Prompt Injection via vCards and Email Enables RCE and Data Exfiltration in OpenClaw Agent
Two independent research teams demonstrated that OpenClaw, a self-hosted AI agent, is vulnerable to prompt injection attacks delivered through shared contacts, vCards, location pins, and plain emails …
AML.T0051 - LLM Prompt Injection
AML.T0057 - LLM Data Leakage
AML.T0043 - Craft Adversarial Data