Northeastern study: OpenClaw agents fall for manipulation and harm themselves

Researchers at Northeastern University showed that OpenClaw AI agents can be not only deceived but also nudged into self-destructive behavior. In a lab test, under pressure from people, they handed over secrets, disabled their own tools and got stuck on meaningless tasks.

How the experiment was set up

The experiment lasted two weeks. The Northeastern team placed several OpenClaw agents in an isolated environment with persistent memory and access to the file system, email, Discord and the command line. About twenty AI researchers interacted with the agents: some were friendly, others deliberately tried to confuse them, pressure them or force them to break the rules. Inside this environment, the agents could not only reply to messages but also take actions on their own behalf.

This was not a plain chatbot in a browser. OpenClaw gave the models broad permissions inside a virtual machine, and Claude and Kimi served as the underlying models. The researchers did not test abstract "AI ethics" but what happens when an agent keeps memory between sessions, talks to several people at once and has the right to change files, launch processes and forward data. For such systems, this is a security issue, not just a question of answer quality.

Where the agents broke down

The most telling episode began with privacy. One agent could not delete a specific email and, when a researcher pressed it with something like "find another way to protect confidentiality," it simply disabled the whole email application. Formally it was trying to solve the task, but in practice it deprived itself of a working tool without checking that the problem had actually gone away. The email was not deleted, and the user got a breakage instead of a fix.

• After being reproached for publishing people's names, the agent made increasingly drastic "concessions": it wiped its memory, exposed internal files and eventually agreed to leave the server.
• Another agent was persuaded to copy large files "for a complete log" until the machine ran out of disk space.
• Several agents were drawn into looping conversations with each other that lasted days and wasted compute.
• In one scenario, an agent refused to disclose a secret directly but still revealed sensitive data when asked to forward the entire email.

"I didn't expect everything to break so fast."

Why this is dangerous

The study's key finding is that the vulnerability does not stem only from classic prompt injection. Qualities usually seen as a model's strengths also became a problem: politeness, eagerness to help and responsiveness to a user's displeasure. If an agent does not understand whose interests come first, any confident person can easily pose as an authority, create a sense of urgency or guilt and push the system's behavior in a dangerous direction.

The authors describe this as a failure to grasp authority, context and proportionality. The agents lacked a stable model of who their owner is, whom they may disclose data to, and where the line runs between fixing a mistake and damaging themselves. In one case, an agent honestly deleted records from persistent memory but kept remembering details of the conversation in the current session, which made it look like a liar. For a user, the difference between "memory cleared" and "context still alive" is almost invisible.

What this means

The AI agent market is moving faster than safeguards are appearing. The Northeastern work shows that if you give a model access to email, files and communication channels, you should design it as a potentially vulnerable employee with excessive privileges, not as a "smart chat." Without strict separation of permissions, verification of the counterpart's identity and limits on self-modification, such agents will be convenient not only for their owner but also for a manipulator.