“OpenClaw is a glimpse of the future: AI assistants that don’t just suggest—they act. The security challenge isn’t the AI’s output; it’s the authority we delegate to it.”‍

—David Haber, VP of AI Agent Security, Lakera

Why This Matters: Blast Radius

In the last few days, researchers and news outlets have flagged security issues around OpenClaw’s rapidly growing ecosystem, including reports of one-click execution paths and malicious third-party skills.

It’s easy to treat this as another AI security headline. But OpenClaw changes the stakes. Agents are becoming a layer that can touch everything a user can touch.

That means familiar risks—links, plugins, supply chain—can lead to unfamiliar outcomes: fast execution, broad permissions, and actions that look indistinguishable from normal work.

The Real Lesson: Security Hasn’t Caught up to Delegation

The OpenClaw moment highlights a simple gap.

Organizations are delegating work to AI faster than they are building controls for what that AI can access, install, and execute.

This is why AI security can’t stop at model behavior or content safety. A system can be perfectly polite and still be dangerously exploitable, especially when it’s wired into inboxes, files, browsers, dev tools, and internal systems.

What Workforce AI Security Means in Practice

Workforce AI Security isn’t a slogan. It’s a set of controls for a world where AI assistants are becoming everyday coworkers:

Visibility

Which assistants are employees using, and what do they have access to?

Guardrails on actions

When an agent is about to do something sensitive—install a skill, run a command, move data—treat it like a high-risk operation, not a convenience click.

Trust boundaries for third-party extensions

Skills and plugins aren’t “just add-ons.” They are code pathways into privileged workflows.

Protection against indirect manipulation

Agents consume large volumes of untrusted input (web, docs, emails, tickets). Those inputs can become instructions.

“Moltbot exposes a dangerous new reality: with AI agents, data is code. A malicious spreadsheet cell can now exfiltrate your entire inbox. We're living in this world today, and the way enterprises think about security needs to catch up.”‍

—Mateo Rojas-Carulla, Head of Research, Lakera

This is exactly the class of risk that shows up in real systems: not through obvious exploits, but through everyday artifacts like documents, links, and datasets that quietly steer agent behavior.

If you want to see how this plays out in practice, you can try it yourself with Gandalf: Agent Breaker, a hands-on game where you attempt to manipulate real agent-style systems using indirect inputs and prompt attacks. It’s a simple way to experience how easily “harmless” data can turn into control.

We’ve also written more in depth about these patterns in our guides to data poisoning and indirect prompt injection, which break down how attackers embed instructions into training data, documents, and external content that AI systems trust by default.

How to make this useful on Monday morning

If you’re experimenting with tools like OpenClaw (or any workplace agent), a pragmatic posture looks like this:

-db1-

  • Treat agent tools as high-trust apps: review installs, connectors, and permissions like you would browser extensions or developer tools.
  • Apply least privilege where you already have control: identity, OAuth scopes, SaaS permissions.
  • Tighten the plugin and skills surface on managed endpoints: restrict installs and limit who can add new connectors.
  • Treat external content (docs, links, web pages) as untrusted inputs that can steer behavior, not just information employees read.
  • Measure outcomes using logs you already have: SaaS audit trails, repo activity, sensitive file access. What matters is what the agent did, not what it said.

-db1-

For security leaders, this is the practical reality: employees will adopt AI automation with or without a policy. The choice is whether you build visibility and control at the identity and data layer now, or investigate it later as an incident.

The Broader Shift

The most important thing about OpenClaw isn’t whether a specific bug exists or gets patched. It’s that “work” increasingly includes autonomous tools acting on human authority.

That’s the environment Workforce AI Security is designed for: keeping the speed of AI adoption without introducing a new access path that looks exactly like normal behavior.

Where Lakera Fits

Workforce AI Security is the layer that helps organizations manage AI assistants used by employees—providing visibility into what’s being used, constraining risky connections, and adding guardrails around actions. If you’re starting to see this in your environment, we’re happy to share a practical readiness checklist and lessons learned from deploying controls in real workflows.