ClawJacked Flaw Could Let Malicious Sites Take Over Local OpenClaw AI Agents
Summary
OpenClaw patched ClawJacked in version 2026.2.25. Oasis Security said malicious websites could exploit the local gateway’s password and device-registration weaknesses to gain control of an agent. The article also details malicious skills and recommends updates and safer
Key points
- Oasis Security reported that JavaScript on an attacker-controlled website could connect to a local OpenClaw gateway over WebSocket and brute-force its password because rate limiting was missing.
- After authentication, the attacker could register as a trusted device without user approval and gain control of the agent, including access to configurations, connected nodes, and logs.
- OpenClaw released a ClawJacked fix in version 2026.2.25 on February 26, 2026; the article advises users to update and audit agent access.
- A separate log-poisoning issue, which could enable indirect prompt injection through logs read by the agent, was fixed in version 2026.2.13.
- The article reports malicious ClawHub skills delivering Atomic Stealer and cryptocurrency scams, including skills that direct agents to expose wallet keys or route payments to attacker-controlled infrastructure.
- Microsoft advised evaluating OpenClaw only in an isolated environment with dedicated, non-privileged credentials and access to non-sensitive data; users are also advised to vet skills and monitor their behavior.
Article Details
- Vulnerability Types
- Missing password rate limiting enabled brute-force attempts against the OpenClaw gateway.
- Localhost WebSocket connections were trusted in ways that allowed automatic approval of new trusted devices.
- Log poisoning through WebSocket requests could place malicious content in logs later read by the agent.
- Severity
- High for ClawJacked, as described by the article.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Avoid exposing OpenClaw runtimes publicly.
- Audit and vet skills before installing them.
- Run OpenClaw in a fully isolated environment with dedicated, non-privileged credentials and access only to non-sensitive data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | openclawcli[.]vercel[.]app | Host of installation instructions containing a malicious command to download and run Atomic Stealer. |
| IPV4 | 91[.]92[.]242[.]30 | Payload server used to distribute Atomic Stealer. |
MITRE ATT&CK
T1005 · Data from Local SystemAfter gaining control of the agent, attackers could dump configuration data and read application logs.T1059.004 · Unix ShellUsers were urged to run a Terminal command designed to retrieve and execute Atomic Stealer.T1059.007 · JavaScriptJavaScript on a malicious webpage opened a WebSocket connection to the local OpenClaw gateway.T1105 · Ingress Tool TransferThe command retrieved the Atomic Stealer payload from an external server.T1110.001 · Password GuessingThe webpage script brute-forced the OpenClaw gateway password by exploiting missing rate limiting.T1189 · Drive-by CompromiseA victim visiting an attacker-controlled website could trigger its JavaScript to connect to the local OpenClaw gateway.T1565.001 · Stored Data ManipulationAttackers could write malicious content to logs on publicly accessible instances, where the agent might later read it.
People
Threat Actors
@liuhui1010Identified by threat hunters as a threat actor posting comments that urged users to run a command to retrieve Atomic Stealer.26mediasOne of the reported aliases of the threat actor attributed the bob-p2p-beta and runware skills; the article says this alias was used on ClawHub.BobVonNeumannOne of the reported aliases of the threat actor attributed the bob-p2p-beta and runware skills; the article says this alias was used on Moltbook and X to promote the skills.Cookie SpiderIdentified in the article as a cybercrime actor that developed and rented Atomic Stealer.
Malware
Vendors
BitsightReports from Bitsight and NeuralTrust have detailed how OpenClaw instances left connected to the internet pose an expanded attack surface, with each integrated service further broadening the blast radius and can beEye Security“If the injected text is interpreted as meaningful operational information rather than untrusted input, it could influence decisions, suggestions, or automated actions,” Eye Security said.Koi Securityis designed to retrieve Atomic Stealer from “91.92.242[.]30,” an IP address previously documented by Koi Security and OpenSourceMalware for distributing the same malware via malicious skills uploaded to ClawHub.MicrosoftThe security risks associated with self-hosted agent runtimes like OpenClaw have also prompted Microsoft to issue an advisory, warning that unguarded deployment could pave the way for credential exposure/exfiltration,NeuralTrustReports from Bitsight and NeuralTrust have detailed how OpenClaw instances left connected to the internet pose an expanded attack surface, with each integrated service further broadening the blast radius and can beOasis Securityno user-installed extensions – just the bare OpenClaw gateway, running exactly as documented,” Oasis Security said in a report published this week.OpenSourceMalwareAtomic Stealer from “91.92.242[.]30,” an IP address previously documented by Koi Security and OpenSourceMalware for distributing the same malware via malicious skills uploaded to ClawHub.StraikerWhat’s more, a recent analysis of 3,505 ClawHub skills by AI security company Straiker has uncovered no less than 71 malicious ones, some of which posed as legitimate cryptocurrency tools but contained hiddenTrend Micro“The infection chain begins with a normal SKILL.md that installs a prerequisite,” Trend Micro said.
Products
ClawHubOpenClaw issued a patch in version 2026.2.25, but malicious skills on ClawHub have been used to deliver Atomic Stealer and other scams, prompting recommendations to update, audit skills, and isolate agent runtimes.OpenClawA high-severity OpenClaw vulnerability codenamed ClawJacked allowed attacker-controlled websites to connect to a local OpenClaw gateway, brute-force its password, auto-register as a trusted device, and fully control AI