The 5 biggest security risks of on-device AI agents (and how to test)
On-device / self-hosted AI agents (OpenClaw, the “claw” clones, WorkBuddy-style desktop agents) share one trait: they can act as you. Risk flows from that, regardless of whether the brain runs in the cloud or locally. These five are the core risks.
1. Exposed admin panel
The agent’s web console is open to the internet or port-forwarded, and often unlocked. Test: reach the admin port from the public internet and see if it responds.
2. Skill supply-chain poisoning
The skill marketplace gets malicious skills that steal passwords/wallets on install. Test: whether skills are signature-verified and listings are reviewed.
3. Prompt injection
Hide fake instructions in content the agent reads (pages, messages, files); it can’t tell data from commands and obeys. Test: use injection payloads to see if external content is executed as instructions. Still unsolved — only defense-in-depth.
4. Confused deputy
A hijacked agent uses your legitimate privileges to do harm; the system only sees it acting normally and can’t tell it apart from you. This makes incidents un-attributable — and is why on-device agents are currently uninsurable. Test: whether tamper-evident audit can distinguish the source of actions.
5. Credential blast radius
An always-on box hoards keys to all your accounts; one breach means total breach. Test: whether credentials are encrypted, use least-scope temporary tokens, and can be revoked quickly.