Skip to main content

Known Vulnerabilities

A comprehensive record of OpenClaw security incidents and vulnerabilities. OpenClaw's explosive adoption massively outpaced its security maturity, resulting in an unprecedented cascade of security events in January-February 2026.

danger

Gartner has recommended enterprises "block OpenClaw downloads and traffic immediately." JFrog found 93.4% of publicly reachable instances had critical authentication bypasses. Noma Security reported 53% of enterprise customers gave OpenClaw privileged access over a single weekend. Take security seriously.

CVE-2026-25253: One-Click Remote Code Execution​

FieldValue
CVECVE-2026-25253
CVSS8.8 (Critical)
CWECWE-669: Incorrect Resource Transfer Between Spheres
Affected VersionsAll versions before v2026.1.29
Fixed Inv2026.1.29 (January 30, 2026)
DiscovererMav Levin (depthfirst.com)

Description​

The OpenClaw Gateway Control UI accepted a gatewayUrl parameter from query strings without validation. The UI automatically established a WebSocket connection without user confirmation, transmitting authentication credentials. The server also failed to validate WebSocket origin headers, enabling cross-site WebSocket hijacking.

Attack Flow​

Even localhost-only instances were vulnerable — the exploit used the victim's browser as a pivot into the local network.

Additional CVE: CVE-2026-25157​

A high-severity OS command injection vulnerability in the OpenClaw/Clawdbot macOS application's SSH handling, where improperly escaped inputs could allow attackers to execute arbitrary commands on the local or remote host.

Advisories Issued By​

Mitigation​

# Update immediately
npm update -g openclaw

# Verify you're on v2026.1.29 or later
openclaw --version

Gateway Authentication Bypass (JFrog)​

JFrog published "Giving OpenClaw the Keys to Your Kingdom" revealing that 93.4% of publicly reachable OpenClaw instances had critical authentication bypass vulnerabilities.

The Bypass Mechanism​

OpenClaw's gateway auto-approves connections from 127.0.0.1. When deployed behind a reverse proxy (Nginx, Caddy, Traefik), all external requests are forwarded to localhost. The gateway sees every connection as local and bypasses authentication entirely.

Impact​

An attacker who reaches an exposed instance can:

  • Read files from the filesystem
  • Access emails and WhatsApp conversations
  • Extract API keys
  • Read Slack threads
  • Trigger additional agent actions
  • Execute arbitrary commands

Fix​

The fix was implemented in PR #1795. Configure trustedProxies when behind a reverse proxy:

~/.openclaw/openclaw.json
{
  "gateway": {
    "bind": "loopback",
    "trustedProxies": ["127.0.0.1"]
  }
}

See Security Hardening: trustedProxies for full details.

Exposed Instances (January-February 2026)​

Multiple security firms independently discovered a staggering number of exposed OpenClaw instances:

FirmDateCountMethod
CensysJan 3121,639Internet-wide scanning
SecurityScorecard STRIKEFeb 240,214Favicon fingerprinting
ShodanFeb 942,665Service fingerprinting
Follow-up scansFeb 9135,000+Expanded detection

Geographic Distribution​

RegionPercentageNotes
ChinaLargest concentration30%+ on Alibaba Cloud
United StatesSecondMajor cloud providers
SingaporeThirdAWS/GCP Asia
82 countries total42,900 unique IPsGlobal exposure

Key Finding​

Of the 42,665 instances found on Shodan:

  • 23,505 showed active control panel interfaces
  • 15,200 were vulnerable to remote code execution
  • Three CVEs had public exploit code

Detection Method​

SecurityScorecard used favicon fingerprinting of exposed gateway web UIs. Censys tracked rapid growth from ~1,000 to 21,000+ instances in under a week.

Active Exploitation​

Terrace Networks reported that the window between tool announcement and active exploitation was measured in hours, not weeks. Exploitation scanning ramped up globally in lockstep with public announcements.

Root Cause​

The default configuration bound the gateway to 0.0.0.0 (all interfaces) rather than 127.0.0.1:

# DANGEROUS — the old default
gateway:
  host: "0.0.0.0"  # Exposes to the entire internet

# CORRECT — current recommended default
gateway:
  host: "127.0.0.1"  # Localhost only

Check If You're Exposed​

# From another machine on your network
curl http://YOUR_IP:18789

# If you get a response, you're exposed. Fix immediately:
openclaw config set gateway.host "127.0.0.1"
openclaw gateway restart

External check: Have I Been Clawned? provides a free external security audit.

