OpenClaw Security — enforcing agent safety in OpenClaw
OpenClaw gives agents persistent memory, tool access, and long-running autonomy. That autonomy is exactly what makes prompt injection and memory poisoning dangerous. This page is the OpenClaw-specific security guide: where the risk is, and how to add a runtime enforcement layer.
OpenClaw's memory retrieval is fast and powerful. But recalled context should never, by itself, authorise an action. Enforcement belongs at the boundary where OpenClaw turns recalled context into a tool call or a memory write.
OpenClaw's exposure
OpenClaw agents read untrusted sources (documents, emails, web pages, search results), keep persistent memory, and call tools. That combination means:
- A malicious document can attempt to override the agent's instructions and trigger a tool call.
- A poisoned memory entry can persist and steer every future session.
- Credentials that reach memory become a standing exfiltration target.
Adding enforcement to OpenClaw
AgentInterdict installs as an OpenClaw skill and wraps the runtime boundary. It intercepts two moments:
OpenClaw security checklist
- Treat all externally-retrieved content as untrusted by default.
- Enforce origin-bound authority — derived content never outranks its source.
- Revalidate at action time — don't trust the ingest-time score.
- Redact credentials before persistence.
- Fail closed when memory state looks tampered.