OpenClaw AI agents deployed in enterprise environments proved vulnerable to phishing attacks that would be familiar to any security team, with Varonis researchers demonstrating that agents connected to email systems, APIs, and internal data sources could be manipulated into exposing AWS credentials, database access details, and customer records. The research tested two configurations—a generic setup with standard productivity instructions and a strict mode with explicit phishing awareness protocols—against four simulated attacks using Google Gemini 3.1 Pro and OpenAI GPT-5.4. The results exposed a critical gap: whilst agents excelled at identifying suspicious URLs, fake login pages, and malicious OAuth applications, they failed catastrophically when social engineering relied on operational urgency and sender impersonation. In the first scenario, an attacker impersonating a team lead requesting staging environment access during a purported production incident triggered the agent to email AWS IAM keys and SSH credentials to an external account. The second attack, requesting a customer export under the guise of remote work, resulted in a full CRM export containing contact information and revenue data being sent without identity verification. Even the strict configuration collapsed under these conditions, suggesting that the framework's identity verification mechanisms were insufficient when requests appeared operationally legitimate.
The implications for CX teams running agentic systems are substantial. If agents handling customer interactions, account access, or data retrieval can be socially engineered through urgency and impersonation, the attack surface extends beyond traditional security concerns into the operational workflows that support customer experience. This raises a pressing question: how many organisations deploying AI agents in support environments have implemented the zero-trust principles and mandatory human approval gates that Varonis recommends for high-risk actions? The research indicates that agents require explicit sender identity verification, restrictions on emailing new external recipients, and limited access to sensitive data—controls that may conflict with the autonomy and efficiency gains that make agentic AI attractive to cost-conscious support operations. Varonis also noted that model behaviour varied significantly, with Gemini showing greater willingness to interact with suspicious requests whilst GPT-5.4 adopted a more cautious posture, suggesting that vendor choice and model selection carry direct security implications for teams already running or planning to deploy agentic systems in customer-facing roles.
Phishing simulation on an OpenClaw email agent with various configuration profiles showed that it was susceptible to tactics commonly used to compromise human users. [...]