Guide
OpenClaw Security Exploits: What Actually Happened
OpenClaw spent 2026 as the most-searched AI agent and, unavoidably, the most-attacked one. Three things genuinely went wrong: a one-click remote code execution bug, a browser-based instance hijack, and a malware campaign riding the skill registry. Here is what each one did, which release closed it, and which risks are still open because they are design consequences rather than bugs.
Why an Agent Is a Bigger Target Than an App
An OpenClaw agent reads your messages, browses the web, writes files and runs code on a machine you care about. That is the product, and it is also the blast radius. A vulnerability in a normal app leaks that app's data; a vulnerability in an agent hands an attacker something that already has your credentials and permission to act. Every exploit below is a variation on that theme.
The Three Real Incidents
| Incident | What it did | Status |
|---|---|---|
| CVE-2026-25253 | One-click RCE from a malicious link | Fixed in 2026.1.29 |
| ClawJacked | Websites hijacking a local instance and exfiltrating data | Fixed in 2026.2.26 |
| ClawHavoc | Malicious skills distributed through the registry | Ongoing — not a patchable bug |
CVE-2026-25253 — one-click remote code execution
The Control UI trusted parameters passed in the URL without validating them, which opened the door to cross-site WebSocket hijacking. A single malicious link was enough to reach code execution on the host running the agent. OpenClaw shipped the fix in 2026.1.29, ahead of public disclosure, which is the right order to do it in.
ClawJacked — hijacking a local instance from a web page
Researchers at Oasis Security found that a malicious website could brute-force its way onto a locally running OpenClaw instance and then quietly use the agent's own autonomy to exfiltrate data. Nothing looked like an attack from the user's side — the agent was simply doing agent things, for someone else. Patched in 2026.2.26.
A separate advisory, CVE-2026-62199, has its own page with the specific fix steps.
ClawHavoc — the supply-chain campaign
This is the one that has not gone away, because it is not a code bug. ClawHub, the community registry where OpenClaw skills are shared, was abused to distribute malicious packages dressed up as trading bots, utilities and developer helpers. Install one and it drops information-stealing malware onto the machine. No OpenClaw release can patch a user choosing to install a hostile skill.
Install Count Is Not a Safety Signal
This is the part most coverage gets wrong, and we have first-party numbers on it. When we vetted skills for our own skills marketplace on 12 August 2026, upstream scanners rejected 137 of 350 candidates that had already passed an initial screen — and the rejects skewed towards the popular ones.
Popularity also hides skills that are merely broken, which scanners pass happily: one with 326 installs ships a raw PDF binary as its instructions file, another with 738 is a stub with no implementation, and a third promises real-time prices with no data source wired up. Check that a skill's body is real, self-consistent instructions before you trust it — a clean scan only means it is not actively hostile.
Hardening That Actually Matters
- Stay current. Two of the three incidents were fixed by a version bump. An agent pinned to a January build is carrying January's bugs — see how to update OpenClaw.
- Never expose the gateway to the open internet. The Control UI is not a public surface. Keep it behind auth and a private network — gateway setup covers the safe shape, and Tailscale is a good private route.
- Use pairing, not open DMs. On Telegram an open DM policy means anyone who finds your bot can talk to it. Pairing forces an approval step — see Telegram pairing.
- Read the skill before installing it. Open the actual instructions. If it tells the agent to fetch and run something from a URL, that is the whole attack in one line.
- Give it its own box. An agent that can run code should not share a machine with your password manager and SSH keys. Container isolation is the point — see OpenClaw with Docker.
- Scope the credentials you hand it. Separate API keys with narrow permissions, so a compromise costs you one key rather than your account.
Where Hosting Changes the Maths
Most of the list above is work. On OpenClaw Launch, several items are simply how the product is built: every agent runs in its own isolated container on our servers rather than on your laptop, the gateway is served over HTTPS behind authentication instead of an open local port, and images are kept on maintained versions rather than whatever was current the day you installed.
That is not a claim that hosting makes an agent unattackable. A malicious skill is still a malicious skill, and an agent you have given broad credentials to can still misuse them. What managed hosting removes is the category of problem where a web page in your browser can reach an agent listening on your own machine — which is precisely what ClawJacked was. Our marketplace only lists skills that passed multi-scanner vetting, which is a different bar from the open registry.
FAQ
Is OpenClaw safe to use?
Yes, with the same caveat that applies to any tool that can run code on your behalf: it is as safe as what you connect it to. Run a current version, keep the gateway private, install skills deliberately rather than by popularity, and the known exploit classes are closed.
Which OpenClaw version fixed the known exploits?
CVE-2026-25253 was fixed in 2026.1.29 and the ClawJacked hijack in 2026.2.26. The ClawHavoc skill supply-chain campaign is not fixable by a release — it depends on which skills you choose to install.
Can a malicious skill steal my API keys?
Yes, if you install one. A skill is instructions the agent follows, and an agent that can read its own environment can be told to send it somewhere. This is the reason to read a skill before installing it and to give the agent narrowly-scoped keys.
Does a high install count mean a skill is trustworthy?
No, and the data says the opposite. In our 12 August 2026 vetting run, scanners rejected 137 of 350 pre-screened skills, and the most-installed skill in the registry — nearly 6,000 installs — carries a DO_NOT_INSTALL rating from ClawHub's own scanner.