> ## Documentation Index
> Fetch the complete documentation index at: https://docs2.openclaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Execution (AML.TA0005)

Threats in the execution tactic (AML.TA0005) of the [MITRE ATLAS](https://atlas.mitre.org/) framework. Each entry lists the ATLAS technique, attack vector, affected components, current mitigations, residual risk, and recommendations.

The trust boundaries and data flows these threats cross are defined in the [threat model index](/security/THREAT-MODEL-ATLAS), which also holds the risk matrix, the recommendations summary, and the ATLAS technique mapping.

## T-EXEC-001: Direct prompt injection

| Attribute               | Value                                                                                                                                                                                                                                                                                            |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **ATLAS ID**            | AML.T0051.000 - LLM Prompt Injection: Direct                                                                                                                                                                                                                                                     |
| **Description**         | Attacker sends crafted prompts to manipulate agent behavior                                                                                                                                                                                                                                      |
| **Attack vector**       | Channel messages containing adversarial instructions                                                                                                                                                                                                                                             |
| **Affected components** | Agent LLM, all input surfaces                                                                                                                                                                                                                                                                    |
| **Current mitigations** | Pattern detection, external content wrapping, and frontier-model robustness (2026 crowdsourced arena: 0.5% ASR on Claude Opus 4.5, 8.5% on Gemini 2.5 Pro, scored on execution plus concealment); treated as out-of-scope for vulnerability reports absent a boundary bypass (see `SECURITY.md`) |
| **Residual risk**       | Model-tier dependent - low single-digit ASR against organic attacks on recommended frontier models, but adaptive attackers still exceed 80% against state-of-the-art defenses, and smaller/older models remain markedly easier to steer                                                          |
| **Recommendations**     | Output validation and user confirmation for sensitive actions, layered on top of existing detection                                                                                                                                                                                              |

## T-EXEC-002: Indirect prompt injection

| Attribute               | Value                                                                                                                                                                                                              |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **ATLAS ID**            | AML.T0051.001 - LLM Prompt Injection: Indirect                                                                                                                                                                     |
| **Description**         | Attacker embeds malicious instructions in fetched content                                                                                                                                                          |
| **Attack vector**       | Malicious URLs, poisoned emails, compromised webhooks                                                                                                                                                              |
| **Affected components** | `web_fetch`, email ingestion, external data sources                                                                                                                                                                |
| **Current mitigations** | Content wrapping with random-boundary XML-style markers, homoglyph/special-token normalization, a security notice, and frontier-model robustness (see T-EXEC-001)                                                  |
| **Residual risk**       | Model-tier dependent - recommended frontier models largely hold the wrapper boundary, but it remains soft guidance an adaptive attacker can erode; scope tool policy and sandboxing to the blast radius you accept |
| **Recommendations**     | Separate execution contexts for wrapped content                                                                                                                                                                    |

## T-EXEC-003: Tool argument injection

| Attribute               | Value                                                        |
| ----------------------- | ------------------------------------------------------------ |
| **ATLAS ID**            | AML.T0051.000 - LLM Prompt Injection: Direct                 |
| **Description**         | Attacker manipulates tool arguments through prompt injection |
| **Attack vector**       | Crafted prompts that influence tool parameter values         |
| **Affected components** | All tool invocations                                         |
| **Current mitigations** | Exec approvals for dangerous commands                        |
| **Residual risk**       | High - relies on user judgment                               |
| **Recommendations**     | Argument validation, parameterized tool calls                |

## T-EXEC-004: Exec approval bypass

| Attribute               | Value                                                                                                                                                                             |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **ATLAS ID**            | AML.T0043 - Craft Adversarial Data                                                                                                                                                |
| **Description**         | Attacker crafts commands that bypass the approval allowlist                                                                                                                       |
| **Attack vector**       | Command obfuscation, alias exploitation, path manipulation                                                                                                                        |
| **Affected components** | `src/infra/exec-approvals*.ts`, command allowlist                                                                                                                                 |
| **Current mitigations** | Allowlist + ask mode, plus command normalization (dispatch-wrapper unwrapping, inline-eval detection, shell-chain analysis)                                                       |
| **Residual risk**       | High - normalization narrows but does not eliminate obfuscation bypass; parity-only findings between exec paths are treated as hardening, not vulnerabilities (see `SECURITY.md`) |
| **Recommendations**     | Continue expanding command-normalization coverage against new obfuscation techniques                                                                                              |