Catch Advisors
Cybersecurity

Everything We Know About OpenClaw Vulnerabilities

OpenClaw — the open-source AI agent that lets you run an autonomous personal assistant on your own machine — is one of the fastest-growing developer tools in history. It crossed 180,000 GitHub stars, drew 2 million visitors in a single week, and has become the default way developers interact with AI agents locally.

It has also become a security disaster.

Since late January 2026, researchers have uncovered a cascade of critical vulnerabilities affecting OpenClaw and its ecosystem: one-click remote code execution, leaked API keys, exposed databases, malicious extensions, and over 30,000 instances sitting on the public internet. If your organization has developers using OpenClaw — or any agentic AI tool — this is the breakdown you need.

A Brief History: Clawdbot to Moltbot to OpenClaw

Before diving into the vulnerabilities, it helps to understand the chaotic timeline:

  • November 2025: The project launches as Clawdbot and gains rapid traction among developers
  • January 27, 2026: Anthropic files a trademark claim; the project renames to Moltbot
  • January 29, 2026: Additional trademark concerns force a second rename to OpenClaw
  • January 30, 2026: Critical RCE patch (version 2026.1.29) is released
  • January 31, 2026: The Moltbook social database exposure is discovered
  • February 2, 2026: Full RCE exploit details are publicly disclosed

During the rebrand chaos, threat actors hijacked the original @clawdbot social media handles and used them to promote fraudulent cryptocurrency tokens ($CLAWD) to over 60,000 followers. The security story was already bad before the CVEs started dropping.

CVE-2026-25253: One-Click Remote Code Execution

This is the headline vulnerability, and it’s as bad as it sounds.

CVSS Score: 8.8 (High) Affected Versions: All versions prior to 2026.1.29 Discovered by: Mav Levin, DepthFirst Security

How the Attack Works

The exploit chain is elegant and terrifying. It executes in milliseconds and requires only that a victim clicks a single malicious link:

  1. Victim clicks a link to an attacker-controlled webpage
  2. JavaScript extracts the authentication token stored in the victim’s browser
  3. Cross-site WebSocket hijacking — OpenClaw’s server doesn’t validate WebSocket origin headers, so the attacker establishes a connection using the stolen token
  4. Safety features are disabled — the attacker sets exec.approvals.set to off and escapes sandbox constraints via tools.exec.host
  5. Arbitrary code execution — a node.invoke request achieves full RCE on the host machine

The critical insight: this works even on loopback-only deployments (localhost). The victim’s own browser acts as the bridge, making network-level protections useless.

Additional Command Injection CVEs

CVE-2026-25253 isn’t alone. Two additional command injection vulnerabilities were disclosed:

  • CVE-2026-24763: Command injection flaw in gateway processing
  • CVE-2026-25157: Additional command injection vector

Researchers demonstrated that these can be chained together to achieve full code execution on host systems even through different attack paths.

30,000+ Instances Exposed on the Public Internet

As of February 8, 2026, Censys has identified over 30,000 publicly exposed OpenClaw instances accessible over the internet — up from 21,000 just a week earlier.

While most require a token to interact with, the exposure itself is the problem. According to Wiz’s analysis, this exposure has already resulted in:

  • 1.5 million API authentication tokens leaked
  • 35,000 email addresses exposed
  • Private messages between agents accessible to anyone
  • API keys, chat histories, and account credentials sitting in the open

The root cause: OpenClaw’s default configuration stores authentication tokens, API keys, user profiles, and conversation histories in unencrypted plaintext — Markdown and JSON files with no encryption at rest.

The ClawHub Skills Marketplace: 283 Leaky Skills

The security problems extend beyond OpenClaw itself into its skills ecosystem.

Snyk researchers audited the entire ClawHub marketplace — nearly 4,000 skills — and found that 283 skills (7.1%) contain critical flaws that expose sensitive credentials. These aren’t obscure, abandoned plugins. They’re popular, actively used skills:

Moltyverse-Email (v1.1.0)

Forces agents to output API keys verbatim in URLs shared with users. Instructions explicitly tell agents to save credentials to memory and display them in plaintext.

