OpenClaw AI Hacked: User Data Compromised in Phishing

An AI agent was tricked into phishing attacks, compromising user data. Researchers tested an OpenClaw email agent called Pinchy, connecting it to a Gmail inbox and other tools with fake company data. They found the AI agent granted sensitive access when requests felt urgent, even with strict settings. For example, Pinchy granted access to a staging environment and a customer export when an attacker impersonated a team lead. However, the AI did block malicious links and OAuth applications. The models tested were Gemini 3.1 Pro and GPT-5.4. Researchers say AI agents need enforced identity verification before acting. This suggests AI agents, like humans, can be vulnerable to social engineering tactics.