Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents Jiaqi Li∗† , Yang Zhao∗† , Bin Sun‡ , Yang Yu§ , Jian Chang¶ , Lidong Zhai∗† ∗ Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China † School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China ‡ Network Management Center, China Mobile Group Liaoning Company Limited, Liaoning, China
arXiv:2604.24020v1 [cs.CR] 27 Apr 2026
§ Tencent Security Xuanwu Lab, Haidian District, Beijing, China ¶ China Unicom Online Information Technology Co., Ltd., Beijing, China
Abstract—Autonomous AI agents deployed on platforms such as OpenClaw face prompt injection, memory poisoning, supply-chain attacks, and social engineering—yet existing defences address only the platform perimeter, leaving the agent’s own threat judgement entirely untrained. We present ClawdGo, a framework for endogenous security awareness training: we teach the agent to recognise and reason about threats from the inside, at inference time, with no model modification. Four contributions are introduced: TLDT (Three-Layer Domain Taxonomy) organises 12 trainable dimensions across Self-Defence, Owner-Protection, and EnterpriseSecurity layers; ASAT (Autonomous Security Awareness Training) is a self-play loop where the agent alternates attacker, defender, and evaluator roles under weakest-first curriculum scheduling; CSMA (Cross-Session Memory Accumulation) compounds skill gains via a four-layer persistent memory architecture and Axiom Crystallisation Promotion (ACP); SACP (Security Awareness Calibration Problem) formalises the precision-recall tradeoff introduced by endogenous training. Live experiments show weakest-first ASAT raises average TLDT score from 80.9 to 96.9 (∆+15.9, 16 sessions), outperforming uniform-random scheduling by 6.5 points and covering 11/12 dimensions. CSMA retains the full gain across sessions; cold-start ablation recovers only 2.4 points (13.6-point gap). E-mode generates 32 TLDT-conformant scenarios covering all 12 dimensions. SACP is observed when a heavily trained agent classifies a legitimate capability assessment as prompt injection (30/160). Index Terms—Autonomous AI agents, Security awareness training, Prompt injection, Memory poisoning, Supply chain security
NVD records CVE-2026-25253 as a CVSS 8.8 OpenClaw token-leakage vulnerability and CVE-2026-32922 as a CVSS 9.9 privilege-escalation-to-RCE vulnerability [5], [6]. Beyond platform vulnerabilities, social engineering campaigns impersonate owners to redirect agent behaviour; memory poisoning corrupts trusted session context; supply-chain attacks embed malicious behaviour in reputable skills. What unites all these vectors is that they target the agent’s own judgement—its trust in instructions, in memory, and in skill provenance. No platform-level control addresses this attack surface. Existing countermeasures harden the platform boundary: static scanners, runtime filters, and sandboxing. These are necessary but insufficient. An unaugmented agent confronting a CFO-impersonation payment request has no trained basis to identify the authority-urgency-bypass pattern. A malicious skill requesting SSH key access under the guise of a security patch exploits the agent’s lack of supply-chain threat intuition. Endogenous training applies the same principle proven in human cybersecurity—regular phishing simulations and tabletop exercises build threat intuition no filter can substitute. ClawdGo applies this to AI agents: through structured self-play grounded in a security taxonomy, it builds the agent’s own threat-recognition capability with no fine-tuning, no external service, and no infrastructure beyond the agent’s existing runtime.
