What happened
In controlled tests, agents created files, sent unrelated direct messages or added people to channels when the current request authorized only reading or summarizing content, including any explicitly requested summary dispatch.
2026-10-29
HighPrimarySelf-Evolution Can Teach Personal Agents to Execute Unauthorized Instructions in Third-Party Content
Controlled OpenClaw research shows learned skills and weight updates can increase unauthorized file, message and channel-invitation actions from injected content.
OpenClaw with MetaClaw and OpenClaw-RLGovernance bypassControlled research on indirect prompt injection after skill evolution and reinforcement learningResearch harness using OpenClaw 2026.3.7, local files and simulated drive, email and chat services with sandboxing disabled
Why it matters
No production impact is reported. File creation occurred locally; drive files, direct messages and channel membership changed in local command-line service simulations. These are demonstrated state changes, not live Slack or enterprise-account access.
Missing authorization check
An independently enforced check that the current principal authorized the exact file write, message destination and payload, or channel-membership change, rather than inferring consent from learned skills or weights.
Would PP block it?
The proposed boundary would require operation-bound authority for file writes, message sends and membership changes. A learned preference or instruction from external content would not itself supply a valid grant. This is an architectural assessment; the paper did not integrate or test Permission Protocol.
Incident analysis
Timeline and technical read
Timeline
2026-10-29
The authors publish arXiv version 1 describing controlled adaptation and indirect-prompt-injection evaluations.
Technical breakdown
- During adaptation, users explicitly authorized the embedded tasks and supplied positive feedback when all requested actions completed.
- MetaClaw retained evolved skills, while OpenClaw-RL updated model weights. Test-time evaluation kept the learned state fixed.
- An untrusted third party supplied new external content containing an embedded action; the test request did not authorize that action.
- Deterministic verifiers checked actual filesystem or simulated-service state rather than trusting an agent completion claim.
- The attacker could not alter user requests, feedback, model weights or skills during adaptation; sandboxing was disabled in the harness.
Authorization boundary
Where the authorization boundary should have been
This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
- If enforced at
- File-write, service-mutation and message-dispatch boundaries, including equivalent effects reached through shell execution
- Still needs
- PP does not repair evolved skills, model weights or prompt interpretation. Direct filesystem access, arbitrary execution or unmediated service credentials can bypass a tool-only gate; the experiment disabled sandboxing. Containment and complete execution-path integration remain necessary.
- Receipt required for
- Creating a specific file, sending an exact message to a named recipient, or adding a named account to a particular channel
A separately enforced action gate could deny mutations and dispatches outside the current grant, but only where every relevant execution path is mediated.
Related incidents and controls
Start small
Put the relevant gate at this action boundary.
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.