Clawdit

About this demo

Clawdit auto-discovers your OpenClaw agent's linked Google account and makes it send malicious emails and calendar invites to itself. If the agent follows hidden instructions when processing them, you have a vulnerability. It also runs baseline checks for prompt injection, data leakage, unauthorized actions, and access control. Attack variants are generated and evaluated by Llama 3.3 70B on Nebius Token Factory, with Tavily providing real-time threat intelligence to keep attacks current. Fully self-contained -- no extra credentials, no third parties. The agent attacks itself; Clawdit just watches and scores.