Buy-Anything (v2.0.0)

Instructs agents to collect credit card numbers and CVCs, then embeds raw financial data directly into API commands. A prompt injection attack could trigger replay attacks with stored card data.

Prompt-Log

Blindly extracts session logs without redacting credentials, converting previously handled API keys into shareable markdown artifacts.

Prediction-Markets-Roarin

Encourages storing API keys in plaintext configuration files using patterns that become attack vectors for malicious skills.

The fundamental problem is developers treating AI agents like local scripts, forgetting that every piece of data an agent touches passes through the LLM’s context window. Secrets get logged, cached, and exposed in ways that traditional security tooling doesn’t catch.

Malicious Extensions and Supply Chain Attacks

The threat landscape gets worse. Researchers have discovered:

  • Hundreds of malicious skills in the ClawHub repository designed to exfiltrate data
  • Fake “Clawdbot Agent” VS Code extensions that install trojans and remote access malware
  • Indirect prompt injection attacks where crafted emails, chat messages, or web content trick the agent into executing unauthorized actions like data exfiltration or file deletion

This is a supply chain attack surface that most organizations haven’t even begun to map.

The Moltbook Database Exposure

Moltbook — an OpenClaw-adjacent AI agent social network — exposed its entire database to the public, including secret API keys. An attacker could impersonate any registered AI agent on the platform.

The exposure was significant: high-profile researchers like Andrej Karpathy had linked personal agents to the platform. Supabase CEO Paul Copplestone confirmed the issue was a misconfiguration of the underlying database software. It was eventually fixed, but not before the data was accessible for an unknown period.

What Your Security Team Should Do Right Now

If you have any developers or teams using OpenClaw, here’s your action checklist:

Immediate Actions

  1. Audit your environment for OpenClaw installations — check developer workstations, cloud instances, and CI/CD pipelines
  2. Upgrade immediately to version 2026.1.29 or later if any instances are found
  3. Rotate all credentials that may have been accessible to OpenClaw agents — API keys, tokens, passwords
  4. Scan for exposure — use tools like runZero (vendor:=OpenClaw product:=OpenClaw) to find instances on your network
  5. Block public access to any OpenClaw instances — these should never be internet-facing

Ongoing Mitigations

  • Strict tool whitelisting — explicitly permit only essential skills and block shell execution
  • Gateway authentication — set strong passwords and verify reverse proxy header passing
  • Enable sandbox mode — restrict filesystem and browser access
  • Audit installed skills — run mcp-scan to check for known-vulnerable skills
  • Scope API tokens — limit permissions to the absolute minimum required
  • Channel restrictions — grant agent access only to trusted communication channels

Policy Considerations

  • Update your acceptable use policy to address agentic AI tools explicitly
  • Include AI agent deployments in your asset inventory and vulnerability management program
  • Evaluate whether your security model accounts for AI agents that can autonomously read emails, browse the web, and execute code

The Bigger Picture: Agentic AI Is a New Attack Surface

OpenClaw is the canary in the coal mine. As VentureBeat put it: “OpenClaw proves agentic AI works. It also proves your security model doesn’t.”

The core challenge isn’t specific to OpenClaw. Any agentic AI tool that can read data, make decisions, and take actions introduces a fundamentally new class of security risk. Traditional security models assume humans are in the loop. Agentic AI removes that assumption.

Organizations need to start asking:

  • Do we know which AI agents are running in our environment?
  • What data can they access?
  • What actions can they take?
  • Who is responsible when an agent makes a decision that causes a breach?

These aren’t theoretical questions anymore. With 30,000 exposed instances and 1.5 million leaked tokens, the breach has already happened at scale.

Is your organization prepared for the security implications of agentic AI? Request a free cybersecurity assessment and we’ll help you evaluate your exposure and build a response plan.