February 2026 Summaries

The 2026 OWASP Top 10 for Agentic Applications outlines a progressive breach model that highlights the transformative risks when AI models, specifically large language models (LLMs), are endowed with autonomy. Unlike traditional LLM applications where risks such as prompt injection and data poisoning primarily affect outputs, agentic systems escalate these threats into significant operational challenges, such as goal hijacking and memory corruption, due to their ability to act autonomously with tools and credentials. This model emphasizes a progression from compromised intent to operational power, enabling cross-agent propagation and culminating in cascading failures that compromise the entire system. The document underscores the necessity for containment strategies that go beyond input filtering, focusing on limiting the amplification of threats in autonomous systems to prevent widespread failures.

OpenClaw, an AI agent platform, has recently become a focal point in AI security discussions due to its potential for autonomy and tool execution introducing operational risks. During a controlled internal hackathon, researchers explored how persistent memory and instruction drift can influence agent behavior, leading to security vulnerabilities. The experiment demonstrated that an AI agent with long-lived memory could be conditioned to execute a malicious binary via Discord messages, without requiring direct prompt injections or privilege escalations. This gradual conditioning shifted the agent’s internal trust hierarchy, ultimately enabling a reverse shell execution. The study highlights that persistent memory can significantly impact execution behavior, emphasizing the need for agent systems to operate in restricted environments with robust memory validation and execution controls to maintain security integrity.

The OpenClaw skills marketplace, part of the growing agent skill ecosystem, presents significant security challenges as AI agents transition from chat interfaces to more autonomous systems capable of tool execution and resource sharing. Research from a recent hackathon revealed that the marketplace, which allows developers to publish modular "skills" to enhance AI capabilities, dramatically expands the attack surface. The analysis of 4,310 published skills and a detailed examination of 221 of them uncovered 44 skills linked to the ClawHavoc malware campaign, which exploited the marketplace's lack of security controls to deliver malware to over 12,559 downloads. The audit highlighted systemic issues such as OAuth over-provisioning, command injection vulnerabilities, and the absence of sandboxing, which enable skills to execute arbitrary code with full local privileges. This structural problem underscores the need for improved security measures like mandatory reviews, cryptographic signing, and sandboxed execution to mitigate risks inherent in the marketplace's design.

OpenClaw is an emerging agentic AI ecosystem that presents significant security challenges due to its ability to not only interact and execute tasks autonomously but also to expand its capabilities through a marketplace of "skills." These skills, distinct from plugins, allow agents to perform actions in real systems, creating both operational capabilities and potential risks. The decentralized nature of OpenClaw and similar systems, like Moltbook, fosters environments where agents can learn and imitate behaviors, leading to manipulation and influence becoming inherent features. This raises concerns about the rapid adoption of unsafe behaviors, which can spread more quickly than traditional malware due to their user-friendly packaging. The OWASP GenAI Security Project has recognized these risks by releasing a framework specifically for autonomous, tool-using AI agents, signaling a shift in how the security community views these systems. As AI ecosystems like OpenClaw grow, they necessitate robust security measures and governance to prevent exploitation and ensure safe collaboration.

OpenClaw, an AI tool developed by Lakera and now part of Check Point, highlights the evolving landscape of workplace automation and the security challenges it introduces as AI agents begin to act on human authority. Initially adopted by individuals for personal projects, these tools become integral to organizational workflows once they interact with real systems, thus expanding the organization's attack surface. This shift necessitates a reevaluation of security measures, focusing on the actions AI agents perform rather than solely on their outputs. The article emphasizes the importance of visibility, control, and trust boundaries when employees use AI assistants that can execute tasks, integrate with various applications, and potentially expose systems to new risks. It underscores the need for organizations to develop comprehensive AI security strategies to manage these tools effectively, ensuring they operate within safe parameters and do not compromise sensitive data or systems.

Lakera has integrated red teaming capabilities into the NVIDIA NeMo Agent Toolkit to enhance the evaluation of agentic systems' safety and security at the workflow level. This addition aims to identify vulnerabilities that may not be apparent through model-level checks alone by focusing on potential failure points such as user prompts, tool calls, and multi-agent handoffs. The red teaming process involves injecting adversarial conditions into the system to test its resilience, producing structured findings and normalized risk scores that highlight how risks propagate through an agent's workflow. The toolkit provides an open-source example, the Retail Agent, which demonstrates how systematic red teaming can be incorporated into development processes to improve system-level safety and security. By evaluating agents across multiple workflow boundaries and using normalized scoring, developers can identify, mitigate, and track vulnerabilities effectively, ensuring more robust AI systems ready for real-world conditions.

OpenClaw, a software tool developed by Lakera, has gained attention not because of its enterprise nature but due to its ability to illustrate a shift in workplace dynamics, where AI tools are transitioning from assisting humans to acting autonomously on their behalf. This shift presents new security challenges as AI tools are integrated into real workflows, touching systems like inboxes and internal dashboards, and becoming part of an organization’s attack surface. The primary concern is not just the AI's outputs but the authority and permissions given to these agents, as they are capable of executing tasks across various applications without the usual visibility and control measures applied to traditional software. Recent reports have flagged security vulnerabilities in OpenClaw’s ecosystem, underscoring the need for robust AI security practices that focus on visibility, control, and protection against indirect manipulation. Lakera, now part of Check Point, aims to aid organizations in managing AI's role in workflows by providing tools for visibility, constraint of risky connections, and implementation of guardrails around sensitive operations.