🐯虎嗅•Stalecollected in 10m
OpenClaw Faces Security Backlash
#ai-agents#risk-mitigationopenclawopenclawkarpathyclaude
💡OpenClaw's 300k stars mask real security flaws—learn victim stories & fixes
⚡ 30-Second TL;DR
What Changed
OpenClaw gained 300k GitHub stars since January, praised by Karpathy as most practical agent.
Why It Matters
Rising security incidents could hinder OpenClaw's adoption among enterprises and sensitive users, prompting bans and uninstalls. However, with proper safeguards, its automation potential remains high for developers.
What To Do Next
Audit your OpenClaw instance for ClawHub plugins and enable containerized minimal permissions before production use.
Who should care:Developers & AI Engineers
Key Points
- •OpenClaw gained 300k GitHub stars since January, praised by Karpathy as most practical agent.
- •Risks include prompt injection, misoperations, plugin poisoning, and security vulnerabilities.
- •Incidents: users lost data/emails or sent unintended 600 RMB red packets via remote takeover.
- •Chinese authorities warn party/gov't users; firms ban it on company devices.
- •Safety tips: deploy latest version, use containers/VMs, audit skills from ClawHub.
🧠 Deep Insight
Background and context from public sources — not the original article. 10 sources cited.
🔑 Enhanced Key Takeaways
- •CVE-2026-25253, rated CVSS 8.8, enables one-click remote code execution through WebSocket origin validation bypass—an attacker can steal authentication tokens by luring users to visit a malicious webpage, granting full administrative control without prior access[1][2][3].
- •Over 17,500 internet-exposed OpenClaw instances were identified vulnerable to credential theft via the unauthenticated /api/export-auth endpoint, affecting stored API tokens for Claude, OpenAI, Google AI, and other services[1].
- •The ClawHub skill marketplace has been heavily compromised with 341+ malicious skills delivering AMOS malware, reverse shell backdoors, and credential theft targeting exchange API keys, wallet private keys, SSH credentials, and browser passwords[7][8].
- •OpenClaw ships with authentication disabled by default and stores all credentials in plaintext configuration files, making newly deployed instances immediately accessible from the internet and targets for infostealer malware including RedLine, Lumma, and Vidar[2].
- •Multiple high-severity command injection vulnerabilities (CVE-2026-25593, CVE-2026-24763, CVE-2026-25157) allow unauthenticated local clients to exploit the Gateway WebSocket API to inject malicious cliPath values and execute arbitrary commands with gateway user privileges[4].
🛠️ Technical Deep Dive
C V E-2026-25253_ Attack_ Chain
- •Attacker creates a webpage containing malicious JavaScript[2]
- •User visits the malicious page while OpenClaw gateway is running locally[3]
- •JavaScript silently opens a WebSocket connection to the local OpenClaw gateway (localhost:8080 or similar)[6]
- •WebSocket origin header validation is missing, so the connection is accepted[8]
- •Authentication token is extracted from the gateway and sent to attacker[1][3]
- •Attacker uses token to gain operator-level access to the Gateway API[3]
- •Attacker can modify configuration, read files, disable user confirmation prompts, and execute arbitrary commands[6]
C V E-2026-25593_ Exploitation
- •Unauthenticated attacker establishes WebSocket connection to Gateway API[4]
- •Attacker sends config.apply request with malicious cliPath value[4]
- •OpenClaw stores configuration without validation[4]
- •During command discovery, unsanitized cliPath is passed to shell execution context[4]
- •Injected commands execute with gateway user privileges[4]
- •Affected versions: prior to 2026.1.20[4]
Credential_ Storage_ Architecture
- •API keys and OAuth tokens stored in plaintext configuration files[2]
- •Includes credentials for LLM providers, messaging platforms, and connected services[3]
- •File paths targeted by infostealer malware: RedLine, Lumma, Vidar, and AMOS[2][8]
- •Prompt injection can trick agent into exfiltrating credentials via hidden instructions in processed content[3]
Claw Hub_ Marketplace_ Compromise
- •341 malicious skills identified out of audited set[7][8]
- •335 skills delivered AMOS malware via fake prerequisites[8]
- •All malicious AMOS skills shared single C2 IP: 91.92.242.30[8]
- •6 skills contained reverse shell backdoors hidden in functional code[8]
- •Target data: exchange API keys, wallet private keys, SSH credentials, browser passwords, ~/.clawdbot/.env[8]
🔮 Future ImplicationsAI analysis grounded in cited sources
OpenClaw will likely face regulatory restrictions in government and enterprise sectors due to the combination of default-insecure configuration and demonstrated real-world exploitation.
Chinese authorities have already warned party/government users, and multiple firms have banned it on company devices; the 17,500+ exposed instances and active marketplace malware campaigns create liability concerns.
Plaintext credential storage will become a critical compliance liability as security frameworks tighten around AI agent deployment.
The documented targeting of OpenClaw config files by mainstream infostealer malware (RedLine, Lumma, Vidar) demonstrates that the architecture violates basic secrets management standards.
Architectural vulnerabilities like prompt injection cannot be fully patched, limiting OpenClaw's viability for production use cases handling sensitive data.
The project's own documentation states 'there is no perfectly secure setup,' and prompt injection is acknowledged as an unsolvable architectural flaw affecting any content the agent processes.
⏳ Timeline
2026-01
OpenClaw gains 300k GitHub stars; Andrej Karpathy praises it as most practical AI agent
2026-01
CVE-2026-25253 (CVSS 8.8) disclosed by Mav Levin at DepthFirst; WebSocket origin validation bypass enables one-click RCE
2026-01
Security patch released in version 2026.1.29 for CVE-2026-25253
2026-02
341+ malicious ClawHub skills discovered; AMOS malware campaign targeting credentials identified with shared C2 infrastructure
2026-02
Hunt.io research identifies 17,500+ internet-exposed OpenClaw instances vulnerable to credential theft via /api/export-auth endpoint
2026-02
OpenClaw 2026.2.23 released with security hardening including optional HSTS headers and new provider support
📎 Sources (10)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
- hunt.io — Cve 2026 25253 Openclaw AI Agent Exposure
- pacgenesis.com — Openclaw Security Risks What Security Teams Need to Know About AI Agents Like Openclaw in 2026
- digitalocean.com — Openclaw Security Challenges
- sentinelone.com — Cve 2026 25593
- runzero.com — Openclaw
- adminbyrequest.com — Openclaw Went From Viral AI Agent to Security Crisis in Just Three Weeks
- penligent.ai — Openclaw 2026 2 23 Brings Security Hardening and New AI Features but the Real Story Is the Security Boundary
- adversa.ai — Openclaw Security 101 Vulnerabilities Hardening 2026
- fortune.com — Openclaw AI Agents Security Risks Beware
- securityboulevard.com — Openclaw Security Issues Add a Security Guardrail to Your AI Application
📰
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: 虎嗅 ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
Weekly AI briefing
One email a week. Unsubscribe anytime.