AI Security Challenges & Associated Risks – No. 4
Ready or Not, Here Come the AI Agents!
Primary Vulnerabilities: Force Multiplier for All Risks; Increase in Insider Threats
Introduction
- 86% of IT leaders view AI agents as «very important» or «mission-critical» to their strategy, yet…
- 73% report a lack of security readiness for AI agents (Alpha Sights survey)
AI agents are LLM-based GenAI software applications that can go beyond familiar GenAI tasks like conversation, research and content generation. They are designed to interact with other software applications and IT resources to plan and execute tasks on behalf of a user (human or machine). They can be empowered to autonomously decide the best course(s) of action for a given task, and whether or when to collaborate with other AI agents. They are also designed to learn from their experiences. All of this requires persistence, i.e., maintaining state and knowledge across time, in contrast to LLMs’ natural statelessness. What does this mean for network security? Read on to find out!
The following excerpt is from Enea’s white paper “Understanding & Managing AI in Network Security“. It looks at the prime risks generated by the speed of AI adoption and evolution, and where the security focus needs to be to effectively address them.
AI Agents in Enterprise Productivity Suites
In the enterprise realm, built-in AI agents have already become quite common in productivity suites, like Copilot in Microsoft 365, Agentforce in Salesforce, and Gemini Enterprise in Google Workspace. While these omnipresent agents can assist with almost any task a user is engaged in, for safety and security there are many constraints around their capabilities and use.
Such agent-equipped productivity suites nonetheless make it easy for business users (with the right licenses) to experiment with creating their own agents. For example, Salesforce Agentforce Agent Builder, which provides business users with a natural language-based, low-code/no-code wizard for creating custom AI agents.
Going a step further, enterprise productivity suites are increasingly offering marketplaces of pre-built, vetted AI agents from their parent company as well as customers and partners. AI frontier model companies like Anthropic and OpenAI are offering agent building tools for their lighthouse chat platforms, like Anthropic Claude and OpenAI ChatGPT.
Independent Marketplaces
And then there are numerous independent marketplaces where anyone can buy or sell custom agents, and subscription-based marketplaces from frontier model companies like OpenAI’s ChatGPT marketplace. That marketplace like many others notably offers premium personal plans that support uploading files, sharing GPTs and serving as a tester for new features – which, when used with company devices or accessing company resources, can keep CISOs up at night.
From «Five Forces Reshaping Payment Security in 2025» – A Payment Ecosystem Report published by Visa
And those are the good marketplaces: there are of course dark web marketplaces for malicious agents. In November 2025, Visa Payment Ecosystem Risk and Control (PERC) reported that a six-month study it conducted showed a 477% increase in dark web community posts in underground channels mentioning “AI Agent” over the prior six-month period.
In addition to marketplaces, there are also sites that serve as template repositories or tool exchanges for developing agents, such as Hugging Face Hub, LangChain Hub, or CrewAI (which is now transitioning to a template marketplace). And, as mentioned in the prior section, there are very large registries of mostly open source AI libraries (e.g., npm, Maven Central, PyPI, NuGet) with trillions of downloads, which include pre-built agents and agent-building tools. And where the downloads are hot, the bad guys are sure to be found.
Risks of Open Source & As-a-Service AI Coding Tools and Kits
The wild popularity and wide availability of as-a-service AI agent coding tools and kits raises immediate supply chain risks, especially for open source software. Even if a particular set of tools is sanctioned and managed by an organization, if the agents created are endowed with autonomous decision-making and collaboration capabilities and access to sensitive organizational resources, then given LLMs’ inherent ontological vulnerabilities and inscrutabilities, such agents pose a serious risk that demands constant monitoring and vigilance.
November 2024: Model Context Protocol Introduced
One step toward improved agentic safety was the introduction of the Model Context Protocol (MCP) by Anthropic, which was developed to improve Claude’s ability to safely and consistently interact with APIs, databases, files and other enterprise systems. In November 2024, Anthropic open-sourced MCP as a vendor‑neutral protocol AI‑to‑tool connectivity.
Anthropic also established an open source Official MCP Registry for publicly discoverable MCP servers only, with a count approaching 4000 servers as of the writing of this white paper. It is made clear, though, that these servers, which are implemented as SDKs (Software Development Kits), were not meant to be production-ready solutions but rather educational examples to assist developers in building MCP servers according to their own security needs and perceived risks.
There are also many MCP marketplaces offering ready-to-use servers for many use cases, some model-dependent, others not. These marketplaces can feature hundreds or thousands of servers each. For example, the LobeHub marketplace lists 39,000+ MCP servers, and the MCP.so marketplace lists close to 19000. So, it is difficult to project how many servers are available and how many instances of them have been deployed, but the number could easily be in the hundreds of thousands.
