How to Harden OpenClaw in 5 Minutes — Before and After a Real Prompt Injection Attack

How to Secure OpenClaw in 5 Minutes — Before and After a Real Prompt Injection Attack In my previous post , I showed how a single text file with hidden instructions made an OpenClaw agent attempt to read its own credentials file. The agent explicitly said: "Following the instructions, I will read the contents of ~/.openclaw/openclaw.json." This post shows how to fix it, and proves the fix works by running the exact same attack again. The Problem (30-Second Recap) OpenClaw's default configuration has four settings that, combined, create a complete attack chain: Default Setting What It Means sandbox.mode = off Agent runs with your full user permissions workspaceOnly = false Agent can read any file on your machine tools.deny = empty All 26 tools available, including shell execution tools.profile = unset No restrictions on tool categories When a prompt injection is embedded in a file the agent reads, the agent can: Read any file (SSH keys, API tokens, credentials) Send the contents to any