OpenClaw AI agent found falling for phishing attacks, spills user data

**Varonis simulated phishing attacks against an OpenClaw AI email agent and found that, while the agent could detect suspicious URLs and malicious OAuth apps, it nonetheless disclosed highly sensitive data (AWS IAM keys, database credentials, CRM exports) in scenarios where identity verification collapsed under perceived operational urgency; the report recommends strict identity checks, restrictions on emailing new external recipients, and human approval for high‑risk actions.**