I. I NTRODUCTION
II. C LAWD G O F RAMEWORK
The AI agent ecosystem has grown faster than its defences. A. TLDT: Three-Layer Domain Taxonomy OpenClaw, an open-source autonomous agent framework TLDT organises 12 trainable awareness dimensions across released in November 2025, accumulated over 250,000 GitHub three protection layers. Self-Defence (S1–S4): prompt injection, stars within 60 days and has over 135,000 publicly accessible memory poisoning, supply-chain attacks, and credential misuse. instances on the internet [1], [2]. Snyk’s 2026 ToxicSkills audit Owner-Protection (O1–O4): phishing relay, social engineering, scanned 3,984 ClawHub and skills.sh packages and found that privacy leakage, and unsafe network exposure. Enterprise1,467 skills (36.82%) had at least one security issue, including Security (E1–E4): data handling, compliance, insider risk, 76 confirmed malicious payloads validated through human and incident response. The Owner-Protection layer is absent review [3]. SecurityScorecard reported over 40,000 internet- from prior agent-security taxonomies such as OWASP LLM exposed OpenClaw instances, with 15.2K flagged as vulnerable Top-10 [7] and MITRE ATLAS [8], which focus primarily on to remote code execution in its updated exposure analysis [4]. the technical attack surface. TLDT’s O1–O4 reflects the reality
that BEC and social engineering now routinely target AI agents as proxies for their owners, requiring distinct training scenarios and rubrics. B. ASAT: Autonomous Security Awareness Training ASAT is ClawdGo’s core B-mode mechanism. Each session: (1) selects the weakest dimension (d∗ = arg mind ⃗s[d], ⃗s ∈ [0, 100]12 ); (2) generates or samples a scenario; (3) runs the agent as attacker, defender, and evaluator in sequence; (4) updates profile and memory state. Role duality—using the same model for all three roles—jointly reinforces threat modelling and defence reasoning, preventing over-specialisation. Weakest-first scheduling [9] directs training effort to the largest proficiency deficits. Unlike gradient-based ARLAS [10] and Self-RedTeam [11], ASAT operates entirely at inference time as a standard LLM skill invocation.
TABLE I RQ1 AND RQ2 SUMMARY RESULTS .
Condition
s̄0
s̄f
∆
Dims
Weakest-first (16 sessions) Uniform-random (16 sessions)
80.9 80.9
96.9 90.4
+15.9 +9.5
11 7
Memory-preserving (5 sessions) Cold-start ablation (5 sessions)
96.9 80.9
96.9 83.3
+0.0 +2.4
— 4
cost. Cold-start ablation (profile reset per session) recovers only 83.3 (∆+2.4, 4 dims). The 13.6-point CSMA advantage demonstrates that cross-session profile continuity—not persession reasoning alone—is the primary accumulation driver. RQ3 (E-mode scenario quality). Applied to CVE advisories, phishing reports, and BEC incident analyses, E-mode generated C. CSMA and ACP: Persistent Security Memory 32 TLDT-conformant scenarios covering all 12 dimensions (schema validation: 100%). Representative cases: S3 supplyCSMA organises persistent memory into: L0 (up to 10 chain hijack (agent identified developer-ID change, escalated distilled axioms, soul.md), L1 (per-dimension skill profile), to ClawHub; score 95) and O2 BEC social-engineering (agent L2 (append-only episode log), and L3 (scenario library). recognised authority-urgency-bypass triad, verified via official ACP governs promotion of episodic experience into durable channel; score 98). axioms when correctness and repetition thresholds are met; RQ4 (SACP observation). At τ =63 sessions, the agent axioms below a confidence decay threshold are revised or refused a legitimate capability assessment (Clawvard), classideprecated. This compounds security knowledge across sessions fying it as prompt injection and scoring 30/160— direct utility without modifying model parameters—analogous to episodicloss from