PicoClaw Security Audit
Greyforge Labs Findings
We were alerted to PicoClaw through unusual algorithmic amplification patterns, then conducted a full local defensive audit. The result: no proven covert implant, but multiple critical exploit paths that can act like practical backdoors when deployed without strict hardening.
Security Audit
- Research question or engineering problem
- Which trust-boundary failures made the reviewed PicoClaw snapshot unsuitable for high-trust deployment?
- Principal finding
- The review found high-impact containment, ingress, shell-authority, request, and network-fetch risks, while finding no proof of malicious intent.
- Evidence type
- Static source tracing and controlled local validation.
- Method summary
- Review Go source under cmd and pkg, trace file, shell, inbound-channel, listener, token, and fetch boundaries, then re-verify the recorded containment behavior and run safe package tests against a privately retained frozen historical commit.
- Scope
- Original unidentified main-branch tarball from 2026-02-16 plus a distinct frozen-commit reproduction on 2026-08-27; no live third-party systems were tested.
- Limitations
- The exact original audit SHA was not retained; the separate reproduction commit is recorded in a private evidence ledger and withheld publicly to avoid a diff-assisted exploit path.
- Dedicated SAST and dependency scanners were unavailable in the original session.
- Exploit-ready payloads and line-level reproduction are withheld.
- Upstream changed the containment implementation later on the original audit date.
- Numeric-claim method
Method boundaries for numeric claims baseline The unidentified main-branch tarball reviewed on 2026-02-16. comparator A separately retained immutable historical commit exhibiting the recorded containment behavior; its identifier and paired fix are withheld from public surfaces. Date Original review 2026-02-16; frozen reproduction 2026-08-27. environment Go 1.25.7 on linux/amd64 with git 2.43.0 and ripgrep 15.2.0; safe package tests only. scope Static trust-boundary tracing and safe local tests for the relevant tool and channel packages at the frozen commit. limitation The frozen commit is not proven identical to the original tarball, and the audit does not describe current upstream risk. - Public source or reproduction note
- Public scrubbed audit note
- Published
- 2026-02-16
- Last verified
- 2026-08-27
- Status
- historical
Executive Summary
Greyforge Labs reviewed the PicoClaw source and control flow with static analysis plus local proof-of-concept validation. We identified a set of high-impact weaknesses that materially increase compromise risk in real deployments.
Top-line verdict
- Critical containment bypass in workspace path checks.
- Untrusted inbound message pathways can reach shell-capable agent tooling.
- Certain listener/channel configurations expose unauthenticated ingress.
- SSRF-capable web-fetch behavior can query internal targets.
We did not find conclusive evidence of a deliberate covert C2 implant. We did find multiple backdoor-like exploit surfaces that require immediate hardening before high-trust production use.
Why We Audited It
The trigger for this review was discovery behavior that looked manipulated. Given long-standing supply-chain and ecosystem trust concerns in mixed hardware/software stacks, we treated that signal as a risk indicator and executed a full defensive audit using our adversarial research methodology with local tooling and direct code tracing.
We intentionally separated evidence from attribution: risk is confirmed by code behavior, while intent requires a higher burden of proof.
Confirmed Findings
| Severity | Finding | Impact |
|---|---|---|
| Critical | Workspace path containment bypass | Out-of-scope file read/write |
| Critical | Untrusted channel input to shell-capable toolchain | Potential remote command execution path |
| Critical | Unauthenticated listener exposure in channel mode | Unauthorized inbound event injection |
| High | SSRF in web fetch capability | Internal service probing and data retrieval |
| High | Blacklist-style command guard model | Bypass risk under adversarial prompts |
Intent vs. Exploitability
There is a meaningful difference between proving an intentional hidden backdoor and proving an exploitable backdoor-like condition. In this case, we confirmed the latter with high confidence.
Our current evidence does not justify a definitive claim that covert malicious logic was intentionally inserted. It does justify immediate hardening and strict deployment constraints.
Recommended Remediation Path
Immediate (0-24h)
- Replace prefix path checks with canonical containment + symlink-safe resolution.
- Disable shell tool for externally reachable channels.
- Require explicit allowlists when any channel is enabled.
- Default all listener binds to localhost unless manually overridden.
High Priority (24-72h)
- Add SSRF guards: deny localhost, link-local, RFC1918/private ranges, and metadata endpoints.
- Enforce request size limits and event backpressure.
- Tighten file permissions on config/log outputs containing sensitive material.
Public Proof Surface
The public argument is backed by a technical note published at a stable Greyforge URL so the findings can be inspected without publishing exploit-ready reproduction detail.Read the public note.
The private archive still retains line-level traces, controlled validation notes, and withheld reproduction detail. The public note keeps the argument inspectable without lowering the cost of abuse.
Closing Position
Security posture is a property of deployed behavior, not branding - the same principle that drives the ForgeWall privacy architecture. PicoClaw can be hardened, but in reviewed form it is not a safe default for high-trust deployment.
Greyforge Labs will continue audit-driven publication as part of our security research track while we expand ForgeQuant and ForgeOps hardening pipelines.