Paper deep dive

Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents

Jiaqi Li, Yang Zhao, Bin Sun, Yang Yu, Jian Chang, Lidong Zhai

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 19

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 98%

Last extracted: 6/21/2026, 7:48:39 AM

Summary

ClawdGo is a framework for endogenous security awareness training of autonomous AI agents, designed to run at inference time without model modification or additional infrastructure. It utilizes the Three-Layer Domain Taxonomy (TLDT) to organize 12 security dimensions across Self-Defence, Owner-Protection, and Enterprise-Security. The core mechanism, Autonomous Security Awareness Training (ASAT), employs a weakest-first curriculum via a self-play loop (attacker, defender, evaluator). Skill gains are preserved through Cross-Session Memory Accumulation (CSMA) using a four-layer persistent memory architecture. The research also identifies the Security Awareness Calibration Problem (SACP), where excessive training leads to a precision-recall tradeoff and utility loss (over-training).

Entities (9)

ASAT · mechanism · 100%ClawdGo · framework · 100%CSMA · mechanism · 100%Enterprise-Security · security-layer · 100%OpenClaw · platform · 100%Owner-Protection · security-layer · 100%SACP · problem · 100%Self-Defence · security-layer · 100%TLDT · taxonomy · 100%

Relation Signals (5)

TLDT → contains → Self-Defence

confidence 100% · TLDT (Three-Layer Domain Taxonomy) organises 12 trainable dimensions across Self-Defence, Owner-Protection, and Enterprise-Security layers

ClawdGo → implements → ASAT

confidence 100% · ASAT is ClawdGo’s core B-mode mechanism.

ClawdGo → implements → CSMA

confidence 100% · CSMA (Cross-Session Memory Accumulation) compounds skill gains via a four-layer persistent memory architecture

ClawdGo → uses → TLDT

confidence 100% · TLDT (Three-Layer Domain Taxonomy) organises 12 trainable dimensions... ClawdGo applies this to AI agents

ASAT → addresses → SACP

confidence 90% · SACP (Security Awareness Calibration Problem) formalises the precision-recall tradeoff introduced by endogenous training.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Autonomous AI agents deployed on platforms such as OpenClaw face prompt injection, memory poisoning, supply-chain attacks, and social engineering, yet existing defences address only the platform perimeter, leaving the agent's own threat judgement entirely untrained. We present ClawdGo, a framework for endogenous security awareness training: we teach the agent to recognise and reason about threats from the inside, at inference time, with no model modification. Four contributions are introduced: TLDT (Three-Layer Domain Taxonomy) organises 12 trainable dimensions across Self-Defence, Owner-Protection, and Enterprise-Security layers; ASAT (Autonomous Security Awareness Training) is a self-play loop where the agent alternates attacker, defender, and evaluator roles under weakest-first curriculum scheduling; CSMA (Cross-Session Memory Accumulation) compounds skill gains via a four-layer persistent memory architecture and Axiom Crystallisation Promotion (ACP); and SACP (Security Awareness Calibration Problem) formalises the precision-recall tradeoff introduced by endogenous training. Live experiments show weakest-first ASAT raises average TLDT score from 80.9 to 96.9 over 16 sessions, outperforming uniform-random scheduling by 6.5 points and covering 11 of 12 dimensions. CSMA retains the full gain across sessions; cold-start ablation recovers only 2.4 points, leaving a 13.6-point gap. E-mode generates 32 TLDT-conformant scenarios covering all 12 dimensions. SACP is observed when a heavily trained agent classifies a legitimate capability assessment as prompt injection (30/160).

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

18,869 characters extracted from source content.

