OpenClaw Security: Viral AI Agent Hit by Repeated Critical CVEs

A record-breaking project with a recurring problem

OpenClaw has become one of the defining open-source stories of 2026. GitHub describes it as the fastest-growing project in the platform's history and has profiled the maintainers working to both build and secure it 5. Oasis Security notes that the autonomous AI agent passed 100,000 GitHub stars in five days. Thousands of developers now run it on their laptops, wired into messaging apps, calendars and development tools, where it acts on their behalf 1.

That same reach and autonomy has made OpenClaw a magnet for security researchers and attackers. Over several months, the project has absorbed a series of high and critical severity vulnerabilities, a poisoned plugin marketplace, and a large population of exposed deployments. The pattern says as much about agentic AI as a category as it does about one codebase.

The early wave: RCE, hijacking and poisoned skills

Conscia describes the first weeks after OpenClaw's surge as a "multi-vector security crisis." The centerpiece was CVE-2026-25253, a one-click remote code execution chain rated CVSS 8.8. It could be exploited even against instances bound only to localhost, and it was patched in version 2026.1.29 2.

Oasis Security separately disclosed a chain it calls ClawJacked. According to the researchers, any website a developer visited could silently take full control of their local agent, with no plugins, extensions or clicks required. The OpenClaw team rated the issue High and shipped a fix within 24 hours 1.

The supply chain was under attack at the same time. Conscia reports that the "ClawHavoc" campaign initially planted 341 malicious skills in the ClawHub marketplace, about 12% of the registry, mostly delivering the Atomic macOS Stealer. Later scans put the count above 800, roughly a fifth of all listings 2. Oasis cites more than 1,000 malicious skills posing as crypto tools and productivity integrations while delivering info-stealers and backdoors 1. The differing figures most likely reflect when each scan ran and how each team counted, but every estimate describes a marketplace that was heavily compromised.

Exposure made things worse. Conscia cites scanning by Censys, Bitsight and Hunt.io that found more than 30,000 internet-facing OpenClaw instances, many without authentication. It also cites Bitdefender telemetry showing the agent on corporate endpoints, a new form of shadow IT 2.

Privilege escalation and the "Claw Chain"

The disclosures continued after the initial rush. Ars Technica reports that maintainers patched three high-severity bugs at once. The most serious, CVE-2026-33579, scores between 8.1 and 9.8 depending on the metric. It lets anyone holding the lowest meaningful permission, pairing scope, approve their own request for full admin access 3. Researchers at Blink warned that in company-wide deployments, a compromised admin device could read every connected data source. They added that no secondary exploit or extra user interaction is needed beyond the initial pairing 3.

Dark Reading then covered "Claw Chain," four vulnerabilities found by data security firm Cyera that can be strung together for initial access, credential theft, privilege escalation and persistent backdoors. The worst, CVE-2026-44112 (CVSS 9.6), is a time-of-check/time-of-use race condition in the OpenShell sandbox that can let attackers rewrite system configuration and gain lasting system-level control. All four affect every release before 2026.4.22 and have been patched 4.

Why it keeps happening

The sources agree on one point. OpenClaw's value comes from broad access and the freedom to act autonomously, and that is exactly what makes each flaw so damaging 23. A bug in a typical developer tool might leak data. A bug in an agent connected to email, calendars, credentials and a shell hands the attacker everything the agent can do.

The flaws also span every layer of the stack:

• The browser boundary: ClawJacked 1.
• Network exposure: the localhost-reachable RCE 2.
• Authorization logic: the pairing-scope escalation 3.
• Sandbox isolation: Claw Chain 4.
• The plugin ecosystem: ClawHavoc 2.

That breadth suggests the problem is structural rather than a few isolated mistakes.

The maintainers deserve credit. Fixes have generally arrived quickly, including the 24-hour turnaround Oasis describes 1, and GitHub frames security as a core part of the team's work 5. But fast patching only protects users who update. With tens of thousands of exposed instances and installs appearing on unmanaged corporate machines 2, many deployments likely still run older, vulnerable builds.

The takeaway

OpenClaw is a preview of the security debt that comes with mainstream agentic AI. It is not an outlier to dismiss. For individual developers, the minimum is to stay on current releases, avoid exposing the gateway to the internet, and treat community skills as untrusted code. For organizations, the stronger lesson is governance: discover where agents are running, restrict what they can reach, and assume more CVEs are coming. On OpenClaw's track record so far, that assumption looks safe.