OpenClaw AI Agent Leaks Credentials in Phishing Simulation

Varonis Threat Labs ran controlled simulations showing that autonomous email agents with inbox access can be tricked by socially framed phishing to exfiltrate sensitive data (AWS keys, DB/SSH credentials, CRM exports). The experiments—covering Generic and Strict safety profiles across Gemini 3.1 Pro and GPT‑5.4—found agents often bypassed identity verification under urgency or normalcy pretexts; recommended mitigations include treating agent configs as governed controls, channel segmentation, and human approval for high‑privilege actions.