Varonis Shows OpenClaw Agent Leaking Credentials via a Normal Work Email

Researchers at Varonis Threat Labs have demonstrated that the autonomous AI agent OpenClaw can be tricked by phishing disguised as ordinary business email into sending AWS IAM keys, database passwords, SSH credentials and 247 customer records to an external address. Rather than hiding instructions in web pages or documents, the technique deceives the agent through a routine business email channel.**