{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T06:16:31Z","timestamp":1783145791054,"version":"3.54.6"},"reference-count":86,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE\/CAA J. Autom. Sinica"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1109\/jas.2026.126209","type":"journal-article","created":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T19:54:22Z","timestamp":1783108462000},"page":"1257-1273","source":"Crossref","is-referenced-by-count":0,"title":["OpenClaw in the Wild: Security Analysis of Autonomous Agents"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6305-1740","authenticated-orcid":false,"given":"Wanlun","family":"Ma","sequence":"first","affiliation":[{"name":"School of Science, Computing and Emerging Technologies, Swinburne University of Technology,Hawthorn,VIC,Australia,3122"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7207-0716","authenticated-orcid":false,"given":"Qing-Long","family":"Han","sequence":"additional","affiliation":[{"name":"School of Science, Computing and Emerging Technologies, Swinburne University of Technology,Hawthorn,VIC,Australia,3122"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0647-4747","authenticated-orcid":false,"given":"Xiaogang","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Information Technology, Adelaide University,Adelaide,SA,Australia,5005"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2548-6348","authenticated-orcid":false,"given":"Wei","family":"Zhou","sequence":"additional","affiliation":[{"name":"School of Science, Computing and Emerging Technologies, Swinburne University of Technology,Hawthorn,VIC,Australia,3122"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-2028-510X","authenticated-orcid":false,"given":"Junwu","family":"Xiong","sequence":"additional","affiliation":[{"name":"AI Infra Team at JD Technology,Beijing,China,100176"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4092-7428","authenticated-orcid":false,"given":"Zhihang","family":"Ren","sequence":"additional","affiliation":[{"name":"Google LLC,Mountain View,CA,USA,94043"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0655-666X","authenticated-orcid":false,"given":"Sheng","family":"Wen","sequence":"additional","affiliation":[{"name":"School of Science, Computing and Emerging Technologies, Swinburne University of Technology,Hawthorn,VIC,Australia,3122"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5252-0831","authenticated-orcid":false,"given":"Yang","family":"Xiang","sequence":"additional","affiliation":[{"name":"School of Science, Computing and Emerging Technologies, Swinburne University of Technology,Hawthorn,VIC,Australia,3122"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/INTELEC63987.2025.11214739"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/JAS.2024.124971"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-024-40231-1"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/JAS.2024.124983"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3581103"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3716628"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/JAS.2025.125552"},{"key":"ref8","volume-title":"OpenClaw: Your own personal AI assistant","author":"Steinberger","year":"2026"},{"key":"ref9","volume-title":"LangGraph: Build resilient language agents as graphs","author":"AI","year":"2024"},{"key":"ref10","volume-title":"CrewAI","year":"2025"},{"key":"ref11","volume-title":"Llamalndex","year":"2025"},{"key":"ref12","article-title":"Taming various privilege escalation in LLM-based agent systems: A mandatory access control framework","author":"Ji","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref13","volume-title":"AI agent security cheat sheet","year":"2026"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/JAS.2025.125498"},{"key":"ref15","article-title":"Malicious agent skills in the wild: A large-scale security empirical study","author":"Liu","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref16","article-title":"SoK: Agentic skills-beyond tool use in LLM agents","author":"Jiang","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref17","article-title":"Agent security bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents","volume-title":"Proc. 13th Int. Conf. Learning Representations","author":"Zhang"},{"key":"ref18","article-title":"Memory poisoning attack and defense on memory based LLM-agents","author":"Sunil","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref19","article-title":"Memory injection attacks on LLM agents via query-only interaction","volume-title":"Proc. 39th Annu. Conf. Neural Information Processing Systems","author":"Dong","year":"2025"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"ref21","article-title":"Agent skills in the wild: An empirical study of security vulnerabilities at scale","author":"Liu","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref22","article-title":"Towards verifiably safe tool use for LLM agents","volume-title":"Proc. Int. Conf. Software Engineering, New Ideas and Emerging Results Track","author":"Doshi","year":"2026"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/OJCS.2026.3664314"},{"key":"ref24","article-title":"Defensible design for OpenClaw: Securing autonomous tool-invoking agents","author":"Li","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref25","article-title":"StruQ: Defending against prompt injection with structured queries","volume-title":"Proc. 34th USENIX Conf. Security Symp.","author":"Chen"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/JAS.2026.125993"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1561\/1500000019"},{"key":"ref28","volume-title":"ClawHub","author":"Steinberger"},{"key":"ref29","volume-title":"Pi monorepo","year":"2026"},{"key":"ref30","volume-title":"Agent communication protocol","year":"2026"},{"key":"ref31","volume-title":"Ultra-efficient personal AI assistant powered by crystal","year":"2026"},{"key":"ref32","volume-title":"Your own AI assistant","year":"2026"},{"key":"ref33","volume-title":"Your everyday AI assistant agents","year":"2026"},{"key":"ref34","volume-title":"TinyAGI is the agent teams orchestrator for one person company (fka TinyClaw)","year":"2026"},{"key":"ref35","volume-title":"A tiny AI creature that lives in a folder on your computer","year":"2026"},{"key":"ref36","volume-title":"Ultra-lightweight personal AI assistant","year":"2026"},{"key":"ref37","volume-title":"The agent operating system","year":"2026"},{"key":"ref38","volume-title":"Agentic 1M chatbot infrastructure","year":"2026"},{"key":"ref39","volume-title":"Personal