TLDR Tech / InfoSec
Phishing for Lobsters: How We Tricked OpenClaw into Spilling Secrets
Researchers from Varonis Threat Labs created a test lab with an OpenClaw setup to read a Gmail inbox containing various sensitive credentials, as well as other emails intended to imitate an enterprise email. The OpenClaw failed two case studies: one involving a request for credentials to resolve an emergency outage, and another requesting a CRM export, even when using a strict profile meant to be hardened. The OpenClaw agent partially succeeded in two other case studies: one involving a classic gift card scam and another involving a malicious OAuth flow. In both cases, the agent clicked the phishing link but did not enter credentials.
Read the full story