{"id":"https://openalex.org/W7151949659","doi":"https://doi.org/10.48550/arxiv.2604.05589","title":"Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw","display_name":"Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw","publication_year":2026,"publication_date":"2026-04-07","ids":{"openalex":"https://openalex.org/W7151949659","doi":"https://doi.org/10.48550/arxiv.2604.05589"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.05589","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.05589","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.05589","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5025460867","display_name":"Jan Gruber","orcid":"https://orcid.org/0000-0003-1862-2900"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gruber, Jan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5052832324","display_name":"Jan-Niclas Hilgert","orcid":"https://orcid.org/0009-0000-5308-5712"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hilgert, Jan-Niclas","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9754999876022339,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9754999876022339,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.006200000178068876,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.005200000014156103,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/artifact","display_name":"Artifact (error)","score":0.6072999835014343},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5491999983787537},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.46970000863075256},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.4334000051021576},{"id":"https://openalex.org/keywords/abstraction","display_name":"Abstraction","score":0.36090001463890076},{"id":"https://openalex.org/keywords/empirical-evidence","display_name":"Empirical evidence","score":0.33899998664855957},{"id":"https://openalex.org/keywords/taxonomy","display_name":"Taxonomy (biology)","score":0.33799999952316284},{"id":"https://openalex.org/keywords/object","display_name":"Object (grammar)","score":0.33160001039505005}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6096000075340271},{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.6072999835014343},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5491999983787537},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.48899999260902405},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.46970000863075256},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.4334000051021576},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.36090001463890076},{"id":"https://openalex.org/C188147891","wikidata":"https://www.wikidata.org/wiki/Q147638","display_name":"Cognitive science","level":1,"score":0.3407000005245209},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.33899998664855957},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.33799999952316284},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.33160001039505005},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.3158000111579895},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.31220000982284546},{"id":"https://openalex.org/C2780966255","wikidata":"https://www.wikidata.org/wiki/Q5474306","display_name":"Foundation (evidence)","level":2,"score":0.3089999854564667},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.29820001125335693},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.2921999990940094},{"id":"https://openalex.org/C2776291640","wikidata":"https://www.wikidata.org/wiki/Q2912517","display_name":"Value (mathematics)","level":2,"score":0.289000004529953},{"id":"https://openalex.org/C140505726","wikidata":"https://www.wikidata.org/wiki/Q495304","display_name":"Forensic science","level":2,"score":0.2883000075817108},{"id":"https://openalex.org/C2781357168","wikidata":"https://www.wikidata.org/wiki/Q5276084","display_name":"Digital evidence","level":3,"score":0.2881999909877777},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.2687999904155731},{"id":"https://openalex.org/C55587333","wikidata":"https://www.wikidata.org/wiki/Q1133029","display_name":"Engineering ethics","level":1,"score":0.267300009727478},{"id":"https://openalex.org/C127627568","wikidata":"https://www.wikidata.org/wiki/Q1639361","display_name":"Sociotechnical system","level":2,"score":0.2551000118255615},{"id":"https://openalex.org/C79897977","wikidata":"https://www.wikidata.org/wiki/Q5054568","display_name":"Causal chain","level":2,"score":0.25450000166893005},{"id":"https://openalex.org/C183322885","wikidata":"https://www.wikidata.org/wiki/Q17007702","display_name":"Context model","level":3,"score":0.25290000438690186},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.05589","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.05589","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.05589","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.05589","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.6302343606948853,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Agentic":[0],"Al":[1,125,182],"systems":[2,45],"are":[3,10,163],"increasingly":[4],"deployed":[5],"as":[6],"personal":[7],"assistants":[8],"and":[9,29,71,89,135,149,157,183,190],"likely":[11],"to":[12,76,93],"become":[13],"a":[14,57,99,120],"common":[15],"object":[16],"of":[17,55,82,133,180],"digital":[18,187],"investigations.":[19],"However,":[20],"little":[21],"is":[22],"known":[23],"about":[24],"how":[25],"their":[26,95],"internal":[27],"state":[28,158],"actions":[30],"can":[31,153],"be":[32],"reconstructed":[33],"during":[34],"forensic":[35,41,74,188],"analysis.":[36],"Despite":[37],"growing":[38],"popularity,":[39],"systematic":[40,100,178],"approaches":[42],"for":[43,123,176,186],"such":[44],"remain":[46],"largely":[47,164],"unexplored.":[48],"This":[49],"paper":[50],"presents":[51],"an":[52,108,130,173],"empirical":[53],"study":[54],"OpenClaw":[56],"widely":[58],"used":[59],"single-agent":[60],"assistant.":[61],"We":[62,87],"examine":[63],"OpenClaw's":[64],"technical":[65],"design":[66],"via":[67],"static":[68],"code":[69],"analysis":[70,75],"apply":[72],"differential":[73],"identify":[77],"recoverable":[78],"traces":[79,92],"across":[80],"stages":[81],"the":[83,146,150,177],"agent":[84,109],"interaction":[85],"loop.":[86],"classify":[88],"correlate":[90],"these":[91,104],"assess":[94],"investigative":[96,115],"value":[97],"in":[98,138,160],"way.":[101],"Based":[102],"on":[103],"observations,":[105],"we":[106,118],"propose":[107],"artifact":[110],"taxonomy":[111],"that":[112,162],"captures":[113],"recurring":[114],"patterns.":[116],"Finally,":[117],"highlight":[119],"foundational":[121],"challenge":[122],"agentic":[124,181],"forensics:":[126],"agent-mediated":[127],"execution":[128,147],"introduces":[129],"additional":[131],"layer":[132],"abstraction":[134],"substantial":[136],"nondeterminism":[137],"trace":[139],"generation.":[140],"The":[141],"large":[142],"language":[143],"model":[144],"(LLM),":[145],"environment,":[148],"evolving":[151],"context":[152],"influence":[154],"tool":[155],"choice":[156],"transitions":[159],"ways":[161],"absent":[165],"from":[166],"rule-based":[167],"software.":[168],"Overall,":[169],"our":[170],"results":[171],"provide":[172],"initial":[174],"foundation":[175],"investigation":[179],"outline":[184],"implications":[185],"practice":[189],"future":[191],"research.":[192]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-04-09T00:00:00"}