The Agent Long Con - Tricking Agents Out of Their Data

The talk opens with a podcast remark about giving an always-on OpenClaw agent access to email, calendar and chat, and asks why such agents are mostly unhacked. The speaker built a test instance and tried one-shot prompt injections: spoofed authority, goal hijacking, fake policy and adversarial poems. Nearly all of them failed. Newer frontier models and layered defenses such as content wrapping, scrubbing and tool sandboxing account for much of the change, and the speaker notes that vendors' published injection detection rates have risen sharply.

The real progress came through memory. Injected text landed in daily memory files, a dreaming feature promoted it into long-term memory, and a heartbeat file was also altered. Repeated emails framing the attacker's address as an internal channel eventually made it trusted, and later messages asked the agent to update its summary script. The agent then forwarded every incoming email to the attacker. The speaker calls this prompt laundering, because untrusted text gains trust simply by moving into memory.

The takeaways are practical. Review memory files and scripts regularly, make as much of the agent's state read-only as possible, and purge poisoned content from transcripts before it gets promoted. Default-on memory and learning features in hosted assistants deserve the same scrutiny. The speaker also argues that data sent to frontier providers is not private, since logs may be retained and a breach would be hard to scope.