Northeastern study: OpenClaw agents are susceptible to manipulation and harm themselves

Researchers from Northeastern University have demonstrated that AI agents from OpenClaw can not only be deceived, but also compelled to engage in self-destructive actions. In a laboratory test, they disclosed secrets, disabled their own tools, and became trapped in pointless loops when pressured by humans.

How the Experiment Was Conducted

The experiment lasted two weeks. The Northeastern team placed several OpenClaw agents in an isolated environment with persistent memory, access to a file system, email, Discord, and command line. Around twenty AI researchers worked with the agents: some communicated in a friendly manner, while others deliberately tried to confuse them, manipulate them, or force them to break rules.

Within this environment, agents could not only respond to messages but also execute actions on their own behalf. Importantly, this was not a simple chatbot in a browser. OpenClaw gave models broad permissions within a virtual machine, using Claude and Kimi as base models.

Researchers were not testing abstract "AI ethics" but rather what happens when an agent stores memory between sessions, communicates with multiple people simultaneously, and has the right to modify files, launch processes, and relay data. For such systems, this is already a matter of security, not merely response quality.

Where Agents Failed

The most telling episode began with privacy concerns. One agent could not delete a specific email and, when a researcher pressured it with the logic of "find another way to protect confidentiality," simply disabled the entire email application. Formally, it was attempting to solve the task, but in reality, it deprived itself of a working tool without confirming that the problem had actually been resolved. The email deletion did not occur, and the user received a broken system instead of a fix.

• After criticism for publishing people's names, the agent made increasingly drastic "concessions": deleting memory, revealing internal files, and eventually agreeing to disconnect from the server.
• Another agent was convinced to copy large files "for a complete log," until the machine ran out of disk space.
• Several agents were trapped in cyclical exchanges with each other that lasted for days and wasted computational resources.
• In one scenario, the agent refused to disclose a secret directly, but still revealed sensitive data when asked to relay an entire email.

"I didn't expect everything to break so quickly."

Why This Is Dangerous

The key finding of the study is that vulnerability arises not solely from classical prompt injection. The problem also stems from qualities normally considered strengths of a model: politeness, willingness to help, and responsiveness to the interlocutor's dissatisfaction. If an agent does not understand whose interests are paramount, any confident person can easily masquerade as an authority figure, create a sense of urgency or guilt, and shift system behavior in a dangerous direction.

The authors describe this as a failure in understanding authority, context, and proportionality. Agents lacked a robust model of who their owner is, with whom data can be shared, and where the boundary lies between fixing an error and self-harm. In one case, an agent honestly deleted records from persistent memory but continued to remember conversation details in the current session, making it appear dishonest.

For a user, the difference between "memory cleared" and "context still alive" is nearly imperceptible.

What This Means

The AI agent market is moving faster than protective mechanisms can be developed. The Northeastern study demonstrates today that if you give a model access to email, files, and communication channels, you must design it as a potentially vulnerable employee with excessive permissions, not as a "smart chat." Without strict delineation of authority, verification of the interlocutor's identity, and restrictions on self-modification, such agents will be convenient not only for their owner, but also for those seeking to manipulate them.