OpenClaw security vulnerability lets malicious websites hijack AI agents in 'ClawJacked' attack

OpenClaw Hit by High-Severity Flaw Enabling Remote Takeover

A critical security vulnerability in OpenClaw, one of the most popular open-source AI agent platforms, allowed malicious websites to hijack AI agents and steal sensitive data from users' computers. Security researchers at Oasis discovered the flaw, dubbed "ClawJacked," which exploited a weakness in the platform's core system rather than any third-party plugins or extensions1

1

. The vulnerability affected OpenClaw installations running as documented, making it particularly dangerous for the platform's extensive user base—OpenClaw currently holds more than 100,000 stars on GitHub1

1

.

The attack vector was alarmingly simple. Users only needed to visit a malicious website for threat actors to gain full control of their AI agents. Once a victim landed on a compromised page, JavaScript code could open a WebSocket connection to localhost and brute-force the gateway authentication with ease1

1

. According to Oasis, attacks were enabled by developers simply browsing the web and accidentally landing on a malicious website2

2

.

How the Gateway Authentication Exploit Works

The high-severity flaw resided in OpenClaw's fundamental architecture. The platform runs a local WebSocket server that handles authentication and coordinates communication between the gateway and connected nodes such as companion apps and other machines1

1

. These nodes expose capabilities, run system commands, and access hardware like cameras. Authentication is managed through either a token or a password, with the gateway binding to localhost by default.

"What we found is different. Our vulnerability lives in the core system itself—no plugins, no marketplace, no user-installed extensions—just the bare OpenClaw gateway, running exactly as documented," Oasis researchers explained1

1

. Once attackers successfully brute-force the password and authenticate as a trusted device, they gain full control over the system. They can interact with the AI agent, dump configuration data, enumerate connected devices, and read logs1

1

.

Rapid Response: Patched Within 24 Hours

Following responsible disclosure by Oasis, the OpenClaw security team classified the vulnerability as high severity and deployed a fix within 24 hours1

1

2

2

. Users are strongly urged to upgrade their instances to version 2026.2.25 or later to protect against potential exploitation1

1

. The swift response demonstrates the importance of coordinated vulnerability disclosure, though questions remain about how many users may have been exposed before the patch.

Shadow AI and the Governance Challenge

This incident underscores a broader challenge facing organizations: the rise of shadow AI. "For many organizations, OpenClaw installations represent a growing category of shadow AI: developer-adopted tools that operate outside IT's visibility, often with broad access to local systems and credentials, and no centralized governance," Oasis noted2

2

. While there are over 1,000 fake plugins on OpenClaw's community marketplace, ClawHub, that are actually malicious, this particular vulnerability affected the platform's core architecture rather than third-party extensions2

2

.

To mitigate risks from similar attacks, Oasis recommended that organizations inventory the AI agents and assistants being used by their developers, immediately update OpenClaw installations, audit the credentials and capabilities granted to AI agents and revoke those not actively needed, and establish governance for non-human identities2

2

. "As AI agents become standard tools in every developer's workflow, the question isn't whether to adopt them, it's whether you can govern them," Oasis stated2

2

.

The ClawJacked vulnerability serves as a warning about the security implications of developer-adopted AI tools that integrate deeply with local systems. As AI agents gain access to calendars, messaging apps, emails, and system commands, the potential damage from compromised authentication grows exponentially. Organizations must balance the productivity benefits of these tools against the need for robust security controls and visibility into how AI agents access and handle sensitive data.