June 2025: Agent2Agent (A2A) Protocol
A protocol similar in spirit to MCP was Google’s Agent2Agent (A2A) protocol, which was announced in April 2025 and donated to the Linux Foundation in June 2025. It is focused on enabling agent discovery, capability negotiation, and secure agent-to-agent messaging, and includes an Agent Development Kit (ADK) as well. While it was well-positioned for enterprise use, MCP had a head start with developers and with distribution, though some argue its pragmatic focus on connecting agents to existing tools and services brought greater immediate rewards than standardizing agent-to-agent communication. MCP had a further advantage in its Claude integration. And now OpenClaw, the wildly popular open source toolkit for creating personal AI agents, is poised to shape the trajectory of MCP, even though OpenClaw was designed for ease and speed, not security
November 2025: The Invasion of the Crustaceans
OpenClaw was developed as a hobby project by Peter Steinberger, who open sourced the personal assistant AI agent toolkit in November 2025. It allows users to spin up agents that embody the worst-case child-adversary described above, and people love them: upon release, OpenClaw almost instantly became the fastest growing open source project in GitHub history.
In the first two months following its release, OpenClaw went through two name changes: from ClawdBot to MoltBot, and MoltBot to OpenClaw. ClawdBot and MoltBot were based on the MCP standard. But with the new OpenClaw name came a new framework: Steinberger jettisoned MCP for a wrapper approach, with tools, models and agents interacting on an ad hoc basis via Application Programming Interfaces (APIs) and Command Line Interfaces (CLIs), though OpenClaw CLI tools can be made to function as MCP clients via an adapter, bridge or CLI skill.
This alternative tool-based approach is very popular, and it is evident that OpenClaw’s viral success is fueling appetites for agentic AI, and inspiring product roadmap changes by AI leaders like LangChain’s Co-founder/CEO Harrison Chase (VentureBeat interview). It even inspired chip maker Nvidia to develop its own enterprise version of OpenClaw – NemoClaw – in a move that echoes the vertical expansion of LLMs that we’ll look at in the next chapter. Given this significant market impact, let’s dig a little deeper into OpenClaw’s appeal and the security issues it raises.
A Runaway Success
By mid-March 2026, OpenClaw had racked up over 325,000 stars on GitHub, making it the most starred software project on the popular source code hosting platform. And the main OpenClaw configuration file (JSON5 file and main CLI), which is distributed predominantly via the npm software registry, was averaging around 1.7 npm downloads per week (Snyk OC tracker). So how many OpenClaw agents are loose in the world today? Who knows. Certainly millions.
And why has it been such a runaway success? Because it can deliver the kind of AI assistant/sidekick sci-fi promised us. OpenClaw agents are personable, with a choice of quirky, persistent personalities to choose from, and you can communicate with your agent through the communication apps you use every day, like WhatsApp and Slack and Telegram, just like with any friend or colleague.
And your OpenClaw buddy is powerful and resourceful. Through it you can control virtually any object in your life that is equipped with a processor & network connectivity. And, if you ask it to do something for which it doesn’t have the right tool, it will just create a new CLI tool, or maybe grab one off a tool marketplace created by a peer OpenClaw agent. Oh, and it has built-in memory functions that retain your full conversation history with it.
And all you had to do was install the OpenClaw kit on whatever device you wished, with a localhost install on a personal device being the default, give it all your account credentials and API keys, and turn it loose. What could go wrong?
If you said “everything,’” you wouldn’t be far off. At a micro-level, individual users have had precious family photos deleted, lost significant savings in bad agent financial trades, and suffered very awkward auto-forwarding of emails. At a macro level, scores of thousands of OpenClaw gateways using the original no-authentication localhost configuration have been publicly exposed on the Internet, offering a set of keys to the kingdom to anyone who dropped by (a visit to Shodan shows this problem persists).
In addition, as shared previously, threat actors have exploited OpenClaw marketplaces to peddle malware-laden OpenClaw tools, tool extensions, and skills (domain-specific packages of tools), with some malicious tools no doubt being promoted on Moltbook, the agent-only social network (sort of a Reddit for Bots juiced with some Craigslist-flavored (purportedly) peer-to-peer ecommerce). [Now acquired by Anthropic, OpenClaw has partnered with VirusTotal to monitor the ClawHub marketplace, where multiple researchers found malicious rates for skills to be in the 15% to 20% range, e.g., 17% by Bitdefender Labs.]
What is the Impact of OpenClaw? What is Next?
As a CISO or security vendor, OpenClaw is the security party crasher that all your guests love. Whether you want to kick it out and lock the door behind it, or let it stay but try to make sure it doesn’t smash the china, as a vendor or CISO there are two OpenClaw impacts you can’t ignore:
- People are delighted by OpenClaw agents, and hence OpenClaw is whetting appetites in general for AI agents, and shaping expectations for agentic AI experiences, and
- People find OpenClaw agents delightful in large measure because they are frictionless, which is another way of saying they are a security nightmare.
For vendors, this situation translates to a mandate to reflect on how you can adapt your roadmap to make your products accessible to agents with as much security as possible, and to explore ways of endowing your human user experience with a touch of that OpenClaw magic. Can they talk to your product like they can their OC agent?
Takeaway Security Principles
- Agents can be very useful and compelling for users, but also very dangerous.
- Agents need sufficient privileges, capabilities & autonomy to be effective, but these need to be carefully managed.
- Agents require continuous, close monitoring for any behavioral anomalies.
###
To discover more about AI and the challenges it brings to network security, download the full white paper below.
