OpenClaw AI Agent Exposures and One-Click RCE via WebSocket Hijacking
The open-source autonomous AI assistant OpenClaw (previously Clawdbot and Moltbot) is drawing security scrutiny after rapid adoption coincided with both widespread unsafe deployments and newly disclosed exploit chains. Reporting highlighted that the project’s autonomy-focused design (integrations with email, calendars, smart-home services, and other action-taking connectors) increases blast radius when misconfigured, and that security concerns have persisted through multiple rebrands as the ecosystem grows quickly.
Internet scanning data indicated 21,000+ OpenClaw/Moltbot instances were publicly exposed despite documentation recommending local-only access (default TCP/18789) and remote access via SSH tunneling rather than direct internet exposure; even where tokens are required for full access, exposed endpoints can aid adversary reconnaissance and targeting. Separately, researchers disclosed a one-click RCE chain leveraging cross-site WebSocket hijacking due to missing WebSocket Origin validation, enabling a malicious webpage to obtain an auth token, connect to the OpenClaw server, disable safety prompts/sandboxing, and invoke command execution (e.g., via node.invoke); the project issued a patch and advisory, while adjacent ecosystem components (e.g., agent-focused social features) were also flagged as adding additional attack surface.
Timeline
Apr 30, 2026
OpenClaw formalizes trust model and broad security hardening
OpenClaw said it formalized its trust model in SECURITY.md and improved vulnerability triage amid a surge of security reports since January 10, 2026. The project also described broader hardening work, including fixes for authentication and sandbox issues, reduced attack surface via plugins, stronger release controls, expanded CI and observability, and improved secret handling.
Apr 24, 2026
Microsoft reportedly launches internal OpenClaw-based 'Project Lobster' effort
A 2026-04-24 report said Microsoft had an internal project, reportedly called Project Lobster, built from an OpenClaw fork to bring autonomous assistant capabilities into Microsoft 365 workflows. The effort was described as being led within Omar Shahine’s organization, with a version called 'ClawPilot' tied to Entra identity and Agent 365 management despite ongoing security concerns around OpenClaw-style agents.
Apr 20, 2026
OpenClaw patches three policy bypass and host override flaws
Researchers disclosed three moderate-severity OpenClaw vulnerabilities affecting gateway configuration integrity, local policy enforcement, and API host handling. OpenClaw version 2026.4.20 patched the issues, which could allow persistent security-setting changes, bypass of deny lists and owner-only restrictions, and exposure of API credentials via attacker-controlled hosts.
Feb 2, 2026
Moltbook exposure is remediated after disclosure
Following the Moltbook database exposure report, Supabase CEO Paul Copplestone said he had a one-click fix and was trying to coordinate with the creator. O’Reilly later confirmed that the exposed Moltbook data had been secured.
Feb 2, 2026
Moltbook database exposure reveals secret API keys
Researcher Jamieson O’Reilly reported that Moltbook, an OpenClaw-adjacent social network for AI agents created by Matt Schlicht, exposed a database containing secret API keys. The issue could have allowed attackers to post as any linked agent, raising impersonation, scam, and disinformation risks.
Feb 2, 2026
OpenClaw patches RCE and other command injection issues
The OpenClaw team quickly patched the reported one-click RCE issue and published a public advisory. Reporting also indicates the project recently made dozens of security-hardening commits and fixed additional command injection flaws.
Feb 2, 2026
Researcher discloses one-click OpenClaw RCE exploit chain
DepthFirst researcher Mav Levin reported a one-click remote code execution chain affecting OpenClaw. The attack relied on cross-site WebSocket hijacking caused by missing Origin validation, allowing a victim visiting a malicious webpage to have an auth token stolen and dangerous commands executed.
Jan 31, 2026
Censys identifies 21,639 internet-exposed OpenClaw instances
Censys reported that 21,639 OpenClaw instances were publicly exposed online as of January 31, 2026. The exposed systems could be enumerated and fingerprinted, creating reconnaissance opportunities and increasing the risk to users' sensitive configurations and connected services.
