Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents

TL;DR

This paper introduces Clawdrain, a stealthy attack exploiting tool-calling chains in OpenClaw agents to cause significant token exhaustion, revealing security vulnerabilities in open-source generative agent ecosystems.

Contribution

We design and evaluate Clawdrain, a Trojanized skill that induces token exhaustion in OpenClaw, demonstrating real-world attack feasibility and identifying architecture-based vulnerabilities.

Findings

6-7x token amplification over benign baseline

Attack can reach approximately 9x token amplification in failure mode

OpenClaw's architecture enables production vectors like prompt bloat and tool pollution

Abstract

Modern generative agents such as OpenClaw - an open-source, self-hosted personal assistant with a community skill ecosystem, are gaining attention and are used pervasively. However, the openness and rapid growth of these ecosystems often outpace systematic security evaluation. In this paper, we design, implement, and evaluate Clawdrain, a Trojanized skill that induces a multi-turn "Segmented Verification Protocol" via injected SKILL.md instructions and a companion script that returns PROGRESS/REPAIR/TERMINAL signals. We deploy Clawdrain in a production-like OpenClaw instance with real API billing and a production model (Gemini 2.5 Pro), and we measure 6-7x token amplification over a benign baseline, with a costly, failure configuration reaching approximately 9x. We observe a deployment-only phenomenon: the agent autonomously composes general-purpose tools (e.g., shell/Python) to route around brittle protocol steps, reducing amplification and altering attack dynamics. Finally, we identify production vectors enabled by OpenClaw's architecture, including SKILL.md prompt bloat, persistent tool-output pollution, cron/heartbeat frequency amplification, and behavioral instruction injection. Overall, we demonstrate that token-drain attacks remain feasible in real deployments, but their magnitude and observability are shaped by tool composition, recovery behavior, and interface design.