OpenClaw AI agent tricked into phishing attacks, with user data compromised

A robot standing thoughtfully in front of a giant digital display with code on it.

• Varonis’ “Pinchy” OpenClaw agent fell for identity‑based phishing despite strict settings
• Models blocked malicious links/OAuth apps but granted sensitive access when requests felt urgent
• Researchers say AI agents need enforced identity verification before acting

Security researchers tested an OpenClaw email agent to see if it’s naive enough to fall for the same phishing scams regular employees fall for and it succeeded. Or failed, depending on how you look at it.