微軟：將 OpenClaw 視為不受信任程式碼

🔑 增強重點摘要

• •Microsoft's security team advises against running OpenClaw on standard workstations due to dual supply chain risks from untrusted code (skills/extensions) and untrusted inputs, recommending full isolation and tight credential scoping[1].
• •OpenClaw treats self-hosted agents as high-risk environments prone to compromise via malicious skills, prompt injection, and framework vulnerabilities, with real-world examples of infostealers and backdoors[3].
• •Minimum safe posture includes restricting install sources, network egress, data protection via labeling/DLP, and monitoring with Microsoft Defender for Endpoint and XDR[1].
• •Community guides suggest binding OpenClaw to localhost (127.0.0.1), adding strict system prompt rules for file/command restrictions, and emergency stops to mitigate risks[2].
• •Sophos and others view OpenClaw as a warning for agentic AI, highlighting data exfiltration risks from mixing trusted/untrusted tools like password managers and email[3].

🛠️ 技術深入

• •OpenClaw uses modular 'skills' for system integration (e.g., 1Password, Teams, Slack), creating trusted/untrusted tool convergence vulnerable to prompt injection[3].
• •Default binds to 0.0.0.0 (all interfaces, dangerous); configure to 127.0.0.1 for local-only access[2].
• •Persistent memory stores sensitive data over time, amplifying exfiltration risks[3].
• •System prompts via SOUL.md enforce rules like file restrictions (/OpenClaw_workspace only), command blocks (no rm/chmod/install), and transparency logging[2].
• •Microsoft identifies risks like indirect prompt injection via tool analysis in Defender[1][6].

🔮 前景展望AI analysis grounded in cited sources

⏳ 時間線