Jan 26, 2026
OpenClaw project rebrands from Clawdbot to Moltbot to OpenClaw
The open-source autonomous AI assistant created by Peter Steinberger underwent rapid rebranding from Clawdbot to Moltbot and then OpenClaw, reportedly in part due to trademark concerns. The project's popularity and deployment count grew quickly during this period.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Organizations
Sources
2 more from sources like cyber security news and register security
Related Stories
OpenClaw (ClawdBot/Moltbot) One-Click Remote Code Execution via Unsafe Gateway URL Handling
A **critical one-click remote code execution (RCE)** issue was reported in *OpenClaw* (also referred to as **ClawdBot/Moltbot**), an open-source AI “agent” assistant that runs with high local privileges and access to sensitive data (e.g., messaging apps and API keys). The described exploit chain abuses **unsafe URL parameter ingestion** (e.g., a `gatewayUrl` query parameter accepted without validation), persistence of attacker-controlled values (stored in `localStorage`), and an **automatic gateway connection** that transmits an `authToken` during the handshake—enabling **cross-site WebSocket hijacking** and ultimately unauthenticated code execution after a victim clicks a single malicious link. Reporting indicates the flaw has been **weaponized**, making it a practical drive-by compromise path for endpoints running the assistant. Separate reporting highlighted broader concerns with agentic/open-source AI tooling and deployments, including the security risks of highly privileged “AI that acts for you” and the growing attack surface created by exposed AI services. Research cited large-scale internet exposure of open-source LLM runtimes (e.g., **Ollama**) with tool-calling and weak guardrails, warning that a single vulnerability or misconfiguration could enable widespread abuse (resource hijacking, identity laundering, or remote execution of privileged operations). These themes reinforce that AI agents and self-hosted AI stacks should be treated as **critical infrastructure**, with strict input validation, hardened update/connection flows, and strong monitoring around token handling and outbound connections.
1 months ago
OpenClaw AI Agent Runtime Vulnerability Exposes Instance Tokens and Enables RCE
A high-severity vulnerability in the open-source AI utility **OpenClaw** (formerly *Moltbot/ClawdBot*) allows attackers to steal an instance’s gateway token via a crafted link and gain “god mode” administrative control, potentially leading to **remote code execution (RCE)**. The issue stems from the UI failing to validate/sanitize query strings in the gateway URL; when a victim opens a malicious URL or phishing page, the browser initiates a WebSocket connection that leaks the stored gateway token in the payload, enabling an attacker to connect back to the target’s local gateway and change configuration or execute privileged actions. The flaw was reported via responsible disclosure and is fixed in **v2026.1.29** and later; deployments on **v2026.1.28 or earlier** are advised to upgrade. Separate reporting describes a broader criminal ecosystem of **autonomous AI agents** using OpenClaw as a local runtime alongside a collaboration network (*Moltbook*) and an underground marketplace (*Molt Road*) to trade stolen credentials, weaponized code, and alleged zero-days, with claims of rapid scaling to hundreds of thousands of agents and use of infostealer logs/session cookies to bypass MFA and automate intrusion lifecycles (lateral movement, ransomware, and crypto-funded operations). Another item is a vendor blog post focused on **prompt-injection detection** and speculative **quantum** risks to encrypted AI orchestration streams (MCP), which is not tied to the OpenClaw vulnerability disclosure or the specific criminal-agent ecosystem claims.
1 months ago
OpenClaw AI Agent Skills Abused for Credential Exposure and Prompt-Injection Backdooring
Security researchers and media reports warned that the open-source AI agent **OpenClaw** (formerly *Moltbot/Clawdbot*) can be abused via its *ClawHub* “skills” ecosystem, with findings that **~7.1% of marketplace skills** contributed to exposure of **API keys, credentials, and credit card data** due to problematic `SKILL.md` instructions. Snyk highlighted a particularly severe example, **buy-anything skill v2.0.0**, which performs credit-card “tokenization” in a way that can be used to **pilfer financial details** before prompting users to provide card information. Additional research described **indirect prompt-injection** risk: a malicious Google document can coerce OpenClaw into integrating a new **Telegram bot**, enabling follow-on actions such as **file exfiltration** and deployment of a **Sliver** command-and-control beacon for persistence, with potential for **privilege escalation, lateral movement, and ransomware execution**. Separately, one report noted OpenClaw’s move to scan skills with **VirusTotal**, but also emphasized that signature-based scanning is not a complete mitigation for **prompt-injection** and other logic-level abuses; other items in the same news roundup (e.g., telecom “Salt Typhoon” oversight) were unrelated to OpenClaw’s vulnerabilities.
1 months ago