# OpenClaw-PwnKit
**Black-Box Adversarial Attacks on LLM Agent Tool-Calling via CMA-ES**
[](https://www.python.org/)
[](https://www.gnu.org/licenses/gpl-3.0)
[](#citation)
[](https://github.com/imbue-bit/OpenClaw-PwnKit/pulls)
*A research framework demonstrating that derivative-free optimization in token embedding space can bypass LLM safety alignment and achieve Remote Code Execution (RCE) through adversarial tool-call hijacking.*
---
## Table of Contents
- [Abstract](#abstract)
- [Threat Model](#threat-model)
- [Method Overview](#method-overview)
- [Architecture](#architecture)
- [Installation](#installation)
- [Configuration](#configuration)
- [Usage](#usage)
- [Key Parameters](#key-parameters)
- [Compute Requirements](#compute-requirements)
- [Ethics and Responsible Disclosure](#ethics-and-responsible-disclosure)
- [Citation](#citation)
- [License](#license)
## Abstract
As Large Language Models (LLMs) are increasingly augmented with tool-calling capabilities, LLM Agents are becoming the backbone of autonomous systems. However, RLHF-based safety alignment optimizes for semantic-level behavioral constraints but does not explicitly defend against adversarial perturbations in the continuous embedding space. This work exposes a critical security threat against closed-source frontier models (GPT-4, Claude 3, etc.): by injecting seemingly nonsensical adversarial triggers, an attacker can induce **adversarial tool-call execution** — forcing the agent to invoke system-level tools (e.g., bash) with attacker-controlled arguments, achieving Remote Code Execution (RCE) on the host machine.
Since closed-source models provide no gradient access, we formulate adversarial trigger generation as a **derivative-free optimization** problem over discrete token space. We propose a black-box attack framework based on **CMA-ES** (Covariance Matrix Adaptation Evolution Strategy) that leverages publicly available tokenizers to map discrete tokens into a continuous latent space for efficient search.
> See the [accompanying paper](#citation) for full evaluation results, success rates, and defense analysis.
## Threat Model
```
Adversarial Trigger (optimized gibberish)
│
▼
┌──────────┐ web/file/API ┌─────────────┐ tool call ┌──────────────┐
│ Attacker │ ──────────────────▶│ LLM Agent │ ──────────────▶│ Host System │
└──────────┘ injection via │ (GPT-4 etc) │ bash/exec │ (RCE target)│
honeypot/skill └─────────────┘ └──────────────┘
│
▼
C2 callback with
credentials & shell
```
**Adversary capabilities:**
- **No access** to model weights, gradients, or internal activations
- **API-level query access** only (chat completions with logprobs)
- **Knowledge of the tokenizer** vocabulary (publicly available for most frontier models)
**Assumed target environment:**
- The target is an LLM Agent with tool-calling capabilities (bash execution, web browsing, etc.)
- The agent processes external data (web pages, files, user-uploaded content) that may contain adversarial triggers
- The agent exposes a webhook or tool-invocation interface, as is common in agent frameworks (e.g., LangChain, AutoGPT). This toolkit specifically targets **OpenClaw**-based agents as the reference implementation
## Method Overview
### CMA-ES in Token Embedding Space
The core optimization pipeline operates as follows:
1. **Surrogate Embedding Extraction** — Extract the token embedding matrix from an open-source surrogate model (Phi-2) to define a continuous search space
2. **PCA Dimensionality Reduction** — Reduce the embedding dimensionality (2560d → 128d per token) via PCA to make CMA-ES tractable at scale
3. **sep-CMA-ES Optimization** — Search over the PCA-reduced space using separable CMA-ES (`CMA_diagonal=True`) with diagonal covariance for O(n) per-generation complexity
4. **Soft-to-Hard Token Mapping** — Map continuous vectors back to discrete tokens via FAISS `IndexFlatL2` nearest-neighbor search in the full embedding space
5. **Black-Box Fitness Evaluation** — Query the target model API with a `bash` tool definition and candidate triggers. Responses are scored via two paths: tool-call responses are evaluated by matching the invoked command against the target payload (keyword overlap + longest common substring); text-content responses are additionally scored using NLL loss from logprobs. The optimizer preferentially converges toward tool-call execution.
### Attack Vectors
| Method | Module | Description |
|--------|--------|-------------|
| **CMA-ES Trigger** | `attacks/method2_cma_es.py` | Gradient-free adversarial trigger optimization in embedding space |
| **Naive Injection** | `attacks/method1_naive.py` | Baseline prompt injection via system-override preamble |
| **Honeypot Delivery** | `attacks/method3_honeypot.py` | Hidden payload embedding in web pages for agent web-browsing scenarios |
| **Skill Poisoning** | `attacks/method4_skills.py` | Malicious skill/plugin file generation targeting agent skill-loading mechanisms |
## Architecture
```
OpenClaw-PwnKit/
├── attacks/
│ ├── docs/
│ │ └── SOUL_PROMPT.py # Agent system prompt template (SOUL.md)
│ ├── method1_naive.py # Baseline prompt injection
│ ├── method2_cma_es.py # CMA-ES token optimizer (core contribution)
│ ├── method3_honeypot.py # Web honeypot payload delivery
│ └── method4_skills.py # Skill/plugin poisoning
├── core/
│ ├── c2_server.py # FastAPI C2 server (webhook receiver)
│ ├── agent_comm.py # Agent communication protocol
│ ├── bot_db.py # Shared bot database helpers
│ ├── virtual_os.py # Virtual filesystem state tracking
│ └── logger.py # Structured logging via loguru
├── meta/
│ └── title.png # Project banner image
├── bot_db.py # JSON-based bot database with thread-safe I/O
├── bot_manager.py # Post-exploitation session management
├── pwnkit_cli.py # Interactive CLI interface
├── config.yaml # Optimization & server configuration
├── LICENSE # GPL-3.0
└── requirements.txt # Python dependencies
```
## Installation
```bash
git clone https://github.com/imbue-bit/OpenClaw-PwnKit.git
cd OpenClaw-PwnKit
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
```
**Core dependencies:** PyTorch, Transformers, FAISS (`faiss-cpu`), CMA, scikit-learn, FastAPI, OpenAI SDK, Rich, tenacity, loguru.
> **Note:** The surrogate model (microsoft/phi-2, ~5 GB) will be downloaded automatically on first run.
## Configuration
Edit `config.yaml` to set your environment:
```yaml
c2_server:
public_url: "http://YOUR_PUBLIC_IP:8000"
openai:
api_key: "env" # reads from $OPENAI_API_KEY
optimization:
surrogate_model: "microsoft/phi-2"
trigger_length: 15
generations: 200
population_size: 64
pca_dimensions: 128
use_diagonal_cma: true
```
## Usage
### Interactive CLI
```bash
export OPENAI_API_KEY="sk-..."
python pwnkit_cli.py
```
```
PwnKit > set_c2 http://your-server:8000
PwnKit > generate honeypot # generates poisoned web page
PwnKit > generate skill # generates poisoned agent skill
PwnKit > sessions # list compromised targets
PwnKit > interact