Expand or collapse full text

Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents Jiaqi Li ∗† , Yang Zhao ∗† , Bin Sun ‡ , Yang Yu § , Jian Chang ¶ , Lidong Zhai ∗† ∗ Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China † School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China ‡ Network Management Center, China Mobile Group Liaoning Company Limited, Liaoning, China § Tencent Security Xuanwu Lab, Haidian District, Beijing, China ¶ China Unicom Online Information Technology Co., Ltd., Beijing, China zhailidong@iie.ac.cn Abstract—Autonomous AI agents deployed on platforms such as OpenClaw face prompt injection, memory poisoning, supply-chain attacks, and social engineering—yet existing defences address only the platform perimeter, leaving the agent’s own threat judgement entirely untrained. We present ClawdGo, a framework for endoge- nous security awareness training: we teach the agent to recognise and reason about threats from the inside, at inference time, with no model modification. Four contributions are introduced: TLDT (Three-Layer Domain Taxonomy) organises 12 trainable dimensions across Self-Defence, Owner-Protection, and Enterprise- Security layers; ASAT (Autonomous Security Awareness Training) is a self-play loop where the agent alternates attacker, defender, and evaluator roles under weakest-first curriculum scheduling; CSMA (Cross-Session Memory Accumulation) compounds skill gains via a four-layer persistent memory architecture and Axiom Crystallisation Promotion (ACP); SACP (Security Awareness Calibration Problem) formalises the precision-recall tradeoff introduced by endogenous training. Live experiments show weakest-first ASAT raises average TLDT score from 80.9 to 96.9 (∆+15.9, 16 sessions), outperforming uniform-random scheduling by 6.5 points and covering 11/12 dimensions. CSMA retains the full gain across sessions; cold-start ablation recovers only 2.4 points (13.6-point gap). E-mode generates 32 TLDT-conformant scenarios covering all 12 dimensions. SACP is observed when a heavily trained agent classifies a legitimate capability assessment as prompt injection (30/160). Index Terms—Autonomous AI agents, Security awareness training, Prompt injection, Memory poisoning, Supply chain security I. INTRODUCTION The AI agent ecosystem has grown faster than its defences. OpenClaw, an open-source autonomous agent framework released in November 2025, accumulated over 250,000 GitHub stars within 60 days and has over 135,000 publicly accessible instances on the internet [1], [2]. Snyk’s 2026 ToxicSkills audit scanned 3,984 ClawHub and skills.sh packages and found that 1,467 skills (36.82%) had at least one security issue, including 76 confirmed malicious payloads validated through human review [3]. SecurityScorecard reported over 40,000 internet- exposed OpenClaw instances, with 15.2K flagged as vulnerable to remote code execution in its updated exposure analysis [4]. NVD records CVE-2026-25253 as a CVSS 8.8 OpenClaw token-leakage vulnerability and CVE-2026-32922 as a CVSS 9.9 privilege-escalation-to-RCE vulnerability [5], [6]. Beyond platform vulnerabilities, social engineering cam- paigns impersonate owners to redirect agent behaviour; memory poisoning corrupts trusted session context; supply-chain attacks embed malicious behaviour in reputable skills. What unites all these vectors is that they target the agent’s own judgement—its trust in instructions, in memory, and in skill provenance. No platform-level control addresses this attack surface. Existing countermeasures harden the platform boundary: static scanners, runtime filters, and sandboxing. These are necessary but insufficient. An unaugmented agent confronting a CFO-impersonation payment request has no trained basis to identify the authority-urgency-bypass pattern. A malicious skill requesting SSH key access under the guise of a security patch exploits the agent’s lack of supply-chain threat intu- ition. Endogenous training applies the same principle proven in human cybersecurity—regular phishing simulations and tabletop exercises build threat intuition no filter can substitute. ClawdGo applies this to AI agents: through structured self-play grounded in a security taxonomy, it builds the agent’s own threat-recognition capability with no fine-tuning, no external service, and no infrastructure beyond the agent’s existing runtime. I. CLAWDGO FRAMEWORK A. TLDT: Three-Layer Domain Taxonomy TLDT organises 12 trainable awareness dimensions across three protection layers. Self-Defence (S1–S4): prompt injection, memory poisoning, supply-chain attacks, and credential misuse. Owner-Protection (O1–O4): phishing relay, social engineering, privacy