Full Breakdown
ClawJacked Vulnerability Exposes OpenClaw AI Agents to Hijacking
3/3/2026, 1:46:09 AM
Overview of the ClawJacked Vulnerability
The ClawJacked vulnerability is a critical security flaw discovered in the OpenClaw AI agent platform, which allows malicious websites to hijack locally running instances of OpenClaw. This vulnerability stems from a localhost authentication bypass, enabling unauthorized access and data exfiltration. The flaw was identified by Oasis Security and has been patched in OpenClaw version 2026.2.26, released on February 26, 2026. Users are strongly urged to update their systems immediately to mitigate risks.
How the Attack Works
The vulnerability exploits the OpenClaw gateway, which binds to localhost and exposes a WebSocket management interface. Modern browser cross-origin policies do not prevent JavaScript from establishing WebSocket connections to localhost, allowing attackers to initiate a connection silently when a user visits a malicious website. The OpenClaw gateway's rate-limiting mechanism, designed to prevent brute-force attacks, inadvertently exempts localhost connections, enabling attackers to attempt unlimited password guesses. Once authenticated, attackers can register as trusted devices without user confirmation, gaining full administrative access to the AI agent.
Potential Impact of the Vulnerability
Once attackers gain access, they can exfiltrate sensitive data, execute arbitrary commands, and upload malicious "skills" to the ClawHub repository. These skills can include infostealers and crypto-miners, posing significant risks to organizations using OpenClaw. The attack is opportunistic and global, affecting any user running a vulnerable version of OpenClaw, regardless of sector or geography. The presence of malicious skills in the ClawHub repository further amplifies the risk, as compromised agents can propagate attacks within organizational networks.
Official Responses and Recommendations
The OpenClaw security team acted swiftly, addressing the vulnerability within 24 hours of its disclosure. They classified the issue as high severity and recommended that users upgrade to version 2026.2.26 or later. Organizations are advised to review trusted device registrations for anomalies, audit installed ClawHub skills for unauthorized uploads, and monitor for unusual WebSocket activity from browsers to localhost. Additionally, best practices include deploying OpenClaw in isolated environments, using non-privileged credentials, and avoiding the provision of sensitive data to skills unless necessary.
Criticism and Concerns
Despite the rapid response from OpenClaw developers, security experts have raised concerns about the platform's design, which prioritizes capability over security. Analysts from Cisco and Gartner have described OpenClaw as groundbreaking yet a significant risk, highlighting that its design is "insecure by default." The inherent trust placed in localhost connections has been criticized as a fundamental flaw that could lead to widespread exploitation.
Conflicting Reports and Gaps
While the ClawJacked vulnerability has been confirmed and patched, there are ongoing concerns regarding the broader security landscape surrounding OpenClaw. Reports indicate that numerous vulnerabilities and malicious skills have been discovered within the OpenClaw ecosystem, suggesting that the platform may face additional scrutiny and potential threats in the future.
Verbatim Quotes
- “The gateway binds to localhost by default, based on the assumption that local access is inherently trusted. That assumption is where things break down,” — Oasis Security
- “A developer has OpenClaw running on their laptop, with the gateway bound to localhost, protected by a password.” — Oasis Security
- “for many organizations, OpenClaw installations represent a growing category of shadow AI: developer-adopted tools that operate outside IT’s visibility, often with broad access to local systems and credentials, and no centralized governance.” — Oasis Security
- “The design focused on making the developer experience as smooth as possible by using local binding, automatic device pairing, and less friction for connectivity.” — Randolph Barr, Cequence Security CISO
The ClawJacked vulnerability serves as a stark reminder of the security challenges posed by rapidly evolving AI technologies and the importance of robust security measures in their deployment.