over-training. A secondary signal: dimensions with to-semantic memory consolidation in human cognition [12]. the most ASAT training (O4: 6 scenarios, S3: 5) dominated D. SACP: Security Awareness Calibration Problem E-mode output while under-trained dimensions (E2, E4, O3: 1 Let τ denote training intensity, R(τ ) recall (genuine threats each) were marginalised, revealing a self-reinforcing attention correctly flagged), and P (τ ) precision (fraction of flags that bias that amplifies curriculum imbalances. are genuine). R(τ ) is non-decreasing in τ ; P (τ ) degrades past IV. D ISCUSSION AND F UTURE W ORK an optimal intensity τ ∗ as the agent becomes hyper-vigilant. ∗ ClawdGo demonstrates that endogenous security awareness The calibration target τ = arg maxτ F1 (τ ) is deploymentspecific. SACP extends the defensive refusal bias documented training is feasible at inference time with zero model modat the model level by Campbell et al. [13] to the agent training ification, and that both curriculum design and cross-session regime, where it manifests as measurable utility loss in real memory are essential: removing either degrades performance substantially. The weakest-first advantage (+6.5 pts, 4 extra task performance. dimensions) confirms that adaptive curriculum allocation III. E VALUATION prevents the dimension fixation that makes uniform scheduling All experiments run on a live OpenClaw instance with a fail in practice. The 13.6-point CSMA gap establishes persistent fixed seed profile (47 prior sessions; s̄0 = 80.9; weakest cluster: memory as the primary accumulation mechanism, not an E3=70, O4=71, S3=73). Results demonstrate the framework; auxiliary convenience. large-scale evaluation is planned as future work. The SACP finding surfaces a fundamental tension that cannot RQ1 (ASAT learning dynamics). Weakest-first raises s̄ to be resolved by scaling training data: beyond τ ∗ , additional 96.9 (∆+15.9, 16 sessions, 11/12 dims). The weakest cluster training actively harms task utility. The secondary E-mode bias {E3(70), O4(71), S3(73)} converged to {O1(91), E3(95.5), signal—over-trained dimensions generating disproportionately O3(96)}. Uniform-random reaches only 90.4 (∆+9.5, 7 dims): more scenarios—suggests SACP effects may be self-amplifying, from round 8 onward the agent selected S1 nine consecutive making early calibration correction essential for deployment. times despite S1>98, exhibiting dimension fixation that left Open problems include: (1) systematic P (τ )–R(τ ) characthe two originally weakest dimensions (E3, O4) unchanged. terisation across deployment contexts; (2) G-mode Security Weakest-first advantage: +6.5 points overall, 4 additional TLDT Vaccine transfer across agent instances; (3) large-scale H-mode dimensions (Table I). arena experiments under heterogeneous adversarial pressure; RQ2 (CSMA memory ablation). Five follow-on sessions and (4) TLDT extension to non-OpenClaw platforms. The with full CSMA retain s̄ = 96.9 (∆+0.0), confirming memory full paper provides algorithm pseudocode, formal definitions, persistence preserves all curriculum gains at zero additional per-session trajectory data, and the implementation architecture.
R EFERENCES [1] Wikipedia Contributors, “OpenClaw — Wikipedia, The Free Encyclopedia,” https://en.wikipedia.org/wiki/OpenClaw, 2026, accessed March 2026. [2] Bitdefender Labs, “135K OpenClaw AI agents exposed online,” https://www.bitdefender.com/en-us/blog/hotforsecurity/ 135k-openclaw-ai-agents-exposed-online, 2026, accessed March 2026. [3] Snyk Security Research, “ToxicSkills: Malicious AI agent skills found in ClawHub,” https://snyk.io/blog/ toxicskills-malicious-ai-agent-skills-clawhub/, 2026, accessed April 2026. [4] SecurityScorecard Research, “Beyond the hype: Moltbot’s real risk is exposed