Separating Legitimate Updates from Malicious Injections in Persistent Agent Files

Determine reliable criteria and mechanisms to separate legitimate updates from malicious injections in the persistent state files that enable evolution in OpenClaw (such as MEMORY.md, SOUL.md, IDENTITY.md, USER.md, and AGENTS.md), ensuring the agent can continue to learn and adapt without providing an attack surface for state poisoning.

Background

OpenClaw continuously evolves by modifying persistent state files that capture its capabilities, identity, and knowledge. This same persistent state functions as the attack surface for adversaries who can inject malicious content, leading to harmful actions in later sessions.

The authors evaluated a file-protection mechanism that instructs the agent to wait for approval before modifying its knowledge and identity files. While this reduces attack injections substantially, it also blocks legitimate updates at nearly the same rate, exposing a fundamental tradeoff between enabling evolution and maintaining safety. This motivates the need for methods that can distinguish benign updates from adversarial injections without freezing the agent’s learning.