Researchers at Imperva and Varonis independently demonstrated two separate attack paths against OpenClaw, a widely deployed self-hosted AI agent: a prompt injection flaw (patched in version 2026.4.23) and an unpatched social engineering vector that bypasses sender verification by exploiting mutable display names in channel integrations. Both paths exploit what researchers call the ‘lethal trifecta’ – broad permissions, unsanitized content ingestion, and outbound data transmission – enabling attacker code execution and exfiltration of credentials including AWS IAM keys and database connection strings. Neither vector has been assigned a CVE at this time. This incident signals that AI agents are now a distinct attack surface with systemic trust architecture problems that patches alone cannot resolve.