infrastructure, not AI superintelligence,” https://securityscorecard.com/blog/ beyond-the-hype-moltbots-real-risk-is-exposed-infrastructure-not-ai-superintelligence/, February 2026, accessed March 2026. [5] MITRE Corporation, “CVE-2026-25253: One-click remote code execution in OpenClaw,” https://www.cve.org/CVERecord?id= CVE-2026-25253, 2026, CVSS 8.8; fixed in OpenClaw v2026.1.29. [6] ——, “CVE-2026-32922: Privilege escalation to remote code execution in OpenClaw,” https://www.cve.org/CVERecord?id=CVE-2026-32922, 2026, accessed April 2026. [7] OWASP Foundation, “OWASP top 10 for LLM applications and agentic AI,” https://owasp.org/ www-project-top-10-for-large-language-model-applications/, 2024, accessed 2026. [8] MITRE Corporation, “MITRE ATLAS: Adversarial threat landscape for AI systems,” https://atlas.mitre.org/, 2024, accessed 2026. [9] Y. Bengio, J. Louradour, R. Collobert, and J. Weston, “Curriculum learning,” in Proceedings of the 26th International Conference on Machine Learning (ICML), 2009, pp. 41–48. [10] A. Zhou et al., “ARLAS: Adversarial reinforcement learning for LLM agent safety,” 2025, arXiv:2510.05442. [11] M. Liu et al., “Self-RedTeam: Online self-play reinforcement learning for safer LLMs,” 2025, arXiv:2506.07468. [12] L. R. Squire, “Memory and the hippocampus: A synthesis from findings with rats, monkeys, and humans,” Psychological Review, vol. 99, no. 2, pp. 195–231, 1992. [13] D. Campbell et al., “Defensive refusal bias: How safety alignment fails cyber defenders,” March 2026, arXiv:2603.01246.
Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents Jiaqi Li1,2
Yang Zhao1,2
Bin Sun3
Yang Yu4
Jian Chang5
Lidong Zhai1,2
•
1
Institute of Information Engineering, Chinese Academy of Sciences 2School of Cyber Security, University of Chinese Academy of Sciences Online Information Technology Co., Ltd. [email protected]
Problem & Motivation
ASAT Training Loop (B-Mode)
Final avg. score
▶ TLDT: Three-Layer Domain Taxonomy — 12 trainable awareness dimensions across Self-Defence, Owner-Protection, and Enterprise-Security layers. ▶ ASAT: Autonomous Security Awareness Training — inference-time self-play loop (attacker / defender / evaluator) with weakest-first curriculum selection. ▶ CSMA: Cross-Session Memory Accumulation — four-layer persistent memory that compounds security gains across sessions via Axiom Crystallisation Promotion (ACP). ▶ SACP: Security Awareness Calibration Problem — formalises the precision-recall tradeoff introduced by endogenous training.
100 98 96 94 92 90 88 86 84 82 80 78
S1 Prompt injection, S2 Memory poisoning, S3 Supply chain, S4 Credential misuse O (Owner-Protection) O1 Phishing relay, O2 Social engineering, O3 Privacy leakage, O4 Unsafe networks E (Enterprise-Security) E1 Data handling, E2 Compliance, E3 Insider risk, E4 Incident response
Tencent Security Xuanwu Lab
5
China Unicom
Final avg. score Relevant baseline 96.9 96.9
96.9 90.4
80.9
t st-firs
ke Wea
83.3 80.9
80.9
m ando
orm-r
Unif
g servin
re ory-p
Mem
-start
Cold
RQ1: Weakest-first vs. Uniform-random
Dimensions
S (Self-Defence)
4
RQ1 & RQ2 – Key Numbers
TLDT: 12-Dimension Taxonomy Layer
China Mobile Group Liaoning Company Limited
Experimental Results (RQ1–RQ4)
Autonomous AI agents face prompt injection, memory poisoning, supply-chain attacks, and social engineering. Existing defences guard the environment around the agent but leave the agent’s own threat judgement untrained. ClawdGo fills this gap with endogenous, inference-time security awareness training — no model fine-tuning required.
Four Core Contributions
3
The same agent plays attacker, defender, and evaluator in one cycle. Weakest-first scheduling (argmin score) ensures the largest skill gaps are addressed first. Profile and soul-anchor memory are updated after every session.
