OpenClaw Is Just the Beginning: What You Need to Know About AI Agents

You’ve likely heard of OpenClaw by now, although maybe not for the reasons its creator originally intended. The autonomous AI agent made headlines across the internet earlier this year when a Meta employee—an AI safety and security researcher no less—posted about how OpenClaw began deleting all of her emails without her permission.

As it turned out, this was just the latest of a growing number of security incidents associated with OpenClaw. Yet despite experts calling it a security nightmare and even a “dumpster fire,” it still remains one of the fastest-growing repositories in GitHub—after reaching 135,000 stars within just weeks of its launch, OpenClaw now sits at over 346,000, making it the most-starred software on the platform.

What’s more, this momentum isn’t slowing. Gartner predicts that 40% of large enterprises will deploy autonomous AI agents by the end of 2026. Even so, many organizations still don't yet have a clear understanding of what these agents are, what makes them so uniquely vulnerable, or what specific threats they need to watch out for. So let’s get up to speed.

What are AI agents?

An AI agent is a system capable of autonomously reading data, connecting to tools, designing workflows, and completing tasks. They’re designed to act like an assistant that can not only perform the work you don’t want to do, but will know how and when to get that work done before you even have to ask.

This level of capability is what differentiates AI agents from large language models (LLMs) like ChatGPT and Claude. At its core, LLMs are conversation engines: You give them a prompt, they produce a response, and that's the end of the interaction. Agents can do all this, but can also interact with databases, APIs, web browsers, and other agents in order to figure out and execute next steps. Once the user sets a goal, the agent can call up the tools it needs to carry it out—all without requiring any human input. And it can do this all at machine speed, often even carrying out multiple actions at once.

This level of autonomy and interconnectedness is what makes AI agents so powerful. But it's also what makes them so difficult to secure.

What makes AI agents so vulnerable?

It’s not just their rising popularity that has made them such an attractive target for attack. AI agents also possess a unique mix of structural challenges that make it difficult to defend them against threats. 

Every tool and integration is a new potential point of access

Traditional software typically has a relatively defined perimeter. If you can control these access points, then you can secure the application. But AI agents work differently. Because they’re built to integrate into systems by connecting across APIs, databases, cloud services, and even other agents, they present an enormous attack surface. All of those connections represent a potential door for threats to come in. Even more concerning, each may also have their own unique weaknesses, making a comprehensive security strategy even more difficult.

AI agents don’t follow predictable patterns

Cybersecurity tools have long worked by recognizing patterns—such as malware signatures, suspicious traffic, and other anomalous behavior—then mitigating the threat. And this often works extremely well when there’s a defined logic to the software’s behavior that can be anticipated. Unfortunately, AI agents don’t have this.

Instead, they use a process called “inference” to predict the most likely output for a given context. By definition, inference is probabilistic, which means that it depends on whatever unique input it’s been given and therefore cannot be predicted. Because of this, it’s impossible to create rules that anticipate how an agent will respond in a specific situation, making traditional cybersecurity defense strategies ineffective.

AI agents are built to act entirely on their own

The ability to carry out autonomous actions is both a huge benefit of AI agents and a significant risk. In an ideal world, this capability will produce agents that work in the background to anticipate blockers, complete repetitive tasks, and improve productivity. However, as the example of OpenClaw has shown, this isn’t always the case. Left on their own, agents can delete important files, reveal sensitive content, or otherwise expose an organization to even more risk. 

While some organizations may try to get around this fact by requiring human approval before their agent takes any action, this goes against the entire purpose of an autonomous AI. (Just try approving 45 actions for one task within a 10-minute span to see how unfeasible this is.) And because the inference systems that power these agents make it difficult to figure out how they made their decisions, it’s not even possible to reverse engineer what they need, presenting an even starker obstacle for responsible use.

Specific threats you need to know

Understanding the structural issues is important. But when it comes to protecting your organization, you also need to know the specific attack types that threat actors are actively exploiting against AI agents today.

Prompt injection

These are one of the most pervasive and effective types of threats AI tools—both LLMs and agents—face. In a prompt injection attack, a hacker feeds the AI a malicious set of instructions (the prompt) that manipulate it to bypass any existing guardrails or system rules so that it will share sensitive data, grant access to closed systems, or otherwise cause it to behave in ways it wasn’t intended to.

This can be dangerous enough with LLMs, but it can be devastating with agents. That’s because AI agents don’t just share information, but actually carry out actions. WIth the right input, an attacker can compromise a workflow or even potentially take over an entire system.

Data poisoning and memory manipulation

This type of attack works similarly to prompt injections, except instead of using a malicious input, it uses a malicious set of data.

AI agents often rely on external datasets or data sources to help them learn how to reason and behave. So when an attacker is able to gain access to that source data, they can hide information inside of it that makes it produce flawed outputs. The result can disrupt workflows and make the agent easier to exploit. 

While closely related, memory manipulation targets the agent’s memory of what it has done. By planting false memories, attackers can change how the AI agent learns from its prior actions, causing it to behave in ways it otherwise would not. Like data poisoning, this can result in responses and behaviors that may harm the organization.

Privilege compromise

Because agents integrate so closely with the tools and data across a network, they often get granted excessive privileges. This attack works by taking advantage of this fact. 

Over-privileging can happen either by default (the result of an agent simply asking for access wherever it can in order to increase its usefulness) or because the people deploying the agent simply didn’t consider the consequences of not scoping. Either way, if an attacker gains access to the agent somehow, they’ll automatically inherit this access. They’ll then be able to send messages, read sensitive data, modify systems, and even grant themselves additional permissions as they move through the network—all of which can spell disaster for the organization.

Cascading failures

Most organizations don’t just operate a single agent in isolation. Instead, they use multiple agents, each in charge of a specific task or specialized workflow, that collaborate across a larger system. This can be incredibly effective and efficient, except when one agent becomes compromised. That’s because the security implications won’t just be limited to that agent. Instead, bad data and malicious instructions can get passed from one agent onto the next, becoming worse with each step. This kind of cascading failure can be difficult to detect and even harder to reverse, especially in fast-moving automated workflows where humans aren't involved.

AI agents aren’t going anywhere

Despite their security vulnerabilities, AI agents appear here to stay. This says that, at least for now, users appear more than willing to accept risk if it means getting significant productivity gains. 

So security teams have a choice. They can either treat AI agents as an outright threat—an approach that will probably be more likely to drive up rates of shadow AI across the organization—or they can start thinking of them as a new category that requires new approaches to oversight, access controls, and security education. 

Understanding the vulnerabilities of these agents is the first step. Knowing how to recognize prompt injection attempts, why memory poisoning is difficult to detect, and what over-privileged access looks like in practice will put your team in a position to make smarter decisions about how agents are deployed, governed, and monitored across your organization.

Get a head start on this process with Cybrary. Our comprehensive AI curriculum will help your team learn how AI functions on a technical level, how to apply security best practices at every stage of the adoption lifecycle, and how AI can be used and integrated into different security roles—among many other topics.