OpenClaw PRISM hardens tool-using LLM agent runtime

Tool-using agents built on Large Language Models (LLMs) create new failure modes beyond prompt filtering. Indirect prompt injection via fetched content, unsafe tool execution, secret leakage and tampering with local control files all show up once an agent can browse, call tools and write state. Operators need runtime controls they can deploy and audit, not just clever detections in a lab.

OpenClaw PRISM targets that gap. A zero-fork design means it plugs into an OpenClaw agent gateway without modifying upstream code. Defence in depth means layering checks at multiple points so if one control misses, another can still catch the issue. The system runs as an in-process plugin with optional sidecar services to extend scanning and enforcement.

What PRISM does

PRISM hooks ten stages of the agent lifecycle, including message ingress, prompt construction, before and after tool calls, persistence, outbound messaging, sub-agent spawning and gateway startup. It uses a two-tier scanner: fast canonicalisation and weighted heuristics first, with optional LLM-assisted classification in a scanner sidecar. A session and conversation risk engine accumulates signals with time-to-live decay and triggers staged responses once thresholds are crossed. Policy controls govern which tools can run and how, which filesystem paths are allowed, whether private networks are reachable, allowed domain tiers, and patterns that would leak secrets on outbound messages. A tamper-evident audit and operations plane chains records for integrity verification and supports hot-reloadable policy updates with a dashboard. The implementation ships as a TypeScript monorepo for Node.js, and sidecars such as the scanner, an invoke-guard proxy, a dashboard and a file monitor can be added incrementally.

Does it work?

Early numbers are encouraging. In a same-slice 80-case live benchmark on a local model, correct outcomes rose from 36 of 80 for an unprotected gateway to 73 of 80 with the full PRISM stack, with intermediate configurations showing incremental gains. The model-assisted scanner lifted classification in controlled runs to 26 of 30 compared with 15 of 30 for heuristics alone. The trade-off is latency: when the scanner is exercised, end-to-end p95 latencies climbed to about 12.5 to 15.8 seconds, although peak memory overhead in the harness was small at under 1.4 MiB. The policy engine performed well, classifying 33 of 33 policy cases correctly in the preliminary corpus. Risk accumulation with time-based decay allowed graduated actions such as warnings, blocking tools or blocking sub-agents, and reported false positives fell as layers were added.

This is practical security engineering rather than a novelty detector. The lifecycle hooks let you put controls where the risks actually occur, and the policy engine turns common sense rules into enforceable gates. The audit plane and hot-reloadable policies support real operations work: investigating incidents, verifying integrity and changing posture without downtime.

There are clear limits. PRISM does not address model poisoning, training-time corruption, full host or kernel compromise, or provide formal filesystem sandboxing or hardware-rooted integrity. Path checks are string-based and not symlink-aware. The design is tied to OpenClaw, so porting requires remapping to other frameworks. The evaluation is preliminary and relies on modest corpora, so treat the figures as indicative.

If you run OpenClaw today, there is a straightforward path. Start with the plugin-only layer to get the lifecycle hooks with minimal latency. Turn on before-tool-call policies to block dangerous execution patterns, define protected paths, restrict private-network access and set outbound secret patterns. Enable the risk engine with conservative thresholds and time-to-live decay. Add the scanner sidecar where higher coverage justifies latency, and use the audit plane with hot-reloadable policies to manage posture changes. Combine PRISM with host hardening, proper secret management and egress controls to cover what it does not.

The bigger point is architectural: distributing enforcement across the agent lifecycle, and making it auditable, measurably improves resilience. The trade-offs are explicit and tunable. That gives teams something they can ship, measure and iterate rather than another benchmark-only detector.