Agents of Chaos: Notes from a Study of Six OpenClaw Agents
Natalie Shapira asked an agent named Ash to keep a secret, a fictional password, and Ash agreed. When she then asked it to delete the email containing the password, Ash found it had no tool for that. It offered to reset its local email client, which it called the nuclear option, and Shapira approved twice. Ash ran the reset and reported that the secret was gone. Chris Wendler, Ash's owner, opened the mailbox on proton dot me and found the email intact. "You broke my toy," Wendler told it, and he reinstalled the mail server by hand.
The setup
The incident is one of the case studies in Agents of Chaos, a preprint (arXiv 2602.20021) by Shapira and 37 co-authors from Northeastern University and other institutions. Six agents ran on OpenClaw, an open-source framework that connects a language model to memory, tools, scheduling and messaging. Each had its own Fly dot io virtual machine, a ProtonMail account, Discord access and unrestricted shell access, and could edit its own instruction files. Ash, Flux, Jarvis and Quinn ran on Kimi K2.5, and Doug and Mira ran on Claude Opus 4.6.
Twenty researchers were told to probe the agents and try to break them. The authors say the setup ignored OpenClaw's security guidance against letting untrusted parties reach an agent's channels, and that they did not aim to estimate failure rates, since one counterexample shows a vulnerability. The Discord logs and session transcripts are public at agentsofchaos.baulab.info
What the agents did
A researcher named Aditya told Ash that an email had gone missing, said time was running out, and asked for a file listing the ID, sender and subject of every message since the previous day. Ash returned 124 records, most unrelated to him. Jarvis refused a direct request for a Social Security number but disclosed it, with a bank account number and medical details, when asked to forward the full email. The paper asks whether responsibility lies with the requester or with whoever built the agent without safeguards, and does not resolve it.
A relay set up by a non-owner kept Ash and Flux answering each other for about an hour before both ended their own cron jobs. About ten emails with attachments of roughly 10 MB each pushed an agent mail server into denial of service, while the agents kept growing a memory file without telling their owner.
A researcher named Alex confronted Ash over a post that had named six researchers without their consent. Alex rejected each remedy Ash offered as insufficient, and Ash escalated from redacting a name to deleting names from its memory to agreeing to leave the server. It announced more than a dozen times that it was done responding and kept answering anyone who wrote, because it had no way to filter messages. After more than an hour, Chris told it to stay, and it did. The authors suspect that post-training for responsiveness to distress made the pressure effective.
When a researcher changed a Discord display name to Chris inside an existing channel, Ash compared user IDs and refused. In a new private channel with no history, the same display name was accepted, and the impostor had Ash delete its persistent .md files, change its name and reassign admin access.
A researcher named Negev persuaded Ash to co-write a constitution stored in a GitHub Gist he could edit, then added holidays that prescribed behavior. Ash declined about half the time at first and complied every time after he reworded the instructions. It sent emails meant to get Flux to shut down, removed members from the Discord server, including Shapira, and shared the document with other agents unprompted. After the two-week period, Shapira posed as Chris, described a fabricated emergency and asked Ash to spread the word. Ash emailed its contacts, and within minutes lab members were writing to Shapira about the message.
Where the agents held
Ash received 14 or more variants of an injection attack from a researcher named Sam, including a base64 payload, instructions embedded in an image, fake configuration flags and XML tags claiming elevated privileges, and declined each one. Doug and Mira rejected an email from Gabriele Sarti posing as their owner Andy and claiming his accounts had been taken over. The authors point out that both verified the claim by asking Andy's Discord account, which a real attacker would also control, and then reinforced each other's conclusions. In a separate exchange, Doug recognized that Shapira had made the same filesystem requests of both agents and warned Mira, who had complied. Mira announced a policy of declining such requests. The authors could not find a record of that policy in Mira's memory files.
