Researchers at Imperva and Varonis independently demonstrated two separate attack paths against OpenClaw, a widely deployed self-hosted AI agent: a prompt injection flaw (patched in version 2026.4.23) and an unpatched social engineering vector that bypasses sender-verification by exploiting mutable display names in channel integrations. Both paths exploit what researchers call the ‘lethal trifecta’ – broad permissions, unsanitized content ingestion, and outbound data transmission – enabling attacker code execution and exfiltration of credentials including AWS IAM keys and database connection strings. This incident signals that AI agents are now a distinct attack surface with systemic trust architecture problems that patches alone cannot resolve.