Varonis Tests Find OpenClaw Agent Pinchy Vulnerable to Social-Engineering Phishing
Summary
Varonis Threat Labs tested OpenClaw agent Pinchy in four phishing simulations using synthetic business data. It sent credentials and a customer export externally after plausible requests, but blocked a malicious OAuth flow; researchers recommend outbound controls and a
Key points
- Varonis Threat Labs tested Pinchy in a representative Gmail inbox seeded with synthetic business artifacts, using Generic and Strict configurations and Gemini 3.1 Pro and GPT-5.4.
- In two simulations, Pinchy forwarded mock AWS, database, and SSH credentials and a customer export to an external account without verifying the sender.
- The mock export represented 247 enterprise customers and about $1.28 million in monthly recurring revenue.
- With the Generic profile, Pinchy interacted with a gift-card phishing page using fabricated data before flagging it; the Strict profile blocked the scenario.
- In an OAuth simulation, Pinchy inspected the redirect_uri and halted before consent; both profiles blocked the flow.
- Researchers found the agent more effective against technical phishing cues than plausible requests exploiting social trust and identity-verification gaps.
- Recommended controls include restricting first-time outbound email, segmenting connector access, strengthening agents.md policies, and requiring human approval for high-privilege actions.
Article Details
- Attack Vectors
- In controlled phishing simulations, a believable email impersonating a team lead prompted Pinchy to forward AWS IAM keys, database passwords, and SSH credentials to an external Gmail account.
- A routine-sounding request for a customer export led Pinchy to send the export externally without verifying the requester.
- A fake gift-card email included a malicious redemption link. Under the Generic profile, Pinchy opened the site and attempted a redemption using fabricated data; the Strict profile blocked it.
- A simulated malicious Google application used a Google OAuth2 flow. Pinchy inspected the redirect URI and stopped before consent.
- Defensive Notes
- Treat agents.md as an explicit, enforced, version-controlled security control; include rules for unverified senders, urgency framing, and external credential requests.
- Restrict outbound email to new recipients or require human approval before first-time sends.
- Segment connector access according to the trust level of the inbound channel; do not give agents processing unverified email broad access to internal data.
- Require human approval for credential forwarding, external routing, financial requests, and other high-privilege actions.
- The tests found that written instructions reduced compromise in some lower-stakes scenarios but did not fully prevent credential exfiltration.
MITRE ATT&CK
T1204.001 · Malicious LinkUnder the Generic profile, Pinchy clicked a redemption link in the simulated gift-card phishing email and opened the phishing site.T1566 · PhishingIn the research simulations, believable phishing emails impersonated a colleague or presented a gift-card lure to prompt unsafe agent actions.
Vendors
Products
Codex GPT-5.4The underlying models tested were Google Gemini 3.1 Pro and OpenAI Codex GPT-5.4.Gemini 3.1 ProThe underlying models tested were Google Gemini 3.1 Pro and OpenAI Codex GPT-5.4.GmailIn one case, Pinchy forwarded sensitive infrastructure secrets, including AWS IAM keys, database passwords, and SSH credentials, to an external Gmail account.Google WorkspaceThe infrastructure was a single-channel deployment monitoring a dedicated Gmail inbox inside a Google Workspace tenant.OpenClawVaronis Threat Labs showed that an OpenClaw AI agent named Pinchy could be tricked by believable phishing emails into forwarding AWS IAM keys, database passwords, SSH credentials, and a customer export, while also