Safety researchers have disclosed a high-severity vulnerability dubbed “ClawJacked” within the widespread AI agent OpenClaw that allowed a malicious web site to silently bruteforce entry to a domestically operating occasion and take management over it.
Oasis Safety found the difficulty and reported it to OpenClaw, with a repair being launched in model 2026.2.26 on February 26.
OpenClaw is a self-hosted AI platform that has not too long ago surged in recognition for enabling AI brokers to autonomously ship messages, execute instructions, and handle duties throughout a number of platforms.
In accordance with Oasis Safety, the vulnerability is brought on by the OpenClaw gateway service binding to localhost by default and exposing a WebSocket interface.
As a result of browser cross-origin insurance policies don’t block WebSocket connections to localhost, a malicious web site visited by an OpenClaw consumer can use JavaScript to silently open a connection to the native gateway and try authentication with out triggering any warnings.
Whereas OpenClaw consists of price limiting to forestall brute-force assaults, the loopback deal with (127.0.0.1) is exempt by default, so native CLI periods should not mistakenly locked out.
The researchers discovered that they may brute-force the OpenClaw administration password at a whole lot of makes an attempt per second with out failed makes an attempt being throttled or logged. As soon as the proper password is guessed, the attacker can silently register as a trusted machine, because the gateway robotically approves machine pairings from localhost with out requiring consumer affirmation.
“In our lab testing, we achieved a sustained price of a whole lot of password guesses per second from browser JavaScript alone,” explains Oasis.
“At that velocity, an inventory of frequent passwords is exhausted in beneath a second, and a big dictionary would take solely minutes. A human-chosen password would not stand an opportunity.”
With an authenticated session and admin permissions, the attacker can now work together straight with the AI platform, dumping credentials, itemizing related nodes, stealing credentials, and studying software logs.
Oasis says this might permit an attacker to instruct the agent to go looking messaging histories for delicate data, exfiltrate information from related units, or execute arbitrary shell instructions on paired nodes, successfully leading to full workstation compromise triggered from a browser tab.
Oasis shared an illustration of this assault, exhibiting the way it could possibly be used to steal delicate knowledge by the OpenClaw vulnerability.
Oasis reported the difficulty to OpenClaw, together with technical particulars and proof-of-concept code, and it was mounted inside 24 hours of disclosure.
The repair tightens WebSocket safety checks and provides extra protections to forestall attackers from abusing localhost loopback connections to brute-force logins or hijack periods, even when these connections are configured to be exempt from price limiting.
Organizations and builders operating OpenClaw ought to replace to model 2026.2.26 or later instantly to forestall their installations from being hijacked.
With OpenClaw’s huge recognition, safety researchers have been specializing in figuring out vulnerabilities and assaults concentrating on the platform.
Menace actors have been seen abusing the “ClawHub” OpenClaw abilities repository to advertise malicious abilities that deploy infostealing malware or trick customers into operating malicious instructions on their units.
Malware is getting smarter. The Pink Report 2026 reveals how new threats use math to detect sandboxes and conceal in plain sight.
Obtain our evaluation of 1.1 million malicious samples to uncover the highest 10 methods and see in case your safety stack is blinded.
