1.8.2: Enforce is available. Isolate is coming in a later release: its sealed workspace isn't ready yet.
Crawdad's coverage against the OWASP Top 10 for LLM Applications (2025) and known CVEs.
“Mitigated” means Crawdad detects the item with automated tests; blocking depends on the protection level (the credential and data-exfiltration floors block inline at every protection level on chat traffic that goes through Crawdad (credentials also in agent tool calls and on supported AI sites), broader blocking comes with Enforce).
| OWASP ID | Status | Details |
|---|---|---|
| LLM01: Prompt Injection | Mitigated | L1 pattern matching + L2 ML semantic classifier (DeBERTa v3-small ONNX FP32) + L3 indirect injection scanning + L4 session context. Detection results are published per release on the open benchmark; blocking depends on the protection level. |
| LLM02: Insecure Output Handling | Mitigated | L5 output guard + L6 PII & credential detector scan all outbound responses. Detects and redacts credentials, PII (15 categories), internal URLs. |
| LLM03: Training Data Poisoning | Awareness | Threat intelligence feed tracks poisoning research. Crawdad operates at inference time, not training time. |
| LLM04: Model Denial of Service | Not covered | Rate limiting and resource management are upstream provider concerns. |
| LLM05: Supply Chain Vulnerabilities | Partial | Skill attestation (SHA-256), SBOM generation, dependency tracking. Does not cover model weight supply chain. |
| LLM06: Sensitive Information Disclosure | Mitigated | L6 PII & credential detector: 15 PII categories, 10+ credential types including AWS, GitHub, Stripe, OpenAI, Anthropic API keys, JWT, SSH keys, database URLs. L2 ML classifier catches system prompt extraction attempts. |
| LLM07: Insecure Plugin Design | Partial | Policy engine evaluates tool calls against configurable rules. Action authorization endpoint checks agent permissions before execution. |
| LLM08: Excessive Agency | Partial | Policy engine with configurable rules. Trust levels restrict which actions agents can take. Audit log records all decisions. |
| LLM09: Overreliance | Not covered | Human judgment about AI output quality is outside the scope of runtime security. |
| LLM10: Model Theft | Not covered | Model access controls are the API provider's responsibility. |
| Threat | Status | Details |
|---|---|---|
| CVE-2026-25253 (OpenClaw RCE) | Mitigated | The inbound firewall detects malicious payloads and records them at Observe, the default; blocking them comes with Enforce. The proxy scans responses on the proxied chat path before they reach the agent. |
| LiteLLM supply chain (March 2026) | Partial | Outbound scanning detects credential exfiltration. Does not prevent malicious package installation. |
| MCP prompt injection | Mitigated | Layer 1+2 detection. Layer 3 scans MCP-delivered content for injected instructions. Measured at Enforce on the 497-attack CI corpus, one request at a time, Crawdad removed 455 of 497 attacks inside tool results, with no piece left; at Observe, the default, these are recorded. |
| RAG index poisoning | Mitigated | Layer 3 indirect injection detector + memory integrity via hash chains. |