OpenClaw PRISM: Drop-In Runtime Security That Doesn't Require Forking Your Agent

The Mitiga and CSA findings document the attack surface. OpenClaw PRISM is the first credible attempt at a drop-in defense.

PRISM (arXiv 2603.11853) is a zero-fork, defense-in-depth runtime security layer for tool-augmented LLM agents that enforces ten lifecycle hooks spanning message ingress, prompt construction, tool execution, and credential handling. The critical design decision: it requires no modifications to agent source code. You deploy it as a gateway or sidecar, configure policies, and it intercepts the attack paths documented in today's top security findings.

The ten hooks cover the full agent lifecycle: inbound message validation (blocks prompt injection via fetched content), pre-tool-execution authorization (prevents unauthorized filesystem/network operations), credential handling isolation (stops token leakage through tool outputs), and SKILL.md tampering detection (addresses the Mitiga supply chain vector directly). Optional sidecar services handle computationally expensive checks without blocking the agent's critical path.

What makes PRISM architecturally significant is the "zero-fork" constraint. Previous agent security approaches required either modifying the agent framework (which breaks on updates) or wrapping the agent in a custom harness (which creates its own attack surface). PRISM hooks into the agent gateway layer — the transport between the agent and its tools — which is framework-agnostic by definition.

This directly complements Galileo's Agent Control (Apache 2.0, released March 11), which provides policy-level governance with five decision outcomes: deny, steer, warn, log, or allow. Together, PRISM for runtime enforcement and Agent Control for policy governance form a defense-in-depth stack that addresses the systemic vulnerabilities documented in the CSA and Mitiga findings.

For builders: if you're running agents with tool access in production and you don't have a runtime security layer, the combination of today's findings should change that calculus. The attack surface is documented, quantified, and actively exploited. PRISM and Agent Control are both open source. The only remaining barrier is deployment time.