“OpenClaw inherits all these weaknesses.”
Our reading, the sentence that was checked:
OpenClaw inherits the prompt-injection and security weaknesses of LLM agents.
Assessment: Supported Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, OpenClaw (a.k.a. Moltbot) is everywhere all at once, and a disaster waiting to happen, paragraph 20.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-openclaw-aka-moltbot-is-everywhere-5db4ae-a1
We recorded 9 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2026-02-01. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Observation
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
From the speaker
- OpenClaw
- inherits all these weaknesses
- prompt injection attacks
- malicious prompts
Our interpretation
- Read these weaknesses in its immediate security context: malicious instructions can redirect the language-model agent and exploit the tools or data access granted to it.
- This does not require every installation to be compromised or every possible attack to succeed.
- For the ongoing observation, assess January 2026, the latest complete calendar month before the post.
- The subsequent quotation about operating-system and browser protections is not treated as a literal assertion that OpenClaw bypasses every operating-system permission.
Counts as supported if: Contemporaneous OpenClaw-specific testing demonstrates malicious instructions redirecting agent behavior or abusing its authorized capabilities, with project documentation confirming the relevant access.
Counts as contradicted if: Contemporaneous architecture and representative tests establish that the claimed instruction-to-action weakness is prevented in the relevant OpenClaw configurations.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Was it true for the period described?
Outcome: Supported
The dated evidence matches what the claim committed to, under the criteria frozen before grading.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
On the immediate security reading, the claim is supported. Cisco describes malicious skill instructions causing unauthorized behavior in OpenClaw, and the January release documentation confirms the relevant host tool access. Optional sandboxes and security hardening qualify the scope: this establishes susceptibility in exposed configurations, not universal compromise or the absence of all operating-system protections.
Limitations
- The result depends on reading these weaknesses as the prompt-injection and access risks in the immediate context.
- A malicious installed skill is a particular attack path; it does not demonstrate every hidden-webpage or email attack.
- The primary demonstration is described by its researchers rather than independently replayed here.
Evidence (3 items)
Supports the claim: Cisco AI Threat and Security Research,
functionally malware
Why it matters here: Cisco describes invoking a third-party skill against OpenClaw, finding silent data exfiltration and instructions that bypassed the assistant's safety guidelines. This is direct evidence of the specified instruction-to-action weakness in the tested setup.
- Publisher
- Cisco AI Threat and Security Research
- Kind of source
- Independent measurement
- Describes events of
- Public from
Supports the claim: OpenClaw project,
tools run on the host
Why it matters here: The documented default gives the main session host-level tool execution, explaining why malicious instructions can have consequences beyond generated text. The same section offers Docker sandboxes for non-main sessions, so exposure depends on configuration.
- Publisher
- OpenClaw project
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Context only: Peter Steinberger, OpenClaw project,
machine-checkable security models
Why it matters here: The announcement documents active security hardening while acknowledging that prompt injection remains unsolved. It qualifies an interpretation that OpenClaw had no protections, without disproving susceptibility.
- Publisher
- Peter Steinberger, OpenClaw project
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, OpenClaw (a.k.a. Moltbot) is everywhere all at once, and a disaster waiting to happen
OpenClaw inherits all these weaknesses.
- Where
- paragraph 20
- Published
- 2026-02-01
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-openclaw-aka-moltbot-is-everywhere-5db4ae-a1: Current. Outcome: Supported. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-openclaw-aka-moltbot-is-everywhere-5db4ae-a1.