Critical RCE Vulnerability in OpenClaw AI Assistant (CVE-2026-25253) Allows Data and Key Theft
By
arwt
Hot, fresh, and worth queueing round the block for.
Summary
A technical security analysis reveals a critical remote code execution (RCE) vulnerability (CVE-2026-25253) in OpenClaw, a popular open-source AI personal assistant trusted by over 100,000 developers. The vulnerability allows attackers to steal sensitive data and keys through a 1-click exploit that combines a settings logic flaw with WebSocket pivoting, enabling token exfiltration, safety-control bypass, and arbitrary command execution on systems where OpenClaw has high-privilege access.
Key quotes
· 5 pulledOpenClaw (formerly Moltbot and ClawdBot), the open-source AI personal assistant that can take actions on your behalf, is the most popular topic on X right now.
It is already trusted by over 100,000 developers to hold the keys to their digital life, from iMessage/WhatsApp/Slack access to unrestricted local computer control.
While the community celebrated its capabilities, depthfirst General Security Intelligence silently audited its code and found a critical vulnerability.
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access.
See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary command execution.
You might also wanna read
Hacker Exploits AI Coding Agent Vulnerability to Install OpenClaw Malware
A hacker exploited a vulnerability in Cline, an open-source AI coding agent, to trick it into installing OpenClaw (a viral AI agent) on comp
The Verge·3mo ago
OpenClaw: Open-Source AI Agent Raises Security Concerns While Automating Tasks
OpenClaw is an open-source AI agent that runs locally on users' computers and performs practical tasks like managing reminders, writing emai
The Verge·3mo ago
Security Researchers Find Malware in Hundreds of OpenClaw AI Agent Skill Extensions
Security researchers have discovered hundreds of malicious add-ons in OpenClaw's marketplace, with the most-downloaded skill serving as a ma
The Verge·3mo ago
ClawSecure: Security Platform for OpenClaw AI Agents with 3-Layer Protection
ClawSecure is a security platform designed specifically for OpenClaw AI agents, offering comprehensive protection including 3-layer security
Product Hunt·1mo ago
OpenClaw: AI Personal Agent for Computer Control via Chat Apps
OpenClaw is an AI-powered personal agent that transforms computers into 24/7 accessible systems controllable via chat apps like WhatsApp and
Product Hunt·4mo ago
IronClaw: Secure Open-Source Alternative to OpenClaw for AI Credential Protection
IronClaw is presented as a secure, open-source alternative to OpenClaw that addresses security vulnerabilities in AI credential management.
Product Hunt·3mo ago