Policy: – budget = 1000 – each `provision_gpu(a100)` call = 500 Result: – call 1 -> ALLOW – call 2 -> ALLOW – call 3 -> DENY (`BUDGET_EXCEEDED`) Key point: the 3rd tool call is denied before execution. The tool never runs. Also emits: – …
Paper: https://arxiv.org/abs/2604.04759 This paper presents a real-world safety evaluation of OpenClaw, a personal AI agent with access to Gmail, Stripe, and the local filesystem. The authors introduce a taxonomy of persistent agent state: – Capability…
Paper: https://arxiv.org/abs/2604.04759 This OpenClaw paper is one of the clearest signals so far that agent risk is architectural, not just model quality. A few results stood out: – poisoning Capability / Identity / Knowledge pushes attack success fro…