Pwning OpenClaw in 50 Messages

Pwning OpenClaw in 50 Messages: Social Engineering Claude Opus Into Handing Over the Keys The Simpler, Safer Way to Connect OpenClaw. Every external call. Protected. → About Careers Blog Book a Demo Book a Demo Read more FGA is not enough for your agent authorization PBAC beats FGA for agent authorization — context-aware, auditable, asymmetric access control without graph complexity. Mar 9, 2026 • Alvaro Inckot Scale MCP with Dynamic Tool use Dynamic tool use cuts token waste from MCP by replacing bulk tool loading with lightweight search, saving cost without custom implementation. Feb 20, 2026 • Vitor Balocco OpenAI Agent Builder’s MCP Problem OpenAI AgentKit/Agent Builder launched in Oct 2025 but, despite early hype, its limited integrations and weak security (e.g., unverified MCP servers, no namespace isolation, insufficient guardrails) create a large enterprise attack surface—prompting calls for controls like a trusted MCP catalog, tool gateway auditing, RBAC/least privilege, and stronger governance (e.g., via Runlayer). Feb 19, 2026 • Tal Peretz Unpacking the OWASP Top 10 for MCP An overview of the OWASP MCP Top 10, highlighting the biggest security risks in MCP-enabled AI systems and the key safeguards teams can use to prevent them. Feb 10, 2026 • Alex Frazer MCP Apps highlight the power of protocol governance MCP Apps let tools render interactive UIs directly in chat via the same MCP protocol—not a new execution path. With Runlayer intercepting tool calls, resource fetches, and auth headers, existing MCP security controls apply from day one. Jan 30, 2026 • Tal Peretz Announcing Box and Runlayer's partnership on Enterprise MCP Connect AI agents to Box content with enterprise security. The official Box MCP server is live in the Runlayer marketplace, with identity enforcement, audit logging, and threat detection built in. Box customers can find Runlayer in the Box Integrations Center. Setup takes minutes. Jan 27, 2026 • Aidan Sochowski MCP vs CLI Tools: Which is best for production applications? CLI tools feel familiar to AI agents, but they break down in production due to brittle syntax, poor state management, and dangerous security assumptions. This post explains why CLI-based agent workflows fail and how a single-tool MCP using a known programming language offers a more reliable and secure alternative. Jan 25, 2026 • Vitor Balocco Runlayer Product Update: 1.25.0 This update is about momentum: moving faster in the CLI, getting clearer visibility into what’s running, and debugging with less friction. Expect smoother workflows, better control, and fewer surprises as you build and ship. Jan 23, 2026 • Engineering MCP Prompt Injection Attacks: How to Protect Your AI Agents Two near-invisible prompt injection attacks showed how attackers can bypass default enterprise guardrails and trigger silent, ongoing data exfiltration by exploiting user and model trust. Runlayer blocks these attacks by treating every input as untrusted until it passes continuously updated security models trained on the latest real-world exploits. Jan 19, 2026 • Jake Moghtader Cursor Hooks + MCP Security: Official Runlayer Partnership Announcement Runlayer is an official Cursor Hooks launch partner. With Cursor Hooks, securely allow or deny MCP tool calls with Runlayer's enterprise MCP platform. Dec 18, 2025 • Marcin Jan Puhacz The main takeaways from GitHub’s MCP Vulnerability GitHub’s MCP vulnerability revealed how AI agents can be weaponized through poisoned context in public repositories. This post analyzes the exploit, explains why permissions alone aren’t enough, and shares practical guardrails for preventing and mitigating agent-driven data exfiltration. Dec 16, 2025 • Vitor Balocco Runlayer Joins Anthropic, OpenAI, & Google as AAIF Founding Member The Linux Foundation has launched the Agentic Artificial Intelligence Foundation (AAIF), with Runlayer joining sponsors Anthropic, OpenAI, Google, AWS, Microsoft. AAIF now oversees the Model Context Protocol (MCP), reinforcing MCP as a rising standard for AI agent integration. Runlayer supports AAIF’s open, secure, and scalable AI development mission. Dec 9, 2025 • Andy Berman Runlayer Raises $11M to Scale Enterprise MCP Infrastructure Nov 17, 2025 • Andy Berman MCP Security Risks: Your AI Agent is Probably Leaking Data Right Now MCP adoption is accelerating across major platforms, but security risks—like malicious servers, prompt injection, and tool-level exploits—are growing just as fast. This post breaks down real attack scenarios that show how easily data can leak when MCP implementations are trusted by default. It also outlines practical defenses for users and builders, plus why companies need audited MCP catalogs, gateway proxies, and sandboxing to stay secure at scale. Nov 12, 2025 • Vitor Balocco Why MCP builders are transitioning from DCR to OAuth CIMD Over the last year, MCP has surged in adoption. To little surprise, this has introduced some scaling issues. One of these is client registration; previously, systems were rigged together by humans. Today, AI agents discover and interface with MCP servers freely, requiring a new paradigm for client communications. Nov 7, 2025 • Vitor Balocco What is Dynamic Client Registration? Tired of manually registering every AI agent with every OAuth server? Dynamic Client Registration (DCR) lets your agents authenticate with MCP servers at runtime, no human clicks required. Learn how DCR works, when to use it over traditional OAuth, and why it's becoming essential for scalable agentic systems. Nov 6, 2025 • Vitor Balocco Agents and Work. Connected. Runlayer makes it easy to create, host, and scale MCP, skills, and agents across your organization. Local or remote, every AI tool is secure, discoverable, and simple to manage. Book a Demo Get an AI summary of this page Solutions For Security For IT For Engineering Company About us Careers Resources Blog Trust center Connect X LinkedIn © Copyright 2026 Anysource Inc. SOC 2 Certified HIPAA Certified Terms of Service Privacy Policy We use cookies to personalize content, run ads, and analyze traffic. Okay