AI assistant","year":"2026"},{"key":"ref40","volume-title":"Built entirely on Supabase built-in features","year":"2026"},{"key":"ref41","volume-title":"Your personal AI assistant that remembers everything","year":"2026"},{"key":"ref42","volume-title":"Your personal AI assistant, one click away","year":"2026"},{"key":"ref43","volume-title":"An AI agent that controls your android phone","year":"2026"},{"key":"ref44","volume-title":"Claude code on a VPS, controlled from telegram","year":"2026"},{"key":"ref45","volume-title":"Your personal AI assistant","year":"2026"},{"key":"ref46","volume-title":"MimiClaw: Pocket AI assistant on a 5 chip","year":"2026"},{"key":"ref47","volume-title":"The AI agent that runs anywhere - even on a 5 VPS","year":"2026"},{"key":"ref48","volume-title":"PicoClaw: Ultra-efficient AI assistant in go","year":"2026"},{"key":"ref49","volume-title":"The multi-tenant agent operating system","year":"2026"},{"key":"ref50","volume-title":"The zero-cost alternative to OpenClaw","year":"2026"},{"key":"ref51","volume-title":"Shrew: Ultra-lightweight agent","year":"2026"},{"key":"ref52","volume-title":"Your secure personal AI assistant, always on your side","year":"2026"},{"key":"ref53","volume-title":"A rust-native claw you can trust","year":"2026"},{"key":"ref54","article-title":"Agents of chaos","author":"Shapira","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref55","article-title":"Can LLMs separate instructions from data? And what do we even mean by that?","volume-title":"Proc. 13th Int. Conf. Learning Representations","author":"Zverev"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.624"},{"key":"ref57","article-title":"Zombie agents: Persistent control of self-evolving LLM agents via self-reinforcing injections","author":"Yang","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref58","article-title":"MemoryGraft: Persistent compromise of LLM agents via poisoned experience retrieval","author":"Srivastava","year":"2025","journal-title":"arXiv preprint arXiv"},{"key":"ref59","article-title":"AgentSys: Secure and dynamic LLM agents through explicit hierarchical memory management","author":"Wen","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2025.3642164"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2026.230675"},{"key":"ref62","article-title":"Clawdrain: Exploiting tool-calling chains for stealthy token exhaustion in OpenClaw agents","author":"Dong","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref63","article-title":"Beyond max tokens: Stealthy resource amplification via tool calling chains in LLM agents","author":"Zhou","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref64","article-title":"Overcoming the retrieval barrier: Indirect prompt injection in the wild for LLM systems","volume-title":"Proc. ACM on Web Conf.","author":"Chang","year":"2026"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-main.104"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2636"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.1435"},{"key":"ref68","first-page":"80310","article-title":"Melon: Provable defense against indirect prompt injection attacks in AI agents","volume-title":"Proc. 42nd Int. Conf. Machine Learning","author":"Zhu"},{"key":"ref69","article-title":"Trojan\u2019s whisper: Stealthy manipulation of OpenClaw through injected bootstrapped guidance","author":"Liu","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref70","article-title":"SkillProbe: Security auditing for emerging agent skill marketplaces via multi-agent collaboration","author":"Guo","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref71","volume-title":"Exploring the security risks of AI assistants like OpenClaw","author":"McCauley","year":"2026"},{"key":"ref72","volume-title":"Malicious OpenClaw skills used to distribute atomic MACOs stealer","author":"Oliveira","year":"2026"},{"key":"ref73","article-title":"Taming OpenClaw: Security analysis and mitigation of autonomous LLM agent threats","author":"Deng","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref74","article-title":"Proof-of-guardrail in AI agents and what (not) to trust from it","author":"Jin","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref75","article-title":"DRIFT: Dynamic rule-based defense with injection isolation for securing LLM agents","volume-title":"Proc. 39th Annu. Conf. Neural Information Processing Systems","author":"Li","year":"2025"},{"key":"ref76","article-title":"Contextualized privacy defense for LLM agents","author":"Wen","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-main.53"},{"key":"ref78","article-title":"Progent: Securing AI agents with privilege control","author":"Shi","year":"2025","journal-title":"arXiv preprint arXiv"},{"key":"ref79","article-title":"AC4A: Access control for agents","author":"Sharma","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref80","article-title":"Don\u2019t let the claw grip your hand: A security analysis and defense framework for OpenClaw","author":"Shan","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/ASE63991.2025.00067"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/ICCNS66249.2025.11428688"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.53941\/ijndi.2025.100013"},{"key":"ref84","article-title":"From assistant to double agent: Formalizing and benchmarking attacks on OpenClaw for personalized local AI agent","author":"Wang","year":"2026","journal-title":"arXiv preprint arXiv"},{"key":"ref85","article-title":"AMA-Bench: Evaluating long-horizon memory for agentic applications","volume-title":"Proc. ICLR 2026 Workshop on Memory for LLM-Based Agentic Systems","author":"Zhao","year":"2026"},{"key":"ref86","article-title":"AgentTrace: A structured logging framework for agent system observability","volume-title":"Proc. LLM-based Multi-Agent Systems: Towards Responsible, Reliable, and Scalable Agentic Systems","author":"AlSayyad","year":"2026"}],"container-title":["IEEE\/CAA Journal of Automatica Sinica"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6570654\/11595007\/11595140.pdf?arnumber=11595140","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T05:23:38Z","timestamp":1783142618000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11595140\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":86,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/jas.2026.126209","relation":{},"ISSN":["2329-9266","2329-9274"],"issn-type":[{"value":"2329-9266","type":"print"},{"value":"2329-9274","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6]]}}}