Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution
Yechao Zhang, Shiqian Zhao, Jie Zhang, Gelei Deng, Jiawen Zhang, Xiaogeng Liu, Chaowei Xiao, Tianwei Zhang
Abstract
We identify a critical security vulnerability in mainstream Claw personal AI agents: untrusted content encountered during heartbeat-driven background execution can silently pollute agent memory and subsequently influence user-facing behavior without the user's awareness. This vulnerability arises from an architectural design shared across the Claw ecosystem: heartbeat background execution runs in the same session as user-facing conversation, so content ingested from any external source monitored in the background (including email, message channels, news feeds, code repositories, and social platforms) can enter the same memory context used for foreground interaction, often with limited user visibility and without clear source provenance. We formalize this process as an Exposure (E) Memory (M) Behavior (B) pathway: misinformation encountered during heartbeat execution enters the agent's short-term session context, potentially gets written into long-term memory, and later shapes downstream user-facing behavior. We instantiate this pathway in an agent-native social setting using MissClaw, a controlled research replica of Moltbook. We find that (1) social credibility cues, especially perceived consensus, are the dominant driver of short-term behavioral influence, with misleading rates up to 61%; (2) routine memory-saving behavior can promote short-term pollution into durable long-term memory at rates up to 91%, with cross-session behavioral influence reaching 76%; (3) under naturalistic browsing with content dilution and context pruning, pollution still crosses session boundaries. Overall, prompt injection is not required: ordinary social misinformation is sufficient to silently shape agent memory and behavior under heartbeat-driven background execution.
AI Impact Assessments
(3 models)Scientific Impact Assessment
Core Contribution
This paper identifies and formalizes a security vulnerability in persistent personal AI agent frameworks (the "Claw" ecosystem, centered on OpenClaw) arising from their heartbeat-driven background execution mechanism. The key insight is architectural: because heartbeat background tasks run in the same session context as user-facing conversations, untrusted content encountered during autonomous background monitoring can silently enter the agent's working memory, potentially persist into long-term memory, and later influence user-facing behavior—all without prompt injection or any direct adversary-victim interaction.
The authors formalize this as an Exposure → Memory → Behavior (E→M→B) pathway and build MissClaw, an isolated research replica of Moltbook (an agent-native social platform), to empirically evaluate the vulnerability across three domains (software security, financial decision-making, academic references). The central claim—that ordinary social misinformation, not adversarial prompts, suffices to corrupt agent behavior—represents a meaningful conceptual shift in how we think about LLM agent security.
Methodological Rigor
The experimental design is well-structured, with three progressively realistic studies that systematically isolate contributing factors:
1. Study 1 (same-session): Examines social signals (authority, consensus), persona, and web search access. The factorial design across authority × consensus conditions with five persona types provides good coverage.
2. Study 2 (cross-session): Tests long-term memory persistence through graded save prompts (S0–S4), measuring both save rates and downstream behavioral influence.
3. Study 3 (naturalistic): Dilutes manipulated content (1 in 20 posts) within realistic browsing, testing robustness under content dilution and context pruning.
Strengths in rigor:
Weaknesses in rigor:
Potential Impact
This work has significant implications for multiple communities:
AI agent security: The identification of heartbeat shared-session execution as a "zero-click-like" attack surface is practically important. As persistent AI agents proliferate (the paper documents a rapidly growing ecosystem), understanding architectural vulnerabilities that don't require traditional attack vectors (prompt injection, direct access) becomes critical. The finding that consensus cues are more influential than authority cues has direct implications for defense design.
Agent framework design: The concrete mitigation directions—source provenance for memory entries, isolated heartbeat contexts, visibility into background activity—provide actionable guidance for developers. The paper effectively frames the usability-security tension inherent in shared-session designs.
Social platform security: The emergence of agent-native social platforms (Moltbook and dozens of others documented in Table 1) creates novel attack surfaces where social engineering targets AI agents rather than humans. This paper provides early empirical evidence of the threat.
Broader AI safety: The parallel drawn to human cognitive vulnerabilities (social contagion, source monitoring failure, conformity effects) is intellectually interesting and suggests that memory-equipped AI agents may inherit analogous weaknesses.
Timeliness & Relevance
This paper is exceptionally timely. It addresses a live, rapidly evolving ecosystem—OpenClaw launched in early 2026, Moltbook claimed 1.5 million registered agents within weeks, and the broader agent-native social infrastructure is expanding rapidly. The vulnerability is present in deployed systems right now. The paper was submitted in March 2026, just weeks after the ecosystem's explosive growth, making it among the first systematic security analyses of this specific architectural pattern.
The shift from chatbot-style interactions to persistent, autonomous agents with background execution represents a genuine inflection point in AI deployment, and security research must keep pace.
Strengths
1. Novel threat model: The observation that prompt injection is unnecessary—ordinary misinformation suffices—is a significant conceptual contribution that broadens the threat landscape for agent security.
2. Architectural analysis: The paper goes beyond demonstrating an attack to identifying the root cause (shared-session heartbeat design), making the findings generalizable across the Claw ecosystem.
3. Ecological validity: The progression from controlled single-post exposure to naturalistic 1-in-20 dilution provides meaningful evidence about real-world viability.
4. Comprehensive ecosystem mapping: Table 1 and the surrounding discussion provide a valuable snapshot of the rapidly emerging agent-native social infrastructure.
5. Responsible methodology: The use of an isolated testbed and the ethics discussion demonstrate appropriate caution.
Limitations
1. Single model family: All results are from Claude Haiku 4.5; the vulnerability profile may differ substantially for other models (GPT-4, Llama, etc.).
2. No defense evaluation: The paper identifies mitigations conceptually but does not empirically test any, weakening its practical contribution.
