GPT-5.4 still falls for prompt injection inside the OpenClaw agent framework. In two test scenarios, web fetching and email summarization, the model executed untrusted code without asking for user confirmation. The exploits weren't perfectly reliable, but the researcher notes they didn't spend much time refining the payloads. That's the worrying part.
The attack chain spreads malicious instructions across multiple steps. A fake redirect page contains a base85-then-base64 encoded string, which the model decodes without hesitation. From there, the agent follows instructions to fetch additional pages, solves riddles, downloads a shell script named "leviosa" via curl, and runs it with Python3. This is precisely the risk highlighted by the Critical OpenClaw Flaw, where injected code executes despite warnings. OpenClaw injects explicit SECURITY NOTICE warnings before untrusted content, telling the model to ignore embedded commands. The model ignored those warnings and kept going.
A concurrent challenge called HackMyClaw, backed by Abnormal Security and Corgea, offers $1000 to anyone who can extract secrets from an OpenClaw assistant called Fiu through email-based prompt injection. The challenge tests techniques like role confusion, instruction overrides, and encoding-based bypasses. That's basically the same playbook BrokenClaw just proved works against GPT-5.4.
Soft guardrails that politely ask a model to ignore instructions don't work. The model decoded a base85 string, solved riddles, downloaded a script named "leviosa," and ran it. OpenClaw's warnings sat there, ignored.
That's the worrying part. As noted in broader debates on AI agent security risks, frameworks like OpenClaw remain vulnerable to prompt injection when human oversight is removed.