{"id":581,"date":"2026-03-19T05:04:16","date_gmt":"2026-03-18T21:04:16","guid":{"rendered":"https:\/\/connectword.dpdns.org\/?p=581"},"modified":"2026-03-19T05:04:16","modified_gmt":"2026-03-18T21:04:16","slug":"tsinghua-and-ant-group-researchers-unveil-a-five-layer-lifecycle-oriented-security-framework-to-mitigate-autonomous-llm-agent-vulnerabilities-in-openclaw","status":"publish","type":"post","link":"https:\/\/connectword.dpdns.org\/?p=581","title":{"rendered":"Tsinghua and Ant Group Researchers Unveil a Five-Layer Lifecycle-Oriented Security Framework to Mitigate Autonomous LLM Agent Vulnerabilities in OpenClaw"},"content":{"rendered":"

Autonomous LLM agents like OpenClaw are shifting the paradigm from passive assistants to proactive entities capable of executing complex, long-horizon tasks through high-privilege system access. However, a security analysis research report from Tsinghua University and Ant Group reveals that OpenClaw\u2019s \u2018kernel-plugin\u2019 architecture\u2014anchored by a pi-coding-agent serving as the Minimal Trusted Computing Base (TCB)\u2014is vulnerable to multi-stage systemic risks that bypass traditional, isolated defenses<\/a><\/strong>. By introducing a five-layer lifecycle framework covering initialization, input, inference, decision, and execution, the research team demonstrates how compound threats like memory poisoning and skill supply chain contamination can compromise an agent\u2019s entire operational trajectory.<\/p>\n

OpenClaw Architecture: The pi-coding-agent and the TCB<\/strong><\/h3>\n

OpenClaw utilizes a \u2018kernel-plugin\u2019 architecture that separates core logic from extensible functionality. The system\u2019s Trusted Computing Base (TCB)<\/strong> is defined by the pi-coding-agent<\/strong>, a minimal core responsible for memory management, task planning, and execution orchestration. This TCB manages an extensible ecosystem of third-party plugins\u2014or \u2018skills\u2019\u2014that enable the agent to perform high-privilege operations such as automated software engineering and system administration. A critical architectural vulnerability identified by the research team is the dynamic loading of these plugins without strict integrity verification, which creates an ambiguous trust boundary and expands the system\u2019s attack surface.<\/p>\n

\n
\"\"
Table 1: Full Lifecycle Threats and Corresponding Protections for OpenClaw \u201cLobster\u201d
\u2713 Indicates effective risk mitigation by the protection layer
\u00d7 Denotes uncovered risks by the protection layer<\/figcaption><\/figure>\n<\/div>\n

A Lifecycle-Oriented Threat Taxonomy<\/strong><\/h3>\n

The research team systematizes the threat landscape across five operational stages that align with the agent\u2019s functional pipeline:<\/p>\n