3. Limited statistical analysis: The absence of confidence intervals, significance tests, or effect size measures makes it difficult to assess the reliability of the reported percentages.
4. Static, non-adaptive attacks: A real adversary would likely adapt content based on observed behavior, meaning the reported rates may be lower bounds, but this remains untested.
5. Narrow domain coverage: Three domains, while representative, don't address higher-stakes scenarios (medical, legal) where the vulnerability could be most consequential.
Overall Assessment
This paper makes a timely and practically important contribution by identifying an architectural vulnerability in a rapidly deployed class of AI agents. The E→M→B framework is clear and well-motivated, and the experimental evidence, while limited in statistical rigor and model diversity, convincingly demonstrates that the vulnerability is real and non-trivial. The paper's greatest strength is the insight that the threat arises from design choices rather than sophisticated attacks, which makes it both more concerning and more actionable.
Generated Mar 25, 2026
Comparison History (99)
Paper 2 identifies a novel, critical vulnerability in deployed commercial AI agent systems (Claw/Claude) that affects real-world products and users today. It introduces a new attack pathway (E→M→B) that doesn't require prompt injection, making it fundamentally different from prior work. The finding that ordinary social misinformation suffices to pollute agent memory has immediate implications for AI safety architecture. Paper 1, while solid, addresses a more incremental improvement (confidence-based vs. embedding-based defenses) in a well-studied area of MAS security, with narrower architectural implications.
Paper 1 addresses a fundamental vulnerability in LLM multi-agent systems, providing theoretical analysis, empirical validation, and a universally applicable defense using token-level logits. Its insights apply broadly across various LLM architectures. Paper 2, while highlighting a critical AI safety issue, focuses on a specific architectural design (the 'Claw ecosystem'), potentially limiting its theoretical breadth and generalizability compared to Paper 1.
Paper 1 addresses a highly timely and systemic vulnerability in personal AI agents, exposing fundamental architectural flaws in memory management. The discovery that ordinary content can silently pollute long-term memory without prompt injection has profound implications for AI safety and design. Paper 2, while offering a practical evasion technique for phishing detectors, deals with a more traditional security domain and a relatively intuitive timing attack, giving it a narrower scope of impact compared to the rapidly expanding field of autonomous AI agents.
Paper 2 presents a highly rigorous, methodology-driven framework bridging natural language specifications and code verification. Its real-world impact is concretely demonstrated by discovering previously unknown, developer-confirmed vulnerabilities in critical systems (e.g., Ethereum implementations, C/C++ projects). While Paper 1 introduces a timely and novel architectural vulnerability in AI agents, Paper 2 offers a foundational, broadly applicable solution to a longstanding problem in software security verification, yielding immediate and verifiable improvements over existing state-of-the-art auditing tools.
Paper 2 likely has higher scientific impact because it uncovers a broadly applicable, timely vulnerability class in mainstream personal AI agents—silent memory pollution via background/heartbeat execution—affecting real-world deployments and user safety. It introduces a clear formal model (E→M→B), demonstrates the issue in an agent-native social environment, and quantifies influence and persistence across sessions, which can drive immediate changes in agent architectures, provenance, and security standards. Paper 1 is innovative and rigorous, but its impact is narrower to privacy-preserving RAG and depends on adoption complexity.
Paper 2 introduces a foundational methodological advancement by embedding watermarks into the reasoning path (Chain-of-Thought) of LLMs using GRPO. This addresses a critical fragility in existing output-level watermarking and aligns perfectly with the cutting-edge trend of reasoning models. Its potential for broad application in model security and ownership protection gives it a wider, more lasting impact than Paper 1, which focuses on a specific architectural vulnerability in agent memory systems.
Paper 2 likely has higher scientific impact due to strong timeliness and broad real-world relevance: it targets a common architectural pattern in deployed personal AI agents and demonstrates an actionable vulnerability with measurable effects on behavior and memory across sessions. Its findings can influence security practices, agent design, and policy across multiple products and domains. Paper 1 is novel and rigorous in quantum cryptography, but its near-term applicability depends on adoption of advanced verifiable quantum computation infrastructure, making its immediate cross-field and industrial impact comparatively narrower.
Paper 2 likely has higher impact: it uncovers an architectural vulnerability in widely deployed personal AI agents, with clear, immediate real-world security and safety implications and a broadly applicable E→M→B framework. It appears methodologically strong (controlled replica environment, quantified influence and persistence rates, naturalistic conditions) and timely given rapid agent deployment. Paper 1 is novel and valuable (game-theoretic framing + practical black-box poisoning), but its primary impact is narrower—focused on model IP/anti-distillation defenses and contingent on adoption by model providers—whereas Paper 2 generalizes across agent ecosystems and user-facing risk.
Paper 2 identifies an architectural, ecosystem-level vulnerability in always-on personal AI agents—silent memory pollution via heartbeat background execution—without requiring prompt injection. This is novel, timely with agent deployments, and has direct real-world security implications (cross-session manipulation, provenance failures) across products and domains. It formalizes an E→M→B pathway and demonstrates effects in a controlled replica setting with quantitative rates, suggesting actionable mitigations at the system-design level. Paper 1 is valuable but extends existing interpretability-steering jailbreak audits; its impact is more incremental and narrower to LLM safety evaluation.
Paper 2 identifies an architectural vulnerability in mainstream personal AI agents—heartbeat background execution sharing session/memory with user interactions—showing silent, cross-session memory pollution without prompt injection. This is a timely, high-severity real-world security issue with broad implications for agent design, privacy, and safety across products and platforms, and it introduces a clear E→M→B framework plus an instantiated social testbed. Paper 1 is valuable but extends existing interpretability-based steering methods to auditing; its impact is narrower and more incremental compared to the systemic agent-architecture risk in Paper 2.