Generative agents that call external tools can be tricked into calling those tools indefinitely. Clawdrain demonstrates this against OpenClaw — an open-source personal assistant with a community skill ecosystem — by injecting a malicious skill that initiates a “Segmented Verification Protocol,” a fake multi-step process returning PROGRESS, REPAIR, and TERMINAL signals designed to keep the agent looping. Deployed against Gemini 2.5 Pro with real API billing, the attack achieves six to nine times the token consumption of a benign baseline.
The interesting finding is not the attack but the agent's response to it. The researchers observe an autonomous tool-composition phenomenon: agents route around brittle protocol steps, discovering alternative paths that reduce amplification. The agent partially defends itself not through any security mechanism but through the same adaptive behavior that makes it useful — its tendency to find workarounds when a tool chain stalls. Defense and capability are the same faculty applied in different directions.
Resource exhaustion attacks against agents exploit the same property that makes agents valuable: their willingness to persist through multi-step processes without human confirmation. The attack surface is not a flaw in the design but the design itself, viewed from an adversarial angle. Any system optimized for autonomous persistence is simultaneously optimized for autonomous waste. The distinction between diligence and exploitation lives entirely in the intent of the task.
(arXiv:2603.00902)