OpenClaw: The hidden cyber risks lurking in AI

There’s a consistent pattern when new technology enters the world that it’s adopted by well-meaning employees trying to work faster, automate routine tasks, or simplify how they interact with systems and data, then risks start to show through the cracks. Autonomous AI tool,OpenClaw is a current example of this shift. 

OpenClaw opens more than one door 

OpenClaw is designed to help increase efficiency by connecting to applications, automating workflows, and carrying out actions on behalf of the person using it. While from a productivity perspective, the appeal is obvious, from a security and governance perspective it opens the door to a huge risk as organisations may not be structured to monitor or control this level of access and autonomy. 

Big cyber risks often come from trusted users unintentionally creating risk exposure through tools, integrations, or shortcuts that appear harmless at the time. When technology is deployed independently organisation can lose visibility over how data is accessed, shared, and acted upon. 

This is not a criticism of employees or innovation. In many cases, it reflects a gap between how quickly new tools can be adopted and how rapidly organisations should implement guardrails around them. 

So what does this mean for you?

The concern is not simply that these tools exist – it’s how well you manage them. As they’re designed to trust, interact and act on information they receive (including sensitive data), opportunities arise for attackers to influence and manipulate the data or instructions of  AI agent processes. Organisations may find that traditional controls, such as endpoint security, email filtering, and access management, do not fully address or manage the new extent that AI-driven automation tools can be exploited. 

At the same time, visibility into where autonomous AI agents are deployed is often limited. Many organisations currently lack the ability to identify which tools are in use, what applications they are connected to, and what permissions have been granted. Without this visibility, it becomes difficult to assess exposure, enforce policy, or respond effectively if misuse or compromise occurs. 

Addressing this challenge requires organisations to think beyond traditional cyber security controls. They must first understand where autonomous AI tools are being used, consider how to manage and restrict risky behaviour, and ultimately implement safeguards that ensure the AI tool can be used safely within the business. 

Over-influencing AI agents 

One of the most significant risks introduced by autonomous AI agents such as OpenClaw is prompt injection. Unlike traditional software, AI agents are designed to interpret and act on natural language instructions. This means they can be influenced not only by direct user commands, but also by information they are exposed to through connected systems such as email, messaging platforms, or collaboration tools. 

How? 

If an employee is using OpenClaw to help manage communications, automate responses, or summarise emails, the AI agent may be configured to read incoming messages and perform actions based on their content. This creates an opportunity for attackers to embed hidden or misleading instructions within otherwise legitimate-looking communications.

For example, an attacker may send an email that appears routine or business-related but contains language designed to influence how an AI agent interprets or processes the message. Because AI systems are built to follow instructions and extract meaning from text, they may treat these hidden prompts as legitimate operational instructions. Depending on how OpenClaw has been configured and what permissions it has been granted, this could result in the AI agent exposing sensitive information, triggering automated workflows, or interacting with business systems in ways the user did not intend.

The risk is amplified by the fact that the user may never see or recognise the embedded instruction. The AI agent may process the content in the background, acting on the manipulated prompt while appearing to operate normally. From an organisational perspective, this creates a new attack pathway that bypasses traditional security awareness, as the target is not just the employee, but the AI acting on their behalf. 

As organisations adopt AI-driven automation, prompt injection represents a shift in how social engineering attacks can be delivered and executed, requiring new approaches to detection, monitoring, and control. 

So, are we doomed? 

Not at all. Most enterprises already operate controls that, if consistently applied, materially reduce the likelihood that autonomous agents are deployed or misused, such as:

• Application control & endpoint management - Device management policies can prevent unapproved local installations of agent frameworks. This reduces shadow AI at the source.
• Network and web access controls - Secure web gateways, DNS filtering, and firewall policies can block unapproved repositories, extensions, and control channels that agents rely on.
• Identity, API, and integration governance - Strong identity controls, leas tprivilege access, conditional access, approval workflows for app registrations, and secrets hygiene limit what agents can do even when installed.
• Detection & telemetry - EDR/XDR and SIEM content tuned for automation behaviours can surface signals early.
• Data protection - Classification, DLP, and context aware access policies help keep sensitive data from leaving approved boundaries irrespective of whether a user or an agent initiates the action. 

What’s new is not the control set, it’s the use case. The winning move is to connect these existing capabilities into a coherent AI usage policy and control plane, with explicit guidance on where agents are allowed, how they’re configured, and how their actions are monitored.

If you are unsure if you have the controls in place, our cyber advisory or managed security services teams can and will support you, just get in touch with Kieran Baker.