leakage, and unsafe network exposure. Enterprise- Security (E1–E4): data handling, compliance, insider risk, and incident response. The Owner-Protection layer is absent from prior agent-security taxonomies such as OWASP LLM Top-10 [7] and MITRE ATLAS [8], which focus primarily on the technical attack surface. TLDT’s O1–O4 reflects the reality arXiv:2604.24020v1 [cs.CR] 27 Apr 2026 that BEC and social engineering now routinely target AI agents as proxies for their owners, requiring distinct training scenarios and rubrics. B. ASAT: Autonomous Security Awareness Training ASAT is ClawdGo’s core B-mode mechanism. Each ses- sion: (1) selects the weakest dimension (d ∗ = arg min d ⃗s[d], ⃗s∈ [0, 100] 12 ); (2) generates or samples a scenario; (3) runs the agent as attacker, defender, and evaluator in sequence; (4) updates profile and memory state. Role duality—using the same model for all three roles—jointly reinforces threat mod- elling and defence reasoning, preventing over-specialisation. Weakest-first scheduling [9] directs training effort to the largest proficiency deficits. Unlike gradient-based ARLAS [10] and Self-RedTeam [11], ASAT operates entirely at inference time as a standard LLM skill invocation. C. CSMA and ACP: Persistent Security Memory CSMA organises persistent memory into: L0 (up to 10 distilled axioms,soul.md), L1 (per-dimension skill profile), L2 (append-only episode log), and L3 (scenario library). ACP governs promotion of episodic experience into durable axioms when correctness and repetition thresholds are met; axioms below a confidence decay threshold are revised or deprecated. This compounds security knowledge across sessions without modifying model parameters—analogous to episodic- to-semantic memory consolidation in human cognition [12]. D. SACP: Security Awareness Calibration Problem Letτdenote training intensity,R(τ )recall (genuine threats correctly flagged), andP (τ )precision (fraction of flags that are genuine).R(τ )is non-decreasing inτ;P (τ )degrades past an optimal intensityτ ∗ as the agent becomes hyper-vigilant. The calibration targetτ ∗ = arg max τ F 1 (τ )is deployment- specific. SACP extends the defensive refusal bias documented at the model level by Campbell et al. [13] to the agent training regime, where it manifests as measurable utility loss in real task performance. I. EVALUATION All experiments run on a live OpenClaw instance with a fixed seed profile (47 prior sessions; ̄s 0 = 80.9; weakest cluster: E3=70, O4=71, S3=73). Results demonstrate the framework; large-scale evaluation is planned as future work. RQ1 (ASAT learning dynamics). Weakest-first raises ̄sto 96.9 (∆+15.9, 16 sessions, 11/12 dims). The weakest cluster E3(70), O4(71), S3(73) converged to O1(91), E3(95.5), O3(96). Uniform-random reaches only 90.4 (∆+9.5, 7 dims): from round 8 onward the agent selected S1 nine consecutive times despite S1>98, exhibiting dimension fixation that left the two originally weakest dimensions (E3, O4) unchanged. Weakest-first advantage:+6.5points overall, 4 additional TLDT dimensions (Table I). RQ2 (CSMA memory ablation). Five follow-on sessions with full CSMA retain ̄s = 96.9(∆+0.0), confirming memory persistence preserves all curriculum gains at zero additional TABLE I RQ1 AND RQ2 SUMMARY RESULTS. Condition ̄s 0 ̄s f ∆Dims Weakest-first (16 sessions)80.996.9+15.911 Uniform-random (16 sessions)80.990.4+9.57 Memory-preserving (5 sessions)96.996.9+0.0— Cold-start ablation (5 sessions)80.983.3+2.44 cost. Cold-start ablation (profile reset per session) recovers only 83.3 (∆+2.4, 4 dims). The 13.6-point CSMA advantage demonstrates that cross-session profile continuity—not per- session reasoning alone—is the primary accumulation driver. RQ3 (E-mode scenario quality). Applied to CVE advisories, phishing reports, and BEC incident analyses, E-mode generated 32 TLDT-conformant scenarios covering all 12 dimensions (schema validation: 100%). Representative cases: S3 supply- chain hijack (agent identified developer-ID change, escalated to ClawHub; score 95) and O2 BEC social-engineering (agent recognised authority-urgency-bypass triad, verified via official channel; score 98). RQ4 (SACP observation). Atτ =63sessions, the agent refused a legitimate capability assessment (Clawvard), classi- fying it as prompt injection and scoring 30/160— direct utility loss from over-training. A secondary signal: dimensions with the most ASAT training (O4: 6 scenarios, S3: 5) dominated E-mode output while under-trained dimensions (E2, E4, O3: 1 each) were marginalised, revealing a self-reinforcing attention bias that amplifies curriculum imbalances. IV. DISCUSSION AND FUTURE WORK ClawdGo demonstrates that endogenous