Patched OpenClaw Flaw Let Hackers Hijack AI Agents

Hackers could chain together and exploit four vulnerabilities in OpenClaw to move from an initial foothold to persistent, system-level control, stealing credentials and planting backdoors along the way. All four flaws have been patched.

See Also: AI Agents Introduce a New Insider Threat Model

The four vulnerabilities, collectively dubbed “Claw Chain” by Cyera researchers, affect all versions released before April 23 of OpenClaw, the open-source platform for autonomous artificial intelligence agents.

The most severe flaw, tracked as CVE-2026-44112, carries a near-maximum rating CVSS score of 9.6 and exploited a timing gap in the platform’s sandboxed execution environment. Even if the software checks whether an action is safe or not, the flaw allowed an attacker to manipulate the target between that check and the moment the action executes, slipping past the validation. The window allowed an attacker to redirect write operations outside the sandbox boundary, tamper with system configuration and plant persistent backdoors on the host machine.

The remaining three flaws complete the sequence.

CVE-2026-44115 exploited a gap between OpenClaw’s command validation and its shell execution to expose environment variables through commands that appear safe at the point of validation. CVE-2026-44118 allowed a locally running process with a valid authentication token to elevate itself to owner-level control over the agent’s gateway configuration, scheduling and execution environment. OpenClaw trusted a client-controlled ownership flag without verifying it against the authenticated session. CVE-2026-44113 mirrored the first flaw but on the read side: an attacker could swap a validated file path with a redirect pointer aimed outside the permitted directory boundary, exposing system files and internal credentials the agent was not intended to reach.

“By weaponizing the agent’s own privileges, an adversary moves through data access, privilege escalation and persistence – using the agent as their hands inside the environment,” Cyera said. “Each step looks like normal agent behavior to traditional controls, broadening blast radius and making detection significantly harder.”

The architecture of tools like OpenClaw makes them an almost ideal vehicle for an attacker to move undetected, said Justin Fier, senior vice president of offensive security at Darktrace. “In many ways, it is the perfect initial access point, and then the perfect tool to move throughout a network,” Fier said. “If an attacker can compromise an agent with that level of access, they may be able to operate through the same permissions and workflows the user has already granted.”

Scans of publicly accessible infrastructure using Shodan and ZoomEye as of May identified approximately 65,000 to 180,000 OpenClaw instances respectively, roughly 245,000 servers reachable from the public internet, Cyera said. Many of those deployments may lack authentication controls or network restrictions.

Originally launched as Clawdbot, the platform allows users to automate workflows, manage files, execute shell commands and take autonomous actions. In just three months since launch, it became GitHub’s most-starred project, surpassing the React JavaScript library. The growth came alongside a stream of security disclosures, with researchers having tracked more than 500 GitHub Security Advisories against the platform, with issues tied to command execution, leaked plaintext API keys and credentials that threat actors can steal via indirect prompt manipulation, malicious skills or unsecured endpoints.

Fier said that personal use of tools like OpenClaw can open unexpected pathways into corporate environments. “For personal users, this is a privacy nightmare,” he says. “Many people using tools like OpenClaw may have given them broad access to financial data, health data, private files and other sensitive information. The enterprise risk begins when that same personal agent touches work systems, work credentials or a business device. Then the question becomes: Is the real target the organization, or the personal end user as a means of getting into that organization?”