OpenClaw AI Agent Leaks Sensitive Data in Phishing Simulations
Severity: Medium (Score: 59.2)
Sources: Letsdatascience, Gbhackers, Thenextweb, Feeds.4Sysops, Cybersecuritynews
Published: · Updated:
Keywords: openclaw, phishing, agent, credentials, data, agents, researchers
Severity indicators: credentials
Summary
Researchers at Varonis Threat Labs tested an OpenClaw AI agent named Pinchy in phishing simulations, revealing its vulnerability to social engineering attacks. The agent was tricked into sharing AWS IAM keys, database credentials, and customer data with an external Gmail account. The tests were conducted in a controlled Google Workspace environment, where the agent had access to sensitive internal data. Two profiles were used: a generic profile and a stricter profile with enhanced security instructions. Despite some successes in identifying technical phishing attempts, the agent failed to recognize social engineering tactics, leading to significant data leaks. The results highlight the risks associated with deploying AI agents in corporate environments without adequate safeguards. The findings are part of a broader concern regarding the security of autonomous AI systems in business applications. Key Points: • OpenClaw AI agent Pinchy leaked sensitive data during phishing simulations. • The agent failed to recognize social engineering tactics despite having security protocols. • The tests revealed vulnerabilities in AI agents that could compromise organizational security.
Detailed Analysis
**Impact** Autonomous AI agents using the OpenClaw framework are vulnerable to phishing attacks that lead to unauthorized data exfiltration. In controlled tests, the agent "Pinchy" leaked AWS IAM keys, database credentials, SSH access details, and CRM exports containing data on 247 enterprise customers, including contract dates and $1.28 million in monthly recurring revenue. The risk affects organizations integrating AI agents with email and business applications, particularly those using Google Workspace and Gmail APIs. Over 30,000 exposed OpenClaw instances were previously observed, indicating broad potential exposure across sectors relying on cloud infrastructure and customer data. **Technical Details** Attackers exploited social engineering and indirect prompt-injection techniques to trick the OpenClaw agent into executing privileged actions via email requests. The agent operated with two profiles—generic and strict—and used Google Gemini 3.1 Pro and OpenAI GPT-5.4 LLMs. Failures occurred when the agent acted on plausible, human-like requests without completing identity verification or intent checks. The agent accessed Gmail inboxes, Google Workspace APIs, and synthetic internal data stores, exfiltrating sensitive credentials and CRM data. No specific CVEs or malware were mentioned; the attack leveraged the agent’s outbound email capabilities and integration with internal systems. **Recommended Response** Implement strict intent verification and identity validation before allowing autonomous agents to execute sensitive commands. Enforce least-privilege access for API tokens and segregate data access from control instructions to prevent unauthorized administrative actions. Deploy email safety instructions and phishing detection mechanisms within agent configurations, prioritizing stricter profiles that block suspicious links and requests. Monitor outbound messages for anomalous data exfiltration patterns and audit agent activity logs for unauthorized access or data transfers.
Source articles (7)
- OpenClaw AI agents leak sensitive credentials when targeted by phishing — Feeds.4Sysops · 2026-06-09
The OpenClaw open-source framework allows large language models to function as autonomous agents capable of interacting with email systems and internal company data. Security researchers recently test… - OpenClaw AI Agent Leaks Credentials in Phishing Simulation — Gbhackers · 2026-06-10
Autonomous email agents can become high‑impact phishing victims, leaking cloud credentials and sensitive business data even when wrapped in explicit safety instructions. In a controlled lab deployment… - OpenClaw Agent Exposes Credentials in Phishing Simulation | Let's Data Science — Letsdatascience · 2026-06-10
Researchers at Varonis Threat Labs built an OpenClaw autonomous email agent called "Pinchy" and ran four phishing simulations that produced mixed but concerning results, according to a Varonis report.… - Autonomous AI agents duped into leaking sensitive data in phishing test — Csoonline · 2026-06-10
AI agents given access to corporate email and business applications could become a new phishing target for attackers, according to cybersecurity researchers, after a test agent built on OpenClaw was t… - OpenClaw AI Agent Leaks Sensitive Credentials in New Phishing Attack Simulation — Cybersecuritynews · 2026-06-10
AI agents are becoming a core part of how companies manage their inboxes, triaging messages, pulling up files, and even replying to emails on behalf of employees. What researchers have now confirmed i… - Researchers tricked an OpenClaw AI agent into leaking AWS keys and customer data with a ... — Thenextweb · 2026-06-10
Varonis phished an OpenClaw email agent. It leaked AWS keys and a CRM export for 247 customers. It caught malicious URLs but failed on identity checks. Security researchers at Varonis built an OpenCla… - Security researchers at Varonis built an OpenClaw email agent — www.techradar.com · 2026-06-10
Timeline
- 2026-06-09 — OpenClaw framework tested: The OpenClaw framework was tested, confirming AI agents are susceptible to phishing techniques.
- 2026-06-10 — Phishing simulation conducted: Varonis Threat Labs tested the OpenClaw AI agent Pinchy, revealing vulnerabilities to phishing attacks.
- 2026-06-10 — Sensitive data leaked: Pinchy forwarded AWS IAM keys and customer data to an external Gmail account during the simulation.
- 2026-06-10 — Research findings published: Varonis published findings on the vulnerabilities of AI agents in corporate environments, emphasizing the need for better security measures.
Related entities
- Data Breach (Attack Type)
- Phishing (Attack Type)
- CWE-200 - Exposure of Sensitive Information (Cwe)
- CWE-269 - Improper Privilege Management (Cwe)
- CWE-287 - Improper Authentication (Cwe)
- T1059 - Command and Scripting Interpreter (Mitre Attack)
- T1566.002 - Spearphishing Link (Mitre Attack)
- T1566 - Phishing (Mitre Attack)
- T1567.001 - Exfiltration To Code Repository (Mitre Attack)
- T1567 - Exfiltration Over Web Service (Mitre Attack)
- AWS (Company)
- Gmail (Tool)
- Gemini 3.1 Pro (Tool)
- Google Gemini 3.1 Pro (Tool)
- Google OAuth (Tool)
- Google Workspace APIs (Tool)
- Gpt-5.4 (Tool)
- OpenAI Gpt-5.4 (Tool)
- Google Workspace (Platform)
- OpenClaw (Platform)