OpenClaw 0-Click Flaw Lets Malicious Websites Hijack Developer AI Agents

OpenClaw, a highly popular open-source AI personal assistant with over 100,000 GitHub stars, recently faced a critical security flaw.

This AI tool, which autonomously manages developer workflows across laptops, messaging apps, and dev tools, was found to be vulnerable to a 0-click exploit.

Any website visited by a developer could silently hijack their OpenClaw agent without requiring plugins, extensions, or user interaction.

The OpenClaw team has since addressed the issue, classifying it as High severity and releasing a fix within 24 hours.

OpenClaw, formerly known as Clawdbot and MoltBot, has seen unprecedented growth, drawing attention from industry leaders.

Despite its success, the platform has encountered security challenges.

Earlier this year, researchers found over 1,000 malicious skills in OpenClaw’s community marketplace, ClawHub, which deployed info-stealers and backdoors.

However, the newly discovered vulnerability is distinct as it resides in the core gateway system, not in community-developed plugins.

Oasis Security researchers, this situation highlights the growing issue of shadow AI, developer-adopted tools operating outside IT visibility, often with extensive access to local systems and credentials.

Malicious Websites Hijack Developer AI Agents

At the center of OpenClaw is its gateway, a local WebSocket server that manages authentication, chat sessions, configurations, and AI agent orchestration.

Various nodes, such as macOS companion apps or iOS devices, connect to this gateway to execute system commands and access local resources.

The vulnerability stems from the gateway’s inherent trust in localhost connections.

By default, the gateway binds to localhost and uses either a token or a password for authentication.

However, cross-origin policies do not block WebSocket connections to localhost. This allows malicious JavaScript on any visited website to open a connection to the local OpenClaw gateway.

The attack chain begins when a developer visits an attacker-controlled website.

The malicious JavaScript opens a WebSocket connection and starts brute-forcing the gateway password.

Because the gateway exempts localhost connections from rate limiting, attackers can perform hundreds of password guesses per second, quickly bypassing human-chosen passwords.

Once authenticated, the script silently registers as a trusted device, bypassing user confirmation prompts.

The attacker then gains full control over the AI agent, allowing them to:

• Interact with the AI agent and receive responses.
• Access gateway configuration, including AI providers and messaging channels.
• Enumerate all connected nodes and their IPs.
• Read application logs for operational intelligence.

This access enables attackers to search Slack history for API keys, read private messages, exfiltrate files, or execute shell commands on any connected device, equating to a full workstation compromise.

Users and organizations running OpenClaw must immediately update to version 2026.2.25 or later to secure their environments against this severe vulnerability.

Ensuring visibility and governance over developer-adopted AI tools is crucial to mitigating the risks associated with shadow AI.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.