OpenClaw 0-Click Flaw Lets Malicious Websites Hijack Developer AI Agents

OpenClaw, a widely used open-source AI personal assistant, recently encountered a significant security vulnerability affecting its user base.

This AI tool, which automates developer workflows through various platforms, was susceptible to a zero-click exploit.

This vulnerability allowed any website visited by a developer to potentially compromise their OpenClaw agent without the need for additional software or user interaction.

The OpenClaw development team addressed the issue, classifying it as high severity and releasing a patch within 24 hours.

OpenClaw, previously known as Clawdbot and MoltBot, has experienced rapid growth, drawing interest from industry stakeholders.

Despite its popularity, the platform has faced security issues.

Earlier this year, researchers identified over 1,000 malicious components within OpenClaw’s community marketplace, ClawHub, which included info-stealers and backdoors.

The new vulnerability is distinct, residing in the core gateway system rather than community-developed plugins.

Oasis Security researchers noted this issue underscores the increasing concern of shadow AI, where developer-adopted tools operate beyond IT oversight, often with significant access to local systems and credentials.

Malicious Websites Exploit AI Security Flaw

The core of OpenClaw is its gateway, a local WebSocket server responsible for authentication, session management, and AI orchestration.

Various devices, including macOS companion apps and iOS devices, connect to this gateway to execute commands and access resources.

The vulnerability arises from the gateway’s assumption of trust in localhost connections.

By default, the gateway binds to localhost and uses a token or password for authentication.

However, cross-origin policies do not prevent WebSocket connections to localhost, allowing malicious scripts from visited websites to connect to the local OpenClaw gateway.

The attack sequence begins when a developer visits a compromised website.

The malicious script establishes a WebSocket connection and initiates a brute-force attack on the gateway password.

Due to the absence of rate limiting for localhost connections, attackers can perform numerous password attempts per second, swiftly bypassing human-created passwords.

Once authenticated, the script registers as a trusted device without user confirmation.

The attacker gains full control over the AI agent, enabling actions such as:

Communicating with the AI agent and receiving responses. Accessing gateway configuration, including AI providers and messaging channels. Listing all connected nodes and their IP addresses. Reading application logs for operational intelligence.

This level of access allows attackers to search Slack history for API keys, read private messages, exfiltrate files, or execute shell commands on any connected device, leading to a complete system compromise.

Users and organizations utilizing OpenClaw should upgrade to version 2026.2.25 or later to safeguard against this critical vulnerability.

Maintaining oversight and control over developer-adopted AI tools is essential for mitigating risks associated with shadow AI.

Based on reporting by GBHackers.