🐯虎嗅•Mar 18, 2026Stalecollected in 6m

OpenClaw Faces Critical Security Vulnerabilities

Post LinkedIn

🐯Read original on 虎嗅

#ai-agent #cloud-deploymentopenclawopenclaw tencent 360 alibaba

💡Popular open-source AI agent vuln risks data breaches—secure deployments now

⚡ 30-Second TL;DR

What Changed

CNCERT warns of data leaks and infrastructure risks from OpenClaw defaults

Why It Matters

Highlights urgent security needs for open-source AI agents, spurring vendor tools but potentially slowing rapid adoption amid regulatory scrutiny.

What To Do Next

Deploy OpenClaw via Tencent Cloud with their security toolbox for sandbox isolation.

Who should care:Enterprise & Security Teams

Key Points

•CNCERT warns of data leaks and infrastructure risks from OpenClaw defaults
•Tencent releases 'OpenClaw Security Toolbox' with sandbox isolation
•360 publishes deployment guide; browser offers one-click install
•Cloud deployment isolates agent from local sensitive data

🧠 Deep Insight

Background and context from public sources — not the original article. 8 sources cited.

🔑 Enhanced Key Takeaways

•Security researchers identified over 17,500 internet-exposed instances of OpenClaw, Clawdbot, and Moltbot vulnerable to CVE-2026-25253, allowing unauthenticated extraction of API tokens for services like Claude, OpenAI, and Google AI via the /api/export-auth endpoint.[1]
•Attackers distributed 341 malicious skills (12% of ClawHub marketplace) disguised as legitimate tools, deploying keyloggers on Windows and Atomic Stealer on macOS during the January 2026 ClawHavoc campaign.[5]
•Censys detected 21,639 publicly accessible OpenClaw instances by January 31, 2026, with the US hosting the most and China (30% on Alibaba Cloud) second, many leaking plaintext credentials.[5]

🛠️ Technical Deep Dive

•CVE-2026-25253 (CVSS 8.8) enables one-click RCE via WebSocket hijacking: malicious JavaScript on a webpage opens a local WebSocket connection, exfiltrates the gateway auth token, and grants full admin control, exploitable even on localhost-bound instances due to lack of origin validation.[1][2][3][4]
•The /api/export-auth endpoint lacks authentication, exposing stored API keys in plaintext config files; infostealers like RedLine target these paths alongside browser creds.[1][2]
•Additional flaws include CVE-2026-24763 and CVE-2026-25157 (command injection), no rate limiting on auth attempts, and ClawHub skills passing secrets through LLM context windows.[3][5]

🔮 Future ImplicationsAI analysis grounded in cited sources

AI agent marketplaces like ClawHub will implement mandatory skill vetting by Q2 2026

The compromise of 12% of skills in ClawHavoc demonstrates urgent need for automated scanning, as evidenced by Snyk's detection of 283 flawed skills exposing credentials.[2][5]

Default authentication will become mandatory in all OpenClaw versions post-2026.1.29

Patches addressed disabled-by-default auth and plaintext storage after mass exposures, with maintainers warning of dangers for non-expert users.[2][3]