security
Apr 7, 2026
By Teun
Researchers Show AI Agents Can Chain Attacks — 85% Success on Credential Access
A university study found that AI agent frameworks like OpenClaw dramatically amplify attack risk. While a bare model might refuse to help, an agent with tool access can be manipulated into full attack chains with high success rates.
Researchers at Xidian University and China Unicom have shown that AI agents with tool access can be pushed into full attack chains, even when the underlying model would normally refuse harmful requests. In their study, the team found that adding tools, file access, and shell commands changes the security picture sharply, because the agent can be manipulated into carrying out separate steps that look harmless on their own.
That distinction matters. A bare chat model may decline to help with malware or credential theft, but an agent can be guided through a sequence of actions that together achieve the same result. According to the summary of the study, the researchers saw an 85.71% success rate for credential access attacks and more than 65% success for reconnaissance.
⚡ New to this?
This news is about AI agents, which are AI systems that can do work with tools like file access and shell commands, not just chat. The study shows that when those tools are available, an attacker can trick the agent into carrying out steps that add up to credential theft or reconnaissance, even if the model would have refused a direct harmful request. That matters because many people assume the model itself is the main risk, when the bigger risk can be the agent’s access to systems and data.
🦞 OpenClaw angle
Treat every agent tool as a security boundary, not a convenience feature. Put shell access, file reads, and network actions behind explicit approval gates, and use deny lists for commands and paths that the agent should never touch. If an agent can read secrets or run arbitrary commands, assume prompt injection will eventually try to steer it into using that access, and test your workflows with malicious inputs before deployment.
The mechanism is prompt injection, a technique where malicious instructions are hidden inside data the agent processes. Instead of asking the agent to do everything at once, the attacker nudges it into individual tasks, such as scanning a network, reading a file, or sending out data, and those steps can add up to a complete intrusion path.
For operators, the uncomfortable part is that the agent does not need to be “evil” in the obvious sense to become dangerous. If a workflow lets the system run shell commands, inspect arbitrary files, or pass data between tools without checks, one injected instruction can be enough to turn an ordinary automation into an attack helper. The study’s main point is not that AI models are uniquely malicious, but that agent frameworks expand the blast radius once tools are attached.
That is why OpenClaw’s tools.deny configuration and exec-approvals matter in practice. The existing body describes them as controls for restricting which commands an agent can run and when approval is required for dangerous actions. Those controls are only useful if they are applied consistently, especially around shell execution, file reads, and any step that can expose secrets or move data off the box.
The larger lesson is straightforward, according to the researchers’ results and the OpenClaw controls described here, least privilege is not optional for agents. Give the agent only the files, commands, and network reach it needs for the job, and treat every extra capability as an attack surface. The study also points toward a concrete next step for operators, test your agent workflows for prompt injection paths before they are allowed to touch production systems.
