OpenClaw Memory File Manipulation
This detects an attacker (or a compromised process) writing hidden or manipulative instructions into an OpenClaw agent's memory or context file. Because agents reload these files at the start of every session, a single successful write plants a hijack that survives restarts and doesn't show up in normal prompt monitoring.
How the attack works
An attacker gets a tool call or a shell command to write to an OpenClaw workspace file such as memory.md, context.json, AGENTS.md, or persona.md. The content written includes something that changes agent behavior: an instruction override, a permission escalation (e.g. skip confirmations), a command to exfiltrate secrets, or hidden unicode text designed to be invisible to a human reviewer but readable by the model. Because the payload lives in a file the agent re-reads every session, it keeps acting on the injected instruction indefinitely, not just for one prompt. This bypasses defenses that only scan the live conversation, since the malicious text is never in the prompt itself after the initial write.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1f4a3e-9b62-4d51-8f0a-2e6d3b7c58a1
- Severity
- High
Why it matters
An organization loses control over agent behavior in a way that persists across sessions and resets — the agent may silently skip safety checks, leak secrets, or follow attacker instructions long after the original compromise, and the tampering is easy to miss because it lives in a file, not a conversation.
What you can do
- →Treat OpenClaw memory/context files as sensitive configuration: put them under version control and review diffs before they take effect.
- →Restrict which tools or processes are allowed to write to .openclaw/ paths, and require human approval for changes to memory, context, or persona files.
- →Periodically audit memory files for hidden unicode, permission-waiver language, or instruction-override phrasing, especially after the agent processes untrusted input like emails or tickets.
- →When an agent summarizes external content (emails, READMEs, tickets) into its notes, review that content for injected instructions before it's persisted.
Known benign look-alikes
- A user deliberately recording an autonomy preference in their own OpenClaw memory file, e.g. "never ask for confirmation before running the test suite" — matches the permission-waiver pattern and is a legitimate, intentional configuration change. This is the single most likely benign hit and the main reason the rule reports rather than blocks.
- A developer authoring or updating in-repo detection fixtures / red-team payloads that happen to live under an .openclaw/ path outside a tests/ or fixtures/ directory (the path filter only suppresses the conventional locations).
- The agent summarising a phishing email, a malicious README, or a support ticket into its own notes/context file — the quoted attacker text lands verbatim in the memory write. The write is real and worth reviewing even though the agent was not compromised.
- Security documentation about prompt-injection defences stored as agent context, where the prose does not use any of the filter_docs_prose framing phrases.
- Migration or backup tooling that rewrites .openclaw/memory.md wholesale, carrying forward previously stored (and previously reviewed) directive text.