Malicious ClawHub Skills (February 2026)​

The ClawHavoc Campaign​

Koi Security researcher Oren Yomtov (assisted by "Alex," an OpenClaw bot configured for threat analysis) audited all 2,857 skills on ClawHub and found 341 malicious skills across multiple coordinated campaigns:

  • 335 skills installed Atomic Stealer (AMOS) macOS malware via fake pre_install hooks
  • All masqueraded as cryptocurrency trading automation, YouTube utilities, or auto-updaters
  • Campaign window: January 27-29, 2026 (72 hours)
  • Stolen data: crypto exchange API keys, wallet private keys, SSH credentials, browser passwords

AMOS capabilities: Exfiltrates Keychain passwords, system information, desktop/documents files, macOS user passwords, browser cookies/credentials, and cryptocurrency wallets (Electrum, Binance, Exodus, Atomic, Coinomi).

Defense: Clawdex provides pre-installation scanning against Koi's malicious skills database.

The "What Would Elon Do?" Skill​

Cisco's AI Defense team found that OpenClaw's most popular community skill (gamed to #1 ranking) contained 9 security vulnerabilities, 2 critical:

  • Silently exfiltrated data to attacker-controlled servers
  • Used direct prompt injection to bypass the agent's safety guidelines
  • Confirmed data exfiltration and prompt injection without user awareness

Cisco released an open-source Skill Scanner combining static analysis, behavioral dataflow, LLM semantic analysis, and VirusTotal scanning.

Snyk ToxicSkills Study (February 5)​

Snyk performed a broader audit of 3,984 skills from ClawHub and skills.sh:

FindingCountPercentage
Skills with security flaws1,46736%
Critical severity53413.4%
Confirmed malicious payloads76—
Used hybrid attack (prompt injection + malware)91% of malicious—

Snyk called it "the first documented supply-chain attack specifically targeting AI agent skills."

Key insight from Snyk's "SKILL.md to Shell Access in Three Lines of Markdown": The distinction between "documentation" and "executable instruction" doesn't exist for AI agents. Everything in a skill's Markdown is a potential command.

Snyk Credential Leaks Study​

A separate audit found 283 skills (7.1%) that leak credentials:

  • Functional skills (like moltyverse-email, youtube-data) instruct agents to pass API keys through the LLM context window
  • Keys appear in plaintext in output logs and Markdown artifacts
  • If an agent has previously handled an API key, a prompt-log skill can re-expose it

Snyk provides mcp-scan, a free tool to scan skills for security issues.

Bitdefender Findings​

Bitdefender's analysis found that nearly 900 skills (~20% of all packages) contained malicious content — the highest estimate from any research firm.

Root Cause​

ClawHub was open by default — the only requirement to publish was a GitHub account at least one week old. No security review, no code scanning, no verification.

Current Mitigations​

  1. VirusTotal integration (v2026.2.6+) — SHA-256 hashing checked on upload, Code Insight (Gemini-powered) analyzes full packages
  2. Daily re-scanning — Active skills re-scanned to detect skills that become malicious after initial upload
  3. Community reporting — Skills with 3+ unique reports are auto-hidden
  4. Built-in code safety scanner — Static analysis for suspicious patterns
  5. Verdicts system — Benign (auto-approved), Suspicious (warning shown), Malicious (immediately blocked)

Prompt Injection Backdoor (Zenity Labs)​

Zenity Labs published "OpenClaw or OpenDoor?" demonstrating how indirect prompt injection turns OpenClaw into a persistent AI backdoor — no software vulnerability required.

The Complete Attack Chain​

PhaseActionPersistence
1. Initial accessIndirect prompt injection via Google Document — zero-clickNone
2. Telegram backdoorAgent creates integration with attacker-controlled Telegram botSession-level
3. SOUL.md modificationAttacker-controlled instructions injected into agent identity fileSurvives restarts
4. Scheduled taskWindows scheduled task re-injects instructions every 2 minutesSurvives SOUL.md cleanup
5. C2 implantTraditional command-and-control deployed on hostFull system compromise

Key Finding​

All attacks abuse intended capabilities. OpenClaw processes untrusted content from chats, skills, and external sources in the same reasoning context as user instructions, with no hard isolation boundaries.

Penligent described it as "The Security Boundary That Doesn't Exist."

Moltbook Database Breach (January 31, 2026)​

404 Media reported a critical vulnerability in Moltbook (the AI agent social network), discovered by security researcher Jameson O'Reilly:

DetailFinding
VulnerabilitySupabase API key exposed in client-side JavaScript
Access grantedFull read and write access to all platform data
API tokens exposed1.5 million
Email addresses exposed35,000
Private messagesVisible between agents
Agent-to-human ratio88:1 (1.5M agents, 17K human owners)
Root causeNo Row Level Security policies configured
Time to fixHours (with Wiz researchers' assistance)

O'Reilly told 404 Media: "It exploded before anyone thought to check whether the database was properly secured. This is the pattern I keep seeing: ship fast, capture attention, figure out security later."

The "Vibe Coding" Cautionary Tale​

Moltbook founder Matt Schlicht posted on X that he "didn't write one line of code" — the platform was entirely built by an AI assistant. MIT Technology Review published "Moltbook Was Peak AI Theater." This is now cited as a cautionary tale about AI-generated code in production without human security review.

