AI agents are gaining real authority, and their security core is becoming the weak point

Autonomous LLM agents have traded their chatbot innocence for system-level swagger. OpenClaw now executes long-horizon tasks with high-privilege access, turning what once was a conversational toy into something that can rewrite your infrastructure while you grab coffee. The capability leap is genuine. The security posture? Sprawling and largely unmapped.

Researchers from Tsinghua University and Ant Group recently dissected OpenClaw's 'kernel-plugin' architecture and found the kind of design decision that keeps red teams employed. The system leans on a pi-coding-agent as its Minimal Trusted Computing Base — the TCB, in security parlance. One component. One throat to choke. When that single point of failure owns the keys to the kingdom, compromise doesn't mean a leaked prompt; it means an attacker with root and a creative streak.

The arithmetic is sobering. Approximately 26% of attacks against these systems target the TCB directly, a concentration that undercuts vendor narratives about enterprise readiness. The pi-coding-agent's privileges — code generation, real-time execution, system manipulation — are precisely what make it valuable. They're also what make it catastrophic if hijacked. An LLM hallucinating a destructive command is bad enough. An LLM with the keys to execute that hallucination is a different genre of problem entirely.

The Tsinghua-Ant response is a five-layer lifecycle-oriented security framework that tracks the agent from initialization through execution: initialization, input, inference, decision, and execution. Each layer gets scrutiny rather than blind trust. The framework treats the agent less as a tool and more as a semi-autonomous actor whose intentions require continuous verification.

This matters because the attack surface isn't static. Initialization vulnerabilities let attackers poison the agent before it acts. Input-layer exploits feed it malicious context. Inference and decision layers are where hallucinations or prompt injections steer behavior off-script. Execution is where the damage materializes. Wrapping only the final stage in policy checks is like installing a smoke detector in a house already burning.

The framework's lifecycle approach implicitly acknowledges that 'proactive' and 'destructive' share the same root: unbounded agency. By monitoring transitions between layers, the system can catch drift before it becomes disaster. Whether vendors will adopt this model or continue shipping TCB-concentrated architectures remains an open question. The research at least provides a vocabulary for calling out the gap between marketed maturity and structural reality.