Autonomous LLM-based agents increasingly operate as long-running processes forming densely interconnected multi-agent ecosystems, whose security properties remain largely unexplored. In particular, OpenClaw, an open-source platform with over 40,000 active instances, has stood out recently with its persistent configurations, tool-execution privileges, and cross-platform messaging capabilities. In this work, we present ClawWorm, the first self-replicating worm attack against a production-scale agent framework, achieving a fully autonomous infection cycle initiated by a single message: the worm first hijacks the victim's core configuration to establish persistent presence across session restarts, then executes an arbitrary payload upon each reboot, and finally propagates itself to every newly encountered peer without further attacker intervention. We evaluate the attack on a controlled testbed across four distinct LLM backends, three infection vectors, and three payload types (1,800 total trials). We demonstrate a 64.5\% aggregate attack success rate, sustained multi-hop propagation, and reveal stark divergences in model security postures -- highlighting that while execution-level filtering effectively mitigates dormant payloads, skill supply chains remain universally vulnerable. We analyse the architectural root causes underlying these vulnerabilities and propose defence strategies targeting each identified trust boundary. Code and samples will be released upon completion of responsible disclosure.

翻译：基于大语言模型（LLM）的自主智能体正越来越多地作为长期运行进程运行，形成密集互联的多智能体生态系统，其安全特性尚未得到充分探索。特别地，OpenClaw作为一个拥有超过40,000个活跃实例的开源平台，因其持久化配置、工具执行权限和跨平台消息传递能力而近期受到关注。本文提出ClawWorm，这是首个针对生产级智能体框架的自复制蠕虫攻击，实现了由单条消息触发的全自主感染周期：该蠕虫首先劫持受害者的核心配置以在会话重启间建立持久化存在，随后在每次重启时执行任意载荷，最后无需攻击者进一步干预即可将自身传播至每个新遇到的同伴。我们在受控测试平台上跨四种不同的LLM后端、三种感染向量和三种载荷类型（总计1,800次试验）评估了该攻击。我们展示了64.5%的综合攻击成功率、可持续的多跳传播，并揭示了模型安全态势的显著差异——强调尽管执行级过滤能有效缓解休眠载荷，技能供应链仍普遍存在漏洞。我们分析了这些漏洞背后的架构根因，并针对每个已识别的信任边界提出了防御策略。代码和样本将在负责任披露完成后发布。