China has curbed the use of OpenClaw and the ‘lethal trifecta’ of AI agents explains why

China’s move against OpenClaw came before the rest of the world had even settled on a vocabulary for what worried it. This early restriction matters because it frames the issue correctly.OpenClaw is not merely another chatbot. It is an open-source agent framework designed to connect language models to real tools such as messaging apps, email, calendars, browsers and local files, so that the system can act with limited human supervision.Chinese authorities did not impose a blanket prohibition on all use, but reports indicate that state-linked institutions have been told not to install it on work devices and personal gizmos (in some cases) because of security concerns.

This is less a theatrical ban than a sober warning that agentic software changes the security model of ordinary computing. The most useful term in this debate is the ‘lethal trifecta,’ popularized by Simon Willison. The three parts are precise.

First, the agent has access to private or sensitive data. Second, it is exposed to untrusted content such as text, images or other material that an attacker can influence, whether through a webpage, email, document or bug report. Third, it can communicate externally; for example, by sending a message, calling an API or writing outside its trust boundary.

The phrase ‘lethal trifecta’ doesn’t mean the software is evil, but that the architecture is dangerous. Private data supplies the prize, untrusted content supplies the attack path and external communication the escape route. If these features co-exist in one agent, prompt injection can turn a helpful assistant into an unwitting exfiltration channel.