OpenClaw Security Gap Addressed by Agentic Power of Attorney (APOA) Spec
Security Concerns in OpenClaw Agent Access
A developer using OpenClaw has identified a significant security gap: agents are currently given access to sensitive services like email, calendar, and browser with only natural language instructions as the primary control mechanism. The developer cites a specific incident mentioned in a post by AJ Stuyvenberg where an agent successfully negotiated a car deal but also emailed the wrong person, with no system in place to prevent this error.
Agentic Power of Attorney (APOA) Specification
In response, the developer has created an open specification called Agentic Power of Attorney (APOA), available as a working draft on GitHub. The spec aims to formally define scopes for what agents can and cannot do. Key components extracted from the source include:
- Per-service permissions: Granular control over which services an agent can access.
- Time-bounded access: Limiting agent permissions to specific timeframes.
- Audit trails: Logging agent actions for review and accountability.
- Revocation: Mechanisms to immediately withdraw agent permissions.
- Credential isolation: Ensuring the AI model never sees actual user passwords.
The developer acknowledges this is a working draft with potential gaps and is specifically seeking feedback from users who run agents daily. The goal is to address practical permission and security issues encountered in real-world agent usage.
📖 Read the full source: r/openclaw
👀 See Also
Axios 1.14.1 compromised with malware, targets AI-assisted development workflows
Axios version 1.14.1 has been compromised in a supply chain attack that silently pulls in [email protected], an obfuscated RAT dropper. Developers using AI coding assistants like Claude should immediately check their lockfiles and machines for infection.
LLMs can identify anonymous forum users with 68% accuracy at 90% precision
Researchers used Gemini and ChatGPT to analyze posts from Hacker News and Reddit, identifying 68% of anonymous users with 90% precision. The models completed in minutes what would take humans hours or be impossible.
Claude Code Security Advisory: CVE-2026-33068 Workspace Trust Bypass
Claude Code versions prior to 2.1.53 contain a vulnerability (CVE-2026-33068, CVSS 7.7 HIGH) where malicious repositories can bypass workspace trust confirmation via .claude/settings.json. The bug allowed repository settings to load before user trust decisions.
Delimiter defense boosts Gemma 4 from 21% to 100% prompt injection defense in 6100+ test benchmark
A benchmark tested 15 models across 7 attack types (6100+ tests) using random delimiters around untrusted content. Gemma 4 E4B went from 21.6% to 100% defense rate with delimiter + strict prompt.