Financial Impact​

Exposed API keys meant attackers could run up massive bills on the original owners' pay-as-you-go accounts. All agent API keys were force-reset after discovery.

While Moltbook is a separate project from OpenClaw, the breach exposed OpenClaw API keys and credentials that users had connected to their agents.

$16M Crypto Scam (January 27, 2026)​

The Rebrand Window Attack​

On January 27, 2026, Anthropic sent Steinberger a trademark notice: "Clawdbot" was too similar to "Claude." Steinberger announced the rebrand to "Moltbot."

The 10-second window: To claim a new X handle, you must first release the old one. In the gap between releasing "clawdbot" and claiming "moltbot" — approximately 10 seconds — crypto scammers snatched both accounts.

The Scam​

  • Hijacked accounts immediately pumped a fake $CLAWD token on Solana via pump.fun
  • Market cap hit $16 million before Steinberger publicly denied involvement
  • Token crashed to under $800K after denial
  • Rekt News covered the incident as "Frankenclaw"

Ongoing Harassment​

Array VC's Shruti Gandhi reported 7,922 attacks over one weekend. Steinberger described his online life as "a living hell" — nonstop pings, Discord invasions, Telegram spam, and account squatters.

Credential Storage (OX Security)​

OX Security discovered:

  • OpenClaw stores credentials, API keys, and environment variables in cleartext under ~/.openclaw/
  • A single compromised machine exposes all connected accounts
  • Credentials are backed up when removed — removing them from the UI does not delete them from the filesystem

When these findings were reported to creator Peter Steinberger, his response was: "This is a tech preview. A hobby. If you wanna help, send a PR."

Government & Corporate Responses​

EntityAction
Gartner"Unacceptable cybersecurity risk" — recommended blocking downloads and traffic immediately
CrowdStrikeSecurity briefing + Falcon "Search & Removal Content Pack" for enterprise environments
BitdefenderTechnical advisory on OpenClaw exploitation in enterprise networks
Kaspersky"OpenClaw found unsafe for use"
Trend MicroRisk analysis of agentic assistants using OpenClaw as case study
Naver, Kakao, Karrot (South Korea)Banned employees from using OpenClaw on company networks
China NVDBWarned about improperly configured deployments
Belgian CCB (Safeonweb)Published advisory urging immediate patching
Token SecurityFound 22% of enterprise customers had unauthorized OpenClaw deployments
Noma Security53% of enterprise customers gave OpenClaw privileged access over a single weekend
University of TorontoPublished vulnerability notification for community

OpenClaw's Security Response​

DateAction
Jan 30CVE-2026-25253 patched in v2026.1.29
Feb 5VirusTotal partnership announced for ClawHub skill scanning
Feb 7v2026.2.6: Built-in code safety scanner, daily re-scanning of active skills
Feb 7Community reporting system — 3+ reports auto-hide skills
OngoingCommitted to publishing full threat model, security roadmap, and formal vulnerability reporting process
OngoingGitHub Issue #7916: Encrypted API keys / secrets management
OngoingGitHub Issue #8081: Multi-user permission management (RBAC)

Full Security Timeline​

DateEventSeverity
Jan 27Anthropic trademark notice; rebrand begins—
Jan 27X accounts hijacked; $CLAWD scam token launched, hits $16M$16M stolen
Jan 27-29ClawHavoc campaign — 335 malicious skills uploaded in 72 hoursHigh
Jan 30CVE-2026-25253 disclosed and patched (v2026.1.29)Critical (8.8)
Jan 31Censys: 21,639 exposed instances foundCritical
Jan 31Moltbook database breach — 1.5M tokens, 35K emailsCritical
Feb 2SecurityScorecard STRIKE: 40,214 exposed instancesCritical
Feb 2The Register: "security dumpster fire"—
Feb 4Koi Security: 341 malicious ClawHub skills publishedHigh
Feb 5Snyk ToxicSkills: 36% of all skills contain security flawsHigh
Feb 5Cisco: 9 vulnerabilities in top community skillHigh
Feb 5Zenity Labs: Prompt injection backdoor researchHigh
Feb 5Snyk: 283 skills (7.1%) leak credentialsHigh
Feb 5OX Security: Plaintext credential storage disclosedMedium
Feb 7VirusTotal partnership and code safety scanner (v2026.2.6)Mitigation
Feb 8Korean tech firms (Kakao, Naver, Karrot) ban OpenClaw—
Feb 9Follow-up: 135,000+ exposed instances, 42,665 on ShodanCritical
Feb 9JFrog: 93.4% of exposed instances have auth bypassCritical
Feb 9Gartner: "Unacceptable cybersecurity risk" published—

Reporting Vulnerabilities​

Report security issues responsibly:

See Also​