{"schema_version":"0.10.0","id":"LR-2026-0551","record_version":1,"title":"Claw Chain vulnerabilities expose OpenClaw deployments to attack","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Cyber Security News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Cyber Security News · subject to change"}]},"sources_hash":"d4a012702499da7aa329a34f588f9bba4472319280f638b531eb5d67e3570689"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"OpenClaw","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"IT automation, customer service pipelines, and operational integrations","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-05-15","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Researchers at Cyera reported four vulnerabilities in OpenClaw, an open-source platform for autonomous AI agents that connects language models to filesystems, SaaS applications, credentials and execution environments. The flaws, which Cyera named Claw Chain, include a sandbox escape through a race condition, credential leakage through environment variables, privilege escalation via a client-controlled ownership flag, and symbolic-link access to files outside the allowed root. Chained from a single foothold, they could allow credential theft and persistent backdoors. Cyera disclosed the flaws to OpenClaw maintainers in April 2026, and all four have since been patched. Shodan and ZoomEye scans as of May 2026 counted roughly 245,000 publicly accessible instances.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"A time-of-check/time-of-use (TOCTOU) race condition in the OpenShell sandbox allows attackers to redirect write operations outside the sandbox boundary","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK03","RK04"],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["J1"],"quote":"All four have since been patched.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched, with a bounded scope stated. Fact: an estimated 245,000 publicly accessible server instances are exposed, a stated count, but no compromise of them is stated.","harm_class":[],"affected_description":"Approximately 245,000 publicly accessible OpenClaw server instances (about 65,000 Shodan and 180,000 ZoomEye) as of May 2026","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/openclaw-chain-vulnerabilities/","publisher":"CyberSecurityNews","date":"2026-05-15","type":"press","title":"OpenClaw Chain Vulnerabilities Expose 245,000 Public AI Agent Servers to Attack - CyberSecurityNews","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.harness":"C","system.intended_use":"C","event.root_cause_detail":"C","event.incident_class":"C","event.adversarial_actor":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"A chain of four critical vulnerabilities discovered in OpenClaw, one of the fastest-growing open-source platforms for autonomous AI agents, has left an estimated 245,000 publicly accessible server instances exposed to remote exploitation, credential theft, and persistent backdoor installation."}],"system.intended_use":[{"source_index":0,"quote":"Enterprises have rapidly adopted it for IT automation, customer service pipelines, and operational integrations with platforms like Telegram, Discord, and Microsoft Agent 365."}],"event.root_cause_detail":[{"source_index":0,"quote":"A time-of-check/time-of-use (TOCTOU) race condition in the OpenShell sandbox allows attackers to redirect write operations outside the sandbox boundary, enabling configuration tampering and persistent backdoor placement on the host."}],"event.incident_class":[{"source_index":0,"quote":"A chain of four critical vulnerabilities discovered in OpenClaw, one of the fastest-growing open-source platforms for autonomous AI agents, has left an estimated 245,000 publicly accessible server instances exposed to remote exploitation, credential theft, and persistent backdoor installation."}],"event.adversarial_actor":[{"source_index":0,"quote":"From a single foothold, such as a malicious plugin, prompt injection, or compromised external input, an attacker can chain three vulnerabilities in parallel:"}],"impact.affected_description":[{"source_index":0,"quote":"Shodan and ZoomEye scans as of May 2026 reveal approximately 65,000 and 180,000 publicly accessible OpenClaw instances, respectively, totaling roughly 245,000 exposed servers."}],"impact.severity":[{"source_index":0,"quote":"A chain of four critical vulnerabilities discovered in OpenClaw, one of the fastest-growing open-source platforms for autonomous AI agents, has left an estimated 245,000 publicly accessible server instances exposed to remote exploitation, credential theft, and persistent backdoor installation."}],"impact.severity_because":[{"source_index":0,"quote":"A chain of four critical vulnerabilities discovered in OpenClaw, one of the fastest-growing open-source platforms for autonomous AI agents, has left an estimated 245,000 publicly accessible server instances exposed to remote exploitation, credential theft, and persistent backdoor installation."}],"event.remediations":[{"source_index":0,"quote":"All four have since been patched."}],"event.summary":[{"source_index":0,"quote":"A chain of four critical vulnerabilities discovered in OpenClaw, one of the fastest-growing open-source platforms for autonomous AI agents, has left an estimated 245,000 publicly accessible server instances exposed to remote exploitation, credential theft, and persistent backdoor installation."},{"source_index":0,"quote":"Cyera’s research team identified the four previously undisclosed vulnerabilities and disclosed them to OpenClaw maintainers in April 2026."},{"source_index":0,"quote":"From a single foothold, such as a malicious plugin, prompt injection, or compromised external input, an attacker can chain three vulnerabilities in parallel:"},{"source_index":0,"quote":"All four have since been patched."},{"source_index":0,"quote":"Shodan and ZoomEye scans as of May 2026 reveal approximately 65,000 and 180,000 publicly accessible OpenClaw instances, respectively, totaling roughly 245,000 exposed servers."}]},"notes_on_gaps":"The sources state no date of occurrence, no confirmed in-the-wild exploitation, and no affected organisation; the chain is described as possible, not observed. No developer organisation, model name, model version, deployment context, lifecycle stage, or country is stated. No failure_class is given because no autonomous agent misbehaviour is described; the flaws are software vulnerabilities. No trigger is recorded since the cause of any real incident is not stated. The 245,000 figure is an estimate summing two scans, and the sources do not say how many of those instances were compromised. Severity moderate is my judgement: the stated count is of exposed systems, not compromised ones. Root cause guardrail is my classification of the sandbox and validation flaws. Detection method public_researcher is my classification of Cyera. Remediation controls J1 and A1 are my mapping of the patch and advice. The article is a single press source dated 2026-05-15, and no other sources were provided to corroborate it. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Cyber Security News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"reached","text":"Scans as of May 2026 counted roughly 245,000 publicly accessible OpenClaw instances.","quote":"Shodan and ZoomEye scans as of May 2026 reveal approximately 65,000 and 180,000 publicly accessible OpenClaw instances, respectively, totaling roughly 245,000 exposed servers.","source_index":0,"grade":"C"},{"step":"caught","text":"Cyera’s research team identified the flaws and disclosed them to OpenClaw maintainers in April 2026.","quote":"Cyera’s research team identified the four previously undisclosed vulnerabilities and disclosed them to OpenClaw maintainers in April 2026.","source_index":0,"grade":"C"},{"step":"done","text":"All four vulnerabilities have since been patched.","quote":"All four have since been patched.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/openclaw-chain-vulnerabilities/"]},"analysis":{"sections":{"timeline":[{"text":"OpenClaw, originally launched as Clawdbot, begins to be developed and offered.","quote":"Originally launched as “Clawdbot” in late 2025, OpenClaw connects large language models directly to filesystems, SaaS applications, credentials, and execution environments.","source_index":0,"when":"late 2025"},{"text":"Cyera discloses the four vulnerabilities to OpenClaw maintainers.","