How to Secure OpenClaw Against Prompt Injection

Snyk's February 2026 ToxicSkills study scanned 3,984 ClawHub skills and found prompt injection in 36% of them. Of the confirmed malicious skills, 91% used prompt injection as their primary technique. That number matters because it shows the attack isn't rare or theoretical. It's embedded in the supply chain that most OpenClaw users pull from daily.

OpenClaw's own security documentation states the problem directly: "Even with strong system prompts, prompt injection is not solved." System prompts provide soft guidance to the model, but a sufficiently crafted payload can override that guidance. The defense has to happen at the architecture level, not the prompt level.

This is the core insight behind OpenClaw's security model. Instead of trying to make the model immune to manipulation, the framework restricts what a manipulated model can actually do. A tricked model that wants to delete files still can't execute that action if filesystem tools aren't on the allowlist. A model that tries to exfiltrate credentials still can't reach an external endpoint if network boundaries are enforced.

The five defense layers work together: access gating, content isolation, model selection, external content wrapping, and execution constraints. Each one reduces blast radius independently, so a failure in one layer doesn't cascade into a full compromise.

The first layer controls who can talk to your agent at all. By default, OpenClaw accepts messages from anyone who can reach the bot's channel. That's a wide-open attack surface.

DM pairing narrows it. OpenClaw's security documentation describes a per-channel DM policy that restricts inbound messages to pre-approved users. Everyone else gets ignored before the model ever sees their input. You configure this per channel in your gateway settings, choosing from modes like pairing, allowlist, open, or disabled depending on how restrictive you need to be.

This is the simplest and most effective first step. If an attacker can't message the bot, they can't inject prompts through direct messages. The attack surface shrinks from "everyone on the internet" to "people you explicitly approved."

For group channels, pair this with content isolation filtering (covered in the next section) to control what supplemental context reaches the model from group participants.

Even with DM pairing enabled, group chats introduce a second vector. When someone replies to a message, quotes text, or forwards content into a channel, that supplemental context gets injected into the model's input. An attacker doesn't need to message the bot directly. They just need to get malicious text into a quoted reply or thread that the bot processes.

OpenClaw's context visibility setting controls this. It offers three modes: the default passes all supplemental context through as received, an allowlist mode filters content to approved senders only, and a hybrid mode that keeps one quoted reply from non-allowlisted senders while filtering the rest. For production deployments handling sensitive data, restrict to allowlist mode. You can set this per channel or per room. A reasonable pattern is full filtering globally with the hybrid mode on channels where the bot needs to respond to forwarded questions from untrusted senders.

This layer works because most indirect prompt injection arrives through supplemental context, not through the primary message. Giskard's research demonstrated that crafted email summaries, configuration file snippets, and forwarded metadata are all viable injection vectors when the model processes them without filtering.

Keep agent output auditable and version-controlled

Fast.io workspaces give your OpenClaw agents persistent storage with full activity logging, file versioning, and MCP access. 50 GB free, no credit card.

Sign Up Free

Access gating and content isolation reduce what reaches the model. Tool policy reduces what the model can do once it's been reached.

OpenClaw's tool policy works on a deny-by-default principle. You explicitly list which tool groups the agent can use, and everything else is blocked. Even if an injected prompt convinces the model to attempt a filesystem operation or an automation call, the execution layer rejects it before anything happens.

A hardened baseline denies the automation, runtime, and filesystem tool groups entirely. On the execution side, you block direct code execution and force human approval for any execution that does get past the deny list. Together, these settings mean an attacker who successfully injects a prompt still can't run arbitrary code. If your agent has access to code interpreters, enable strict inline evaluation to require explicit approval even when the interpreter itself is on the allowlist. This catches the edge case where an attacker uses inline evaluation to bypass tool-level restrictions.

Network boundaries add another constraint layer. OpenClaw's browser SSRF policy blocks private network destinations by default. Don't change this unless you have a specific, documented reason. The flag that allows private network access exists for development, not production.

Sandboxing for High-Risk Agents

For agents that genuinely need filesystem or execution capabilities, isolate them. OpenClaw supports per-channel-peer session scoping, which prevents one user's session state from leaking to another. Without this isolation, credentials and API keys loaded in one DM session can become visible to other users messaging the same bot. Giskard's research confirmed this cross-session data leakage as a real vulnerability in default configurations.