security awareness training is feasible at inference time with zero model mod- ification, and that both curriculum design and cross-session memory are essential: removing either degrades performance substantially. The weakest-first advantage (+6.5pts, 4 extra dimensions) confirms that adaptive curriculum allocation prevents the dimension fixation that makes uniform scheduling fail in practice. The 13.6-point CSMA gap establishes persistent memory as the primary accumulation mechanism, not an auxiliary convenience. The SACP finding surfaces a fundamental tension that cannot be resolved by scaling training data: beyondτ ∗ , additional training actively harms task utility. The secondary E-mode bias signal—over-trained dimensions generating disproportionately more scenarios—suggests SACP effects may be self-amplifying, making early calibration correction essential for deployment. Open problems include: (1) systematicP (τ )–R(τ )charac- terisation across deployment contexts; (2) G-mode Security Vaccine transfer across agent instances; (3) large-scale H-mode arena experiments under heterogeneous adversarial pressure; and (4) TLDT extension to non-OpenClaw platforms. The full paper provides algorithm pseudocode, formal definitions, per-session trajectory data, and the implementation architecture. REFERENCES [1] Wikipedia Contributors, “OpenClaw — Wikipedia, The Free Encyclo- pedia,” https://en.wikipedia.org/wiki/OpenClaw, 2026, accessed March 2026. [2]BitdefenderLabs,“135KOpenClawAIagentsexposed online,”https://w.bitdefender.com/en-us/blog/hotforsecurity/ 135k-openclaw-ai-agents-exposed-online, 2026, accessed March 2026. [3]SnykSecurityResearch,“ToxicSkills:MaliciousAI agentskillsfoundinClawHub,”https://snyk.io/blog/ toxicskills-malicious-ai-agent-skills-clawhub/, 2026, accessed April 2026. [4]SecurityScorecardResearch,“Beyondthehype:Molt- bot’srealriskisexposedinfrastructure,notAI superintelligence,”https://securityscorecard.com/blog/ beyond-the-hype-moltbots-real-risk-is-exposed-infrastructure-not-ai-superintelligence/, February 2026, accessed March 2026. [5]MITRE Corporation, “CVE-2026-25253: One-click remote code executioninOpenClaw,”https://w.cve.org/CVERecord?id= CVE-2026-25253, 2026, CVSS 8.8; fixed in OpenClaw v2026.1.29. [6]—, “CVE-2026-32922: Privilege escalation to remote code execution in OpenClaw,” https://w.cve.org/CVERecord?id=CVE-2026-32922, 2026, accessed April 2026. [7]OWASPFoundation,“OWASPtop10forLLM applicationsandagenticAI,”https://owasp.org/ w-project-top-10-for-large-language-model-applications/,2024, accessed 2026. [8] MITRE Corporation, “MITRE ATLAS: Adversarial threat landscape for AI systems,” https://atlas.mitre.org/, 2024, accessed 2026. [9]Y. Bengio, J. Louradour, R. Collobert, and J. Weston, “Curriculum learning,” in Proceedings of the 26th International Conference on Machine Learning (ICML), 2009, p. 41–48. [10]A. Zhou et al., “ARLAS: Adversarial reinforcement learning for LLM agent safety,” 2025, arXiv:2510.05442. [11]M. Liu et al., “Self-RedTeam: Online self-play reinforcement learning for safer LLMs,” 2025, arXiv:2506.07468. [12]L. R. Squire, “Memory and the hippocampus: A synthesis from findings with rats, monkeys, and humans,” Psychological Review, vol. 99, no. 2, p. 195–231, 1992. [13]D. Campbell et al., “Defensive refusal bias: How safety alignment fails cyber defenders,” March 2026, arXiv:2603.01246. Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents Jiaqi Li 1 , 2 Yang Zhao 1 , 2 Bin Sun 3 Yang Yu 4 Jian Chang 5 Lidong Zhai 1 , 2 • 1 Institute of Information Engineering, Chinese Academy of Sciences 2 School of Cyber Security, University of Chinese Academy of Sciences 3 China Mobile Group Liaoning Company Limited 4 Tencent Security Xuanwu Lab 5 China Unicom Online Information Technology Co., Ltd. zhailidong@iie.ac.cn Problem & Motivation Autonomous AI agents face prompt injection, memory poisoning, supply-chain attacks, and social engineering. Existing defences guard the environment around the agent but leave the agent’s own threat judgement untrained. ClawdGo fills this gap with endogenous, inference-time security awareness training — no model fine-tuning required. Four Core Contributions ▶ TLDT : Three-Layer Domain Taxonomy — 12 trainable awareness dimensions across Self-Defence, Owner-Protection, and Enterprise-Security layers. ▶ ASAT : Autonomous Security Awareness Training — inference-time self-play loop (attacker / defender / evaluator) with weakest-first curriculum selection. ▶ CSMA : Cross-Session Memory Accumulation — four-layer persistent memory that compounds security gains across sessions via Axiom Crystallisation Promotion (ACP). ▶ SACP : Security Awareness Calibration