270K OpenClaw 'Lobsters' Running Exposed

🔑 Enhanced Key Takeaways

• •OpenClaw, previously known as Clawdbot and Moltbot, is an open-source AI agent framework for local autonomous assistants connecting LLMs to tools, browsers, and system resources.[1][2][4]
• •Multiple high-severity vulnerabilities identified, including ClawJacked (CVE-2026-25253) enabling RCE and data theft via brute-force on localhost, patched in version 2026.2.26 on February 26.[3][4][6]
• •Attackers exploited exposures through GitHub fake installers delivering Vidar/Atomic Stealer malware and poisoned marketplace skills, leading to crypto wallet and credential theft.[3]
• •Exposed instances correlated with breach activity (549 cases) and vulnerabilities (1493 cases); 63% vulnerable, with concentrations in China, US, Singapore, and industries like information services.[1][2][5]

🛠️ Technical Deep Dive

• •OpenClaw runs locally on TCP port 18789 with web browser interface; documentation recommends SSH tunnels, but default lacks authentication, WebSocket origin checks, and login rate limiting.[2][6]
• •ClawJacked flaw (CVE-2026-25253, CVSS 8.8) allowed malicious sites to brute-force passwords at hundreds/second due to no localhost rate limiting, auto-register as trusted device, granting admin control.[4][6]
• •Additional CVEs include CVE-2026-26319, CVE-2026-26322, CVE-2026-26329; total audit found 512 vulnerabilities, 8 critical, plus risks like indirect prompt injection and leaked API keys.[1][5][6]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline