Independent Testing — OpenClaw Defends Against Only 17% of Adversarial Prompt Injection

Independent testing from AIThinkerLab found that OpenClaw blocked only 17% of adversarial prompt injection attempts, a result that puts a hard number on a long-running risk in agentic AI systems. The finding suggests that, as tested, OpenClaw cannot yet be treated as safe for unrestricted enterprise use without additional controls around sensitive data and tool access.

Prompt injection is a security problem that appears when an attacker hides instructions inside text, files, web pages, emails, or other content that an AI system reads. If the model follows those hidden instructions, it may ignore the user’s real request, reveal information it should not, or take actions through connected tools. In systems that can browse, call APIs, send messages, or write to databases, that can turn a simple content-handling bug into a meaningful security incident.

AIThinkerLab’s test is notable because it looks at defense performance from the attacker’s point of view. Rather than asking whether the system can handle normal prompts, the evaluation checks how often it can resist deliberately hostile inputs designed to confuse or redirect the model. That kind of testing is especially relevant for AI agents, which often work with external content and have permission to act beyond a chat window.

A 17% block rate means most attacks still made it through the defenses under test. That does not necessarily mean every attempt led to a successful compromise, but it does show that the system’s current guardrails are incomplete when measured against adversarial input. For security teams, that gap matters more than a single benchmark score, because even a small number of successful injections can be enough to expose internal data or trigger an unsafe action.

Prompt injection has become one of the defining security concerns for AI assistants and agents because the attack surface is not just the model itself. It includes whatever documents, websites, tickets, messages, or repositories the model can read, plus any tools it can call. The more autonomy the system has, the more a successful injection can matter, which is why vendors and researchers keep treating this as a core trust problem rather than a niche bug.

Independent testing is also important because vendor claims about safety often focus on intended behavior, not adversarial resilience. External evaluations can show where a product works well in ordinary use and where it falls short once someone actively tries to break it. In this case, the reported result points to a system that may still need stricter input filtering, narrower permissions, better content isolation, or stronger human approval steps before it is exposed to high-stakes workloads.

For organizations considering deployment, the issue is not just whether OpenClaw can answer questions correctly, but whether it can be trusted around untrusted content and real-world actions. AIThinkerLab’s finding places prompt injection squarely in that risk assessment, and the 17% figure suggests the defenses under test still leave a large attack surface open.