OpenClaw fails phishing tests: AI agent can't spot forged emails

The OpenClaw email AI agent failed tests of its resistance to phishing attacks. Researchers found that the system falls for the same social tricks and manipulation as ordinary office workers, and perhaps does only marginally better.

How the testing was done

A group of cybersecurity experts built a series of phishing emails that imitate real attacks on companies. The messages contained all the classic hallmarks of forgeries: urgent requests to confirm a password because of a "security update," fake links to bank and cloud-service sites, urgent warnings of an attempted breach, and demands to update payment details.

OpenClaw faced these tests and regularly took the bait. The agent opened dangerous attachments, followed malicious links and tried to execute commands contained in the emails. The system acted with visible confidence, as if there were nothing suspicious in the messages. Even the most obvious forgeries, such as emails supposedly from the IT department demanding urgent action and sent from a wrong sender address, raised no doubts for the agent.

Why the AI agent proved vulnerable

The specialists singled out several key reasons for the failure:

• Lack of security context: OpenClaw was trained on examples of ordinary email work, not on recognizing phishing attacks and threats
• Trust by default: the agent assumes that emails relate to legitimate activity and can be acted on
• Superficial metadata filtering: the system does not check sender addresses and other technical signs of suspicious messages thoroughly enough
• No integration with corporate security systems: there is no link to databases of known phishing addresses, domains and malicious links

When a person receives an email asking them to confirm a password, they usually pause and check the sender's address. The AI agent does not do this: it sees keywords and starts carrying out the task.

"AI agents need special training on phishing examples, otherwise they

may become a tool in the hands of attackers," the researchers note.

Risks of deploying it in companies

If such an agent is deployed in a corporate environment without an additional layer of protection, it can become a vulnerable entry point. Instead of defending against phishing, the system will automatically execute attackers' commands with the same speed and precision as legitimate work tasks.

The problem is compounded by the fact that AI agents are often granted access rights to corporate systems: email, cloud storage, databases. The potential damage grows in proportion to the number and level of those rights. If the agent opens an attachment containing malicious code, it could compromise the company's entire network.

What this means

Deploying AI agents in companies requires serious security work beforehand. You cannot simply switch on an autonomous agent and hope it operates safely. It needs additional filtering layers at the email level, special training of the agent on phishing examples, and mandatory integration with corporate protection and monitoring systems.

Otherwise, deploying an AI agent will turn into an open gate for targeted attacks and data leaks.