Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces Clawdrain, a Trojanized skill designed to induce token exhaustion in OpenClaw agents through a multi-turn "Segmented Verification Protocol" orchestrated via injected SKILL.md instructions and a companion script. By deploying Clawdrain in a production-like OpenClaw environment with real API billing and Gemini 2.5 Pro, the authors achieved 6-9x token amplification compared to a benign baseline. The study also reveals that the agent's autonomous tool composition capabilities can reduce amplification and alter attack dynamics, highlighting the interplay between attack design and agent behavior.
OpenClaw agents are vulnerable to token-exhaustion attacks via Trojanized skills, but their self-directed tool use can unexpectedly alter attack dynamics.
Modern generative agents such as OpenClaw - an open-source, self-hosted personal assistant with a community skill ecosystem, are gaining attention and are used pervasively. However, the openness and rapid growth of these ecosystems often outpace systematic security evaluation. In this paper, we design, implement, and evaluate Clawdrain, a Trojanized skill that induces a multi-turn "Segmented Verification Protocol" via injected SKILL.md instructions and a companion script that returns PROGRESS/REPAIR/TERMINAL signals. We deploy Clawdrain in a production-like OpenClaw instance with real API billing and a production model (Gemini 2.5 Pro), and we measure 6-7x token amplification over a benign baseline, with a costly, failure configuration reaching approximately 9x. We observe a deployment-only phenomenon: the agent autonomously composes general-purpose tools (e.g., shell/Python) to route around brittle protocol steps, reducing amplification and altering attack dynamics. Finally, we identify production vectors enabled by OpenClaw's architecture, including SKILL.md prompt bloat, persistent tool-output pollution, cron/heartbeat frequency amplification, and behavioral instruction injection. Overall, we demonstrate that token-drain attacks remain feasible in real deployments, but their magnitude and observability are shaped by tool composition, recovery behavior, and interface design.