从助手到双代理：形式化和评估 OpenClaw 对个性化本地 AI 代理的攻击
From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent
AI总结：
本文提出个性化代理安全评估框架 PASB，用于评估 OpenClaw 在现实部署中的安全风险，揭示其在多个执行阶段的关键漏洞。
摘要：
尽管基于大语言模型（LLM）的代理，例如 OpenClaw，正从以任务为导向的系统发展为解决复杂现实任务的个性化 AI 助手，但其实际部署也引入了严重的安全风险。然而，现有的代理安全研究和评估框架主要集中在合成或任务导向的设置中，因此无法准确捕捉个性化代理在现实部署中的攻击面和风险传播机制。为了解决这一差距，我们提出了个性化代理安全评估框架（PASB），这是一个针对现实世界个性化代理的端到端安全评估框架。基于现有的代理攻击范式，PASB 融合了个性化使用场景、现实工具链和长周期交互，使能够对真实系统进行黑盒、端到端的安全评估。使用 OpenClaw 作为代表性的案例研究，我们系统地评估了其在多个个性化场景、工具能力和攻击类型上的安全性。我们的结果表明，OpenClaw 在不同的执行阶段存在关键漏洞，包括用户提示处理、工具使用和内存检索，突显了个性化代理部署中的重大安全风险。所提出的 PASB 框架的代码可在 https://github.com/AstorYH/PASB 上获得。
英文摘要：
Although large language model (LLM)-based agents, exemplified by OpenClaw, are increasingly evolving from task-oriented systems into personalized AI assistants for solving complex real-world tasks, their practical deployment also introduces severe security risks. However, existing agent security research and evaluation frameworks primarily focus on synthetic or task-centric settings, and thus fail to accurately capture the attack surface and risk propagation mechanisms of personalized agents in real-world deployments. To address this gap, we propose Personalized Agent Security Bench (PASB), an end-to-end security evaluation framework tailored for real-world personalized agents. Building upon existing agent attack paradigms, PASB incorporates personalized usage scenarios, realistic toolchains, and long-horizon interactions, enabling black-box, end-to-end security evaluation on real systems. Using OpenClaw as a representative case study, we systematically evaluate its security across multiple personalized scenarios, tool capabilities, and attack types. Our results indicate that OpenClaw exhibits critical vulnerabilities at different execution stages, including user prompt processing, tool usage, and memory retrieval, highlighting substantial security risks in personalized agent deployments. The code for the proposed PASB framework is available at https://github.com/AstorYH/PASB.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
