Oasis-Security

If you run OpenClaw on your local machine, here’s your mandatory security update for the week: a vulnerability named ClawJacked was quietly exploiting a gap in the local gateway WebSocket handshake — and yes, a malicious website could have used it against you while you were browsing with OpenClaw running in the background. The patch is out. Here’s what happened and what you need to do. What Is ClawJacked? ClawJacked is the name given to a class of attack discovered by Oasis Security that targets OpenClaw’s local gateway server — the WebSocket service that runs on localhost to connect your browser to your AI agents. ...

Oasis Security disclosed a critical vulnerability chain in OpenClaw today that can enable full workstation compromise — initiated from a browser tab. SecurityScorecard found more than 40,000 OpenClaw gateways exposed to the public internet. If you’re running OpenClaw, this guide walks you through auditing your exposure and locking it down while you wait for an official patch. This is not a theoretical threat. Act now. Disclaimer: This guide reflects best practices as of 2026-02-26, based on the publicly available Oasis Security threat research. OpenClaw’s security team has acknowledged the report. Apply any official patches immediately when released, as they may supersede or extend these mitigations. ...

If you’re running OpenClaw, stop what you’re doing and read this. Oasis Security’s research team published threat research today revealing a critical vulnerability chain in OpenClaw that enables attackers to achieve full workstation compromise — potentially including privilege escalation and credential theft — initiated entirely from a browser tab. This is a distinct and separate issue from the GHSA-mr32 CVE batch that was patched earlier this month. Compounding the urgency: SecurityScorecard has identified more than 40,000 exposed OpenClaw instances accessible from the public internet. ...