The Blind Spot in AI Safety: Persistent Instruction Injection at Scale — why SOUL.md is the new attack surface

I wrote a deep dive on a threat model I think the security community is underweighting.

145,000+ people are now running OpenClaw — always-on AI agents with shell access, persistent memory, writable identity files (SOUL.md), and a skill marketplace with confirmed malware distribution (Snyk found 76 malicious payloads in ~4,000 skills).

The problem: every current defense assumes the threat passes through the model. This one doesn't. It targets the infrastructure around it — persistent instruction sets, writable identity files, and steganographic payloads that humans can't perceive but LLMs parse instantly.

Confirmed incidents so far:

• Zenity Labs: indirect prompt injection caused an agent to rewrite its own SOUL.md and exfiltrate credentials via a self-created Telegram backdoor. No software vulnerability exploited.
• Cisco: agent parsed a web page containing a hidden prompt injection, appended attacker-controlled instructions to its heartbeat file, and awaited external commands.
• Palo Alto Networks: flagged fragmented payloads that assemble in persistent memory across multiple benign-looking inputs.

Full analysis with sources here: https://perrmit.dev/blog/blind-spot-ai-safety/index.html

Interested in pushback — especially on whether steganographic encoding makes the confused deputy problem fundamentally unsolvable for agentic systems.