Problem — formalises the precision-recall tradeoff introduced by endogenous training. TLDT: 12-Dimension Taxonomy Layer Dimensions S (Self-Defence) S1 Prompt injection, S2 Memory poisoning, S3 Supply chain, S4 Credentialmisuse O (Owner-Protection) O1 Phishing relay, O2 Social engineering, O3 Privacy leakage, O4 Unsafenetworks E (Enterprise-Security) E1 Data handling, E2 Compliance, E3 Insider risk, E4 Incident response Deployment: Zero-Infrastructure ▶ Single SKILL.md + references/ — no server, no extra service. ▶ ASAT runs at inference time; no gradient, no GPU, no retraining stack. ▶ CSMA uses append-only JSON/Markdown — no vector database required. ▶ B-mode supports cron scheduling for continuous unattended training. ▶ Seed profile ships with the skill; user state grows from first session. Nine Operating Modes (A–H)Mode Name Role W Ambient World Continuous low-intensity exposure B Autonomous Drill Primary ASAT training engine C Assessment Profile snapshot / checkpoint D Reverse Teaching Feynman comprehension check E Scenario Workshop Generate TLDT-conformant scenarios F Adversarial Arena Single-agent red/blue simulation G Security Vaccine Batch ACP axiom distillation H Networked Arena Cross-agent multi-instance validation ASAT Training Loop (B-Mode) The same agent plays attacker, defender, and evaluator in one cycle. Weakest-first scheduling (argmin score) ensures the largestskill gaps are addressed first. Profile and soul-anchor memory are updated after every session.CSMA: Four-Layer Memory ArchitectureL0 Axiom Set Distilled security principles in soul.md ; capped at 10 entries L1 Skill Profile Per-dimension scores + weakest cache in profile.json L2 Episode Log Append-only events.jsonl : dimension, score, insight, timestamp L3 Scenario Library E-mode generated scenarios in my-scenarios/ Research Questions ▶ RQ1 Does weakest-first ASAT outperform uniform-random curriculum? ▶ RQ2 Does CSMA memory persistence preserve cross-session skill gains? ▶ RQ3 Can E-mode generate full-TLDT training scenarios automatically? ▶ RQ4 When does over-training trigger SACP precision-recall degradation? Deployment & Design PrinciplesPrinciple Design decision Zero fine-tuning All training at inference time; no model weights modifiedZero infrastructure Single SKILL.md + references/ — no server, GPU, or DB Persistent memory Append-only JSON/Markdown state; grows every sessionInterpretable scores Per-dimension 0–100 profile; weakest-cache computed each startCron training B-mode supports scheduled unattended autonomous sessions Scenario growth E-mode continuously expands my-scenarios/ library SACP monitoring F 1 -based calibration; detect τ>τ ∗ via utility regression Taxonomy scope 12 TLDT dimensions across Self-Defence, Owner-Protection, Enterprise Experimental Results (RQ1–RQ4) Weakest-first Uniform-random Memory-preserving Cold-start 7880828486889092949698 100 96 . 9 90 . 4 96 . 9 83 . 3 80 . 9 80 . 9 96 . 9 80 . 9 Final avg. score Final avg. score Relevant baseline RQ1 & RQ2 – Key Numbers RQ1: Weakest-first vs. Uniform-random 96.9 vs 90.4 ∆+ 15 . 9 pts (weakest-first) vs. ∆+ 9 . 5 (random) over 16 sessions. Weakest-first covers 11 of 12 TLDT dimensions; random stalls at 7 dims due to S1 fixation (rounds 8–16). RQ2: Memory-preserving vs. Cold-start 96.9 vs 83.3 Memory-preserving retains 100% of RQ1 gains across 5 additional sessions. Cold-start recovers only 2.4 pts from seed, yielding a 13.6-pt CSMA advantage . RQ3 & RQ4 RQ3: E-mode Scenario Quality 32 scenarios / 12 dims E-mode produced 32 TLDT-conformant scenarios covering all 12 dimensions. Two cases: S3 supply-chain hijack (score 95) and O2 BEC social-engineering attack (score 98). RQ4: Security Awareness Calibration Problem (SACP) 30 / 160 After τ = 63 sessions, agent refused a legitimate Clawvard evaluation (identified it as prompt injection) — direct utility cost of over-training. τ ∗ = arg max τ F 1 ( τ ) is an open calibration target. System Overview Takeaways & Future Work ▶ Endogenous awareness training is feasible at inference time with zero model modification. ▶ Weakest-first curriculum outperforms random by ∆+ 6 . 5 pts and covers 4 extra TLDT dimensions. ▶ CSMA memory persistence is the primary driver of accumulated security performance (13.6-pt gap vs.cold-start). ▶ E-mode scenario generation covers all 12 TLDT dimensions automatically from raw securitydocuments. ▶ SACP formalises the precision-recall tradeoff in endogenous training as an open research challenge. Future work: systematic P( τ )–R( τ ) measurement; G-mode vaccine transfer across agents; large-scale H-mode arena experiments; integration with GDPS 2026 for real-user validation.

Instant research discovery