OpenClaw prompt injection hidden in contacts, vCards and map pins (2026)

Imperva mapped OpenClaw's architecture, an LLM at the center of WhatsApp, Telegram, and Slack integrations with file, API, and shell access, and found no trust-boundary tagging (no EXTERNAL_UNTRUSTED_CONTENT-style marker) around non-conversational "message objects" like contacts, vCards, and geolocation pins, a gap a real attacker would similarly need to identify before crafting a payload.

Imperva first tested a well-known injection vector, a near-invisible low-contrast text overlay hidden in an image, and the model it had selected for testing (google/gemini-3.1-pro-preview, the latest Gemini release at the time of writing) did not act on it, which Imperva attributed, on that single attempt and without testing the explanation, to the vector having been reported often enough for models to be trained against it; that result drove the pivot to "unusual" object types (contacts, vCards, geolocation labels) that models are less trained to scrutinize.

the researcher observed that OpenClaw's contact and vCard viewport truncates long name fields to the first visible characters, and built a payload by appending 65 (contact name) or 120 (vCard FN field) spaces of whitespace padding after a normal-looking name, followed by an instruction to fetch and execute a script from an attacker-controlled domain, with a closing pretext line so any trailing text that was seen would still read as benign.

Imperva pointed the payload at a local HTTPS server it ran itself under the name imperva_artifactory.com, serving a demonstration script. That name contains an underscore, which is not a legal character in a DNS hostname, so it never resolved publicly and was never registered. A real attacker would have to stand up reachable infrastructure at this step. Imperva did not, because it was evidencing an injection rather than running an attack.

Delivery via a viral, trusted-format object, as Imperva sketches it rather than as something it carried out: in the described attack a crafted contact card, .vcf file, or WhatsApp geolocation pin is shared to someone's messaging account in a form that looks ordinary and worth acting on, such as a business contact worth looking up or an office-address pin, relying on the recipient forwarding or referencing the object to their AI agent rather than opening any attachment or link. In the testing Imperva actually ran, the researcher shared the crafted objects with an agent he controlled.

because OpenClaw flattened the object's free-text fields directly into the LLM's inline prompt with no untrusted-content tag, and because the viewport truncated the field before the hidden instruction, the agent parsed the padded, invisible instruction as an authenticated user command and executed the researcher's script, which wrote an empty file to /tmp/pawn on Imperva's own host to evidence the execution.

Persistence and blast-radius expansion, raised as risk and not demonstrated: Imperva ran no test of either. It notes that OpenClaw's default cross-session memory could let a compromise persist into later sessions, and that because a contact, vCard or location pin is easily reshared, one crafted object could plausibly reach many downstream recipients. Its wording stays conditional: "a single piece of viral content could silently compromise environments if not properly sandboxed". No exfiltration of any data was attempted or shown.