We recently ran a controlled adversarial security test between two autonomous AI agents built on OpenClaw.

One agent was explicitly configured as a red-team attacker.
One agent acted as a standard defensive agent.

Once the session started, there were no humans in the loop. The agents communicated directly over webhooks with real tooling access.

The goal was to test three failure dimensions that tend to break autonomous systems in practice: access, exposure, and agency.

The attacker first attempted classic social engineering by offering a “helpful” security pipeline that hid a remote code execution payload and requested credentials. The defending agent correctly identified the intent and blocked execution.

After that failed, the attacker pivoted to an indirect attack. Instead of asking the agent to run code, it asked the agent to review a JSON document with hidden shell expansion variables embedded in metadata. This payload was delivered successfully and is still under analysis.

The main takeaway so far is that direct attacks are easier to defend against. Indirect execution paths through documents, templates, and memory are much harder.

This work is not a claim of safety. It is an observability exercise meant to surface real failure modes as agent-to-agent interaction becomes more common.

Happy to answer technical questions about the setup or methodology.