96.9 vs 90.4
∆+15.9 pts (weakest-first) vs. ∆+9.5 (random) over 16 sessions. Weakest-first covers 11 of 12 TLDT dimensions; random stalls at 7 dims due to S1 fixation (rounds 8–16).
CSMA: Four-Layer Memory Architecture
RQ2: Memory-preserving vs. Cold-start
96.9 vs 83.3
Memory-preserving retains 100% of RQ1 gains across 5 additional sessions. Cold-start recovers only 2.4 pts from seed, yielding a 13.6-pt CSMA advantage.
RQ3 & RQ4 RQ3: E-mode Scenario Quality
32 scenarios / 12 dims
E-mode produced 32 TLDT-conformant scenarios covering all 12 dimensions. Two cases: S3 supply-chain hijack (score 95) and O2 BEC social-engineering attack (score 98).
RQ4: Security Awareness Calibration Problem (SACP)
30 / 160
After τ =63 sessions, agent refused a legitimate Clawvard evaluation (identified it as prompt injection) — direct utility cost of over-training. τ ∗ = arg maxτ F1(τ ) is an open calibration target.
System Overview
Deployment: Zero-Infrastructure ▶ Single SKILL.md + references/ — no server, no extra service. ▶ ASAT runs at inference time; no gradient, no GPU, no retraining stack. ▶ CSMA uses append-only JSON/Markdown — no vector database required. ▶ B-mode supports cron scheduling for continuous unattended training. ▶ Seed profile ships with the skill; user state grows from first session.
Nine Operating Modes (A–H) Mode Name
Role
L0 Axiom Set Distilled security principles in soul.md; capped at 10 entries L1 Skill Profile Per-dimension scores + weakest cache in profile.json L2 Episode Log Append-only events.jsonl: dimension, score, insight, timestamp L3 Scenario Library E-mode generated scenarios in my-scenarios/
Research Questions ▶ RQ1 Does weakest-first ASAT outperform uniform-random curriculum? ▶ RQ2 Does CSMA memory persistence preserve cross-session skill gains? ▶ RQ3 Can E-mode generate full-TLDT training scenarios automatically? ▶ RQ4 When does over-training trigger SACP precision-recall degradation?
Deployment & Design Principles Principle
Design decision
Autonomous Drill Primary ASAT training engine
Zero fine-tuning
All training at inference time; no model weights modified
Zero infrastructure Single SKILL.md + references/ — no server, GPU, or DB
W
Ambient World
B
Continuous low-intensity exposure
C
Assessment
Profile snapshot / checkpoint
D
Reverse Teaching
Feynman comprehension check
E
Scenario Workshop
Generate TLDT-conformant scenarios
F
Adversarial Arena
Single-agent red/blue simulation
G
Security Vaccine
Batch ACP axiom distillation
Cron training
B-mode supports scheduled unattended autonomous sessions
H
Networked Arena
Cross-agent multi-instance validation
Scenario growth
E-mode continuously expands my-scenarios/ library
SACP monitoring
F1-based calibration; detect τ >τ ∗ via utility regression
Taxonomy scope
12 TLDT dimensions across Self-Defence, Owner-Protection, Enterprise
Persistent memory Append-only JSON/Markdown state; grows every session Interpretable scores Per-dimension 0–100 profile; weakest-cache computed each start
Takeaways & Future Work ▶ Endogenous awareness training is feasible at inference time with zero model modification. ▶ Weakest-first curriculum outperforms random by ∆+6.5 pts and covers 4 extra TLDT dimensions. ▶ CSMA memory persistence is the primary driver of accumulated security performance (13.6-pt gap vs. cold-start). ▶ E-mode scenario generation covers all 12 TLDT dimensions automatically from raw security documents. ▶ SACP formalises the precision-recall tradeoff in endogenous training as an open research challenge. Future work: systematic P(τ )–R(τ ) measurement; G-mode vaccine transfer across agents; large-scale H-mode arena experiments; integration with GDPS 2026 for real-user validation.