Clawjacked

The ClawJacked vulnerability allowed malicious websites to brute-force OpenClaw’s local WebSocket gateway and silently gain admin control over your AI agents. The patch is out — but patching alone isn’t enough if your gateway is still misconfigured. This guide walks you through verification and hardening. Time required: 10–15 minutes Difficulty: Beginner–Intermediate Prerequisites: OpenClaw installed and running locally Step 1: Check Your OpenClaw Version The ClawJacked fix shipped in the latest OpenClaw release. First, confirm what version you’re running. ...

If you run OpenClaw on your local machine, here’s your mandatory security update for the week: a vulnerability named ClawJacked was quietly exploiting a gap in the local gateway WebSocket handshake — and yes, a malicious website could have used it against you while you were browsing with OpenClaw running in the background. The patch is out. Here’s what happened and what you need to do. What Is ClawJacked? ClawJacked is the name given to a class of attack discovered by Oasis Security that targets OpenClaw’s local gateway server — the WebSocket service that runs on localhost to connect your browser to your AI agents. ...