Imagine a medieval castle where the drawbridge, the treasury, the armory, and the messenger service all share a single hallway — and anyone who can talk to the messenger can walk into the treasury. That's the security model of today's agentic AI frameworks. OpenClaw-style systems combine LLM reasoning, persistent memory, tool invocation, local code execution, and web workflows into a single pipeline, and this paper asks: what happens when the hallway has no doors? The committed claim: agentic AI security failures are not isolated implementation bugs but recurring trust-boundary failures across the entire execution pipeline. The authors back this up with an empirical study of 25,292 Reddit posts across 13 subreddits and 358 security-tagged GitHub issues, distilling 162 security-relevant Reddit discussions and 180 concrete GitHub security reports. Through qualitative coding and CWE (Common Weakness Enumeration) mapping, they identify 521 CWE instances spanning 59 distinct weakness types — concentrated in access-control failures, sensitive-data exposure, injection attacks, and unsafe execution. The ladder here is unusual because this paper isn't competing against a prior benchmark — it's creating one. There is no established empirical taxonomy of agentic-system security weaknesses at this scale. Prior work exists on prompt injection (Greshake et al., 2023) and LLM red-teaming, but those focus on the model layer, not the full agent execution pipeline. This paper's contribution is the systematic mapping of where trust breaks down across memory, tools, execution, and deployment. The 59 CWE types and 543 practitioner-suggested mitigations consolidated into seven strategies represent the most complete empirical picture of this attack surface to date. Architecturally, this is a qualitative empirical study, not a systems paper. The method is grounded theory applied to two complementary data sources: Reddit (community perception, practitioner experience) and GitHub (concrete bug reports with technical detail). The CWE mapping provides commensurability with traditional software security — you can compare these 59 weakness types directly against OWASP or MITRE ATT&CK categories. The illustrative reconstruction of a sensitive-data exposure pathway uses dummy values, which is honest but limits the integrity claim: this is evidence-grounded illustration, not a demonstrated exploit chain on a live system. Integrity is the dimension where this paper is most transparent about its limits. The data sources are public and reproducible. The qualitative coding methodology is described. But the validation is inherently circular in the way all qualitative studies are: the researchers chose the coding categories, applied them, and then reported the patterns they found. There's no adversarial red team independently confirming that these weakness categories are exhaustive or that the severity rankings match real-world exploitability. The CWE mapping provides external grounding, but the paper acknowledges this is practitioner-reported, not attacker-demonstrated. The practical implications are immediate. The seven mitigation strategies — explicit trust boundaries, least-privilege tool access, execution containment, runtime oversight, defense-in-depth, memory isolation, and input sanitization — aren't novel individually, but their consolidation from 543 practitioner suggestions gives them empirical weight. If you're deploying an agentic system today, this paper is a checklist. The milestone question is whether the field moves from taxonomizing weaknesses to building verified trust-boundary enforcement — and the gap between 'we know what's broken' and 'we can prove it's fixed' is years wide. The experiment the authors didn't run — and this is the obvious successor — is an automated red-team evaluation against live OpenClaw deployments using the 59 CWE categories as an attack playbook. The honest read is (a): this is a qualitative research group, not a pen-testing team, and the compute/access/ethics requirements for live exploitation studies are substantially different. But until someone runs those attacks systematically, the severity hierarchy remains practitioner-reported, not empirically validated.
