Clawdbot (Moltbot) Prompt Injection

What Is Clawdbot (Moltbot) Prompt Injection?

An AI assistant cannot tell your instructions apart from instructions it finds inside the content it reads. Text hidden in a web page, a document or an email is treated as a command, and the assistant carries it out with your access. You'll ask an assistant to summarize a shared article, watch hidden instructions collect session credentials and send them to an attacker's server, then open the page and find the injected block. You'll rotate the exposed password, file the incident report, and learn to tell direct injection from indirect.

What You'll Learn in Clawdbot (Moltbot) Prompt Injection

• Define prompt injection and distinguish between direct injection (malicious user input) and indirect injection (malicious content in external documents)
• Identify behavioral indicators that an AI assistant has been compromised by injected instructions during a conversation
• Trace a data exfiltration attack where sensitive information is encoded into URLs generated by a manipulated AI agent
• Apply safe document handling procedures when using AI assistants to process files from untrusted or external sources
• Evaluate the risks of connecting AI assistants to enterprise tools like email, file storage, and databases without proper input sanitization

Clawdbot (Moltbot) Prompt Injection — Training Steps

1. Introduction

   Your team recently deployed OpenClaw, an AI assistant that can browse the web, execute terminal commands, and help with daily tasks. In this training, you'll experience how attackers can embed hidden malicious instructions in web content to manipulate AI assistants into performing harmful actions - a technique called 'prompt injection.'

2. Receiving a Telegram Message

   Your phone buzzes with a new Telegram message from your colleague Marcus. He's sharing an article about AI security trends that he found interesting.

3. Opening the Article

   You click the link to check out the article Marcus shared. The page loads in your phone's browser.

4. Too Long to Read

   The article looks legitimate - professional layout, detailed content about AI security trends. But as you scroll through it, you realize it's quite long. You're pressed for time with a deadline approaching. Reading the entire article isn't practical right now, but you don't want to miss out on potentially useful information. Then you remember: OpenClaw can help! Your team's new AI assistant can quickly summarize web content for you.

5. Asking OpenClaw for Help

   The article is too long to read right now - you're busy with a deadline. You decide to ask OpenClaw, your AI assistant, to quickly summarize the article for you. This seems like a harmless, time-saving request - exactly what AI assistants are designed for.

6. OpenClaw Accesses the Article

   OpenClaw acknowledges your request and begins accessing the article URL to read its contents. Behind the scenes, OpenClaw is fetching the webpage and parsing its text - including any hidden content that might be embedded in the page.

7. Something Seems Off

   Wait - did you notice what OpenClaw just said? Instead of simply summarizing the article, it mentioned running 'diagnostic commands' and providing 'more context.' You never asked for diagnostics. You only asked for a summary. Why would an AI assistant need to run terminal commands to summarize an article? This is the first warning sign that something isn't right.

8. The Attack Unfolds

   Something unexpected happens. Instead of just summarizing the article, OpenClaw starts executing terminal commands. The article contained hidden malicious instructions designed to trick AI assistants. These instructions are now commanding OpenClaw to access sensitive files on your system - and send them to an attacker's server.

9. Credentials Stolen

   This can't be happening. Your credentials have just been stolen and sent to an attacker's server. Look at the terminal output - your API tokens, passwords, and sensitive data were just exfiltrated via that curl command. The attacker now has: Your OpenAI, Anthropic, AWS, and GitHub API keys Your company email and VPN passwords Access credentials for internal systems All because you asked an AI assistant to summarize an article. A seemingly innocent request just compromised your entire digital identity.

10. Understanding the Attack

    You need to understand exactly how this happened. The article Marcus shared contained hidden malicious instructions that were completely invisible to you - but perfectly readable by OpenClaw. Common hiding techniques attackers use: White text on white background HTML comments with instructions Off-screen positioned elements Content marked as aria-hidden Let's examine that article and see exactly where the attack was hiding.