OpenClaw AI Agent Found Vulnerable to Phishing Simulations, Exposing Sensitive User Data

Security researchers found that an AI-powered email agent built with the OpenClaw framework could be manipulated by phishing tactics commonly used against human users, including impersonation, urgency, and fake operational requests.

OpenClaw is an open-source AI agent framework that allows large language models to interact with real-world systems and perform tasks autonomously. When configured as an email agent, it can read messages, reason about requests, access connected tools, and take actions on behalf of a user or organization.

Researchers at Varonis Threat Labs built an OpenClaw-based agent named Pinchy and connected it to a Gmail inbox, browser tools, Google Workspace APIs, and simulated internal company data sources. The test environment included fabricated but realistic sensitive data such as AWS credentials, database credentials, CRM exports, internal messages, and calendar information.

The goal was to determine whether traditional phishing techniques that have long been used against employees could also manipulate AI agents operating on their behalf.

The researchers tested two agent configurations. The first used a generic productivity profile with standard email-processing instructions. The second used a stricter security-focused profile that included phishing awareness guidance and identity verification procedures. The framework was tested using Google Gemini 3.1 Pro and OpenAI GPT-5.4.

The results showed that AI agents can identify some technical indicators of phishing, but may still fail when social engineering appears operationally urgent or business-relevant.

In one test, an attacker impersonated a team lead and requested access to a staging environment during a fake production issue. The agent located and emailed AWS IAM keys, database credentials, and SSH access details to an external Gmail account.

In another scenario, the attacker requested a customer export while claiming to be working remotely on a presentation. The agent retrieved and sent CRM data containing customer records, contact details, contract information, and revenue data without properly verifying the sender’s identity.

Both the generic and strict profiles failed these first two scenarios. According to Varonis, the stricter profile still broke down because the agent treated the requests as urgent business tasks rather than high-risk actions requiring stronger verification.

The agent performed better in other simulations. When it received a fake gift card email containing a phishing link, the generic configuration visited the phishing site and attempted to interact with it using fabricated credentials before identifying the page as malicious. The stricter configuration blocked the attempt immediately.

In a fourth test, researchers created a malicious Google OAuth application disguised as a timesheet platform. The agent inspected the OAuth flow, analyzed the destination, recognized the application as suspicious, and refused to grant access.

Varonis concluded that AI agents may be strong at detecting suspicious links, fake login pages, malicious OAuth applications, and other technical phishing indicators. However, they can still fail when attacks rely on trust, urgency, authority, or incomplete identity verification.

The findings highlight a major security challenge for autonomous AI agents. Unlike traditional chatbots, agents often have access to tools, files, APIs, email, cloud platforms, and business data. If they are tricked into taking action, the damage can extend beyond a bad response and turn into real data exposure, credential theft, or unauthorized workflow execution.

At the model level, Varonis observed that Gemini showed a greater willingness to interact with requests, while GPT-5.4 displayed a more cautious posture. However, the researchers emphasized that the broader issue is not only the model itself, but also the agent framework, permissions, identity controls, and approval workflow surrounding it.

The research points to the need for stronger zero-trust controls around AI agents. Agents should not automatically trust email senders, even when requests appear to come from internal users or reference legitimate business processes.

Varonis recommends requiring explicit sender verification, limiting access to sensitive internal data, blocking agents from emailing new external recipients without approval, and requiring human review for high-risk actions such as sharing credentials, exporting customer data, approving financial requests, or granting access to external applications.

The findings also reinforce an important security lesson: AI agents should be treated as privileged automation systems, not ordinary productivity assistants. If an agent can access credentials, customer records, cloud resources, or internal APIs, it should be governed with the same security controls used for service accounts, automation tools, and privileged users.

As organizations begin deploying AI agents into email, IT operations, customer service, finance, and development workflows, phishing defense will need to evolve. The next generation of phishing attacks may not only target employees directly, but also the AI systems acting on their behalf.