The model itself is the fourth layer. OpenClaw's documentation is direct about this: older, smaller, and weaker models show higher susceptibility to prompt injection and tool misuse.

For any agent that has tool access, use the strongest latest-generation, instruction-hardened model available. The cost difference between a small model and a frontier model is negligible compared to the cost of a successful injection that exfiltrates credentials or deletes data.

Content wrapping is the complementary half of this layer. When OpenClaw processes external content (web search results, email bodies, file contents), it strips special-token literals before passing them to the model. This prevents tokenizer-layer role injection, where an attacker embeds tokens that look like system or assistant role markers inside what appears to be user content.

This happens automatically, but it's worth understanding because it explains why the wrapping layer exists separately from content isolation. Content isolation (Layer 2) controls which external content reaches the model. Content wrapping sanitizes the content that does get through. They're complementary, not redundant.

Why Both Layers Matter

Consider a scenario where an attacker embeds malicious instructions inside a legitimate document that your allowlisted user shares. Content isolation lets the document through because the sender is trusted. Content wrapping strips the special tokens that would let the malicious instructions impersonate a system prompt. The model sees the text as user content, not as instructions with elevated authority.

Neither layer alone solves the problem. Together, they reduce the attack surface for indirect injection through trusted channels.

OpenClaw ships a built-in security audit tool that checks your configuration against known vulnerability patterns. The basic mode scans your gateway configuration for common misconfigurations. A deeper analysis mode adds logic-level vulnerability detection, static code analysis on installed skills, active network surface probing, and scans over 70 security items including filesystem permissions, gateway authentication, API token integrity, and potential prompt injection vectors.

The audit also offers an auto-remediation mode that converts permissive policies to allowlists, restores redaction for sensitive keys in logs, binds the gateway to localhost by default, and tightens filesystem permissions on the state directory. For CI/CD integration, the audit supports JSON output, making it straightforward to parse results in GitHub Actions, GitLab CI, or any other automation system. A failing audit should block deployment the same way a failing test suite would. OpenClaw's security documentation covers the full audit command surface.

Auditing Installed Skills

The ClawHub supply chain is a real concern. Beyond Snyk's findings on prompt injection prevalence, the CyberPress team documented 1,184 malicious skills uploaded to ClawHub that actively exfiltrated data. The deep audit mode includes skill scanning, but you should also review installed skills manually. Check what network calls they make, what filesystem access they request, and whether their source code matches their stated purpose.

For persistent file storage and audit trails across your agent workflows, Fast.io provides workspaces where agents and humans share the same files with full activity logging. Every file change, share event, and AI interaction gets tracked. When you're investigating a potential injection incident, that audit trail tells you exactly what the agent accessed and when. The free agent plan includes 50 GB storage and 5,000 credits per month with no credit card required.

None of these layers work in isolation. The defense model is cumulative: each layer catches attacks that slip through the ones above it.

A practical hardening checklist for a production OpenClaw deployment:

1. Enable DM pairing on every channel to gate who can message the bot
2. Restrict content visibility to allowlisted senders to filter supplemental content injection
3. Deny automation, runtime, and filesystem tool groups by default
4. Block direct code execution and require human approval for any execution that passes the deny list
5. Enable strict inline evaluation if any code interpreters are available
6. Scope sessions per channel and peer to prevent cross-session data leakage
7. Select the strongest available instruction-hardened model for tool-enabled agents
8. Run the built-in security audit in deep mode before every deployment
9. Review installed ClawHub skills for unexpected network calls and filesystem access
10. Store agent output in a workspace with full audit logging for incident investigation

The honest reality is that prompt injection remains an unsolved problem across the entire AI industry. No configuration eliminates the risk entirely. What these layers do is contain the blast radius. A successful injection against a properly hardened OpenClaw deployment can trick the model into wanting to do something harmful, but the execution layer prevents it from actually happening.

For teams running agents in production, pair OpenClaw's built-in defenses with external storage that provides its own audit trail. Local filesystems don't log agent access patterns. Cloud storage services like Fast.io workspaces provide the file versioning, permission boundaries, and activity tracking that make incident response possible when something does go wrong. The MCP server gives agents structured access to storage, AI, and workflow tools through a single authenticated endpoint, keeping tool access auditable and bounded.