In plain words
AutoRedClaw is a framework that creates security tests for claw-style agents, which can carry information from one task into another. It generates a task, malicious instructions, a small working environment, and a check for whether the attack worked.
Its tests ask whether outside content can poison lasting agent files and whether those files can later prompt a harmful action.
In a fixed collection of 330 cases, OpenClaw and Nanobot met the attack-success conditions in more than 60% of cases on average across four models, in both stages. That result applies to the tested harnesses and collection.
The research
If an agent reloads its memory and configuration across tasks, an instruction encountered once may influence later work. It remains unclear whether security tests can capture both how that instruction enters persistent state and what happens after the agent encounters it again.
AutoRedClaw generates attacks with task-specific environments and success checks, letting researchers test both persistent-state poisoning and its later effects.
AutoRedClaw is an automated red-teaming framework that generates attacks alongside task-specific environments and checks for success. Its two stages test whether external content can poison persistent agent state and whether planted instructions can later cause harmful actions.
In the authors' frozen 330-case collection, attack success rate means the share of cases meeting attacker-success conditions. OpenClaw and Nanobot each averaged above 60% across four models in both stages, evidence that the collection exposes substantial risks for those harnesses.
The findings come from selected models and agent harnesses tested in isolated containers with simulated applications and bounded tasks. They do not establish how other deployments, live services, or prolonged multi-session interactions would behave.
Analysis
Deep
- Original paper authors
- Hao Li, Tongyan Hu, Weidi Luo, Shanghao Shi, Xiaogeng Liu
- Submitted to arXiv
- License
- arXiv non-exclusive