{"id":"https://openalex.org/W7164921330","doi":"https://doi.org/10.48550/arxiv.2606.15008","title":"Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations","display_name":"Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations","publication_year":2026,"publication_date":"2026-06-12","ids":{"openalex":"https://openalex.org/W7164921330","doi":"https://doi.org/10.48550/arxiv.2606.15008"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.15008","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.15008","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.15008","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138719934","display_name":"Saeid Jamshidi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jamshidi, Saeid","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138709071","display_name":"Arghavan Moradi Dakhel","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dakhel, Arghavan Moradi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110358595","display_name":"Kawser Wazed Nafi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nafi, Kawser Wazed","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138742365","display_name":"Foutse Khomh","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Khomh, Foutse","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.29820001125335693,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.29820001125335693,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.1014999970793724,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.0828000009059906,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/compromise","display_name":"Compromise","score":0.8384000062942505},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.6485000252723694},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6478999853134155},{"id":"https://openalex.org/keywords/margin","display_name":"Margin (machine learning)","score":0.3765999972820282},{"id":"https://openalex.org/keywords/boundary","display_name":"Boundary (topology)","score":0.3546000123023987},{"id":"https://openalex.org/keywords/downgrade","display_name":"Downgrade","score":0.3327000141143799},{"id":"https://openalex.org/keywords/covert-channel","display_name":"Covert channel","score":0.3125999867916107},{"id":"https://openalex.org/keywords/attack-surface","display_name":"Attack surface","score":0.31189998984336853}],"concepts":[{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.8384000062942505},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.6485000252723694},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6478999853134155},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6093999743461609},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5730999708175659},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.3765999972820282},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.3546000123023987},{"id":"https://openalex.org/C2779628075","wikidata":"https://www.wikidata.org/wiki/Q1253258","display_name":"Downgrade","level":2,"score":0.3327000141143799},{"id":"https://openalex.org/C29024540","wikidata":"https://www.wikidata.org/wiki/Q1476964","display_name":"Covert channel","level":5,"score":0.3125999867916107},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.31189998984336853},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.299699991941452},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.26829999685287476},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2676999866962433},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.2662000060081482},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.26499998569488525},{"id":"https://openalex.org/C44154836","wikidata":"https://www.wikidata.org/wiki/Q45045","display_name":"Simulation","level":1,"score":0.2635999917984009},{"id":"https://openalex.org/C112972136","wikidata":"https://www.wikidata.org/wiki/Q7595718","display_name":"Stability (learning theory)","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.25519999861717224}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.15008","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.15008","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.15008","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.15008","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Agentic":[0],"large":[1],"language":[2],"model":[3,15],"(LLM)":[4],"systems":[5],"can":[6,54,225],"now":[7],"execute":[8,55],"actions,":[9],"not":[10,111],"only":[11],"produce":[12],"text.":[13],"When":[14,223],"outputs":[16,53],"trigger":[17],"privileged":[18],"operations":[19],"such":[20],"as":[21,76,164],"shell":[22],"commands,":[23],"browser":[24],"automation,":[25],"or":[26],"external":[27],"tool":[28],"calls,":[29],"the":[30,83,92,97,113,124,202,232],"security":[31],"problem":[32],"shifts":[33],"from":[34,116,130,146,244,252],"alignment":[35],"alone":[36],"to":[37,100,132,148,246,255],"system":[38,49,93,198,237],"configuration":[39],"and":[40,57,61,71,173,185,219,248],"structural":[41],"design.":[42],"We":[43,63],"analyze":[44],"OpenClaw,":[45],"a":[46,135],"self-hosted":[47],"multi-agent":[48],"in":[50],"which":[51],"LLM":[52],"commands":[56],"interact":[58],"with":[59],"tools":[60],"services.":[62],"measure":[64],"compromise":[65,84,98,177],"probability,":[66],"boundary":[67,181],"failures,":[68],"privilege":[69,143,161,186],"drift,":[70],"how":[72],"these":[73],"metrics":[74],"change":[75],"attacker":[77,165],"capability":[78,166],"increases.":[79,167],"With":[80,88],"one":[81],"agent,":[82,231],"probability":[85,178],"is":[86,205],"0.24.":[87],"seven":[89],"agents,":[90],"when":[91],"executes":[94],"an":[95],"action,":[96],"rises":[99],"0.86":[101],"if":[102],"any":[103,229],"single":[104,230],"agent":[105,235],"proposes":[106],"it.":[107],"The":[108,141,197],"models":[109],"do":[110],"change;":[112],"increase":[114,249],"comes":[115],"output":[117],"aggregation.":[118],"Prompt":[119],"injection":[120],"propagates":[121],"instability":[122],"across":[123,211],"system.":[125],"Attack":[126],"surface":[127],"entropy":[128],"increases":[129,145],"0.42":[131],"0.71,":[133],"indicating":[134,150],"broader":[136],"distribution":[137],"of":[138,157],"exploit":[139],"paths.":[140],"mean":[142],"drift":[144,187],"0.03":[147],"0.21,":[149],"unintended":[151],"authority":[152],"gain.":[153],"Positive":[154],"escalation":[155],"curvature":[156],"0.08":[158],"indicates":[159],"that":[160],"grows":[162],"faster":[163],"Defensive":[168],"controls,":[169],"including":[170],"policy":[171],"gating":[172],"execution":[174,224],"filtering,":[175],"reduce":[176,241],"by":[179,183,188,228],"0.10,":[180,184],"failures":[182],"0.02,":[189],"all":[190],"statistically":[191],"significant":[192],"at":[193],"p":[194],"<":[195],"0.0001.":[196],"remains":[199],"sensitive,":[200],"but":[201],"mitigation":[203,208],"impact":[204],"measurable.":[206],"Injection":[207],"success":[209],"differs":[210],"models:":[212],"0.37":[213],"for":[214,217,221],"GPT-5.2,":[215],"0.35":[216],"Llama-4-Maverick,":[218],"0.31":[220],"DeepSeek-R1.":[222],"be":[226],"triggered":[227],"most":[233],"vulnerable":[234],"determines":[236],"exposure.":[238],"Mitigations":[239],"slightly":[240],"task":[242],"utility":[243],"0.93":[245],"0.89":[247],"median":[250],"latency":[251],"420":[253],"ms":[254],"468":[256],"ms.":[257]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-17T00:00:00"}