user credentials and personal information. In a test, a phishing website was embedded in a malicious skill package that, when accessed by the AI agent, captured user account credentials entered by the user.
The attack exploited OpenClaw's architecture: when given a command, the agent calls a large language model to interpret it, then executes the command using external skill packages by granting them elevated system permissions. Malicious skill packages can trick the model into opening phishing sites that harvest login credentials and personal data.
From March 2026, the Ministry of Industry and Information Technology and other Chinese government agencies issued risk warnings about OpenClaw-type agents. China Electronics Technology Standardization Research Institute experts noted that while mainstream agents improved security measures, third-party extension skill packages became a security vulnerability because users often download packages from unofficial sources without understanding the risks.
Reported impact
Users reported being trapped in a dilemma: limiting system permissions restricts agent functionality and usability, while granting high permissions necessary for complex tasks exposes personal information. The vulnerability creates a pattern of user behaviour where individuals face uncertainty about when their unintended privacy information may be exposed to third parties.
According to experts, once personal information is leaked through third-party skill packages, users cannot fully mitigate the damage. Many users experience a conflict between wanting to use the agent's functionality and fearing the privacy risks.
Index analysis
The root cause is the tension between functionality and security: OpenClaw requires high system permissions to perform complex tasks, but this same access enables malicious skill packages to exfiltrate data. Third-party extension packages introduce multiple points of interaction where unintended information could be shared with third parties.
The incident highlights gaps in user awareness and consent mechanisms: most users install software without reading privacy agreements and click through terms of service without understanding what permissions they grant or how data may be used by third parties. Privacy policy analysis found that while some agents align with regulatory requirements, the governance of third-party extensions remains inconsistent across products.
Governance controls
Researchers recommended users download skill packages only from official platforms to reduce risk. China Electronics Technology Standardization Research Institute experts emphasized that intelligent agents differ from traditional apps by mounting numerous external tools and skill packages, multiplying third-party interaction points and data leakage risk.
Proposed standards address agent security requirements, but implementation varies. The study suggested agents should obtain clear user consent before enabling external tools and skill packages, and that privacy agreements should explicitly detail which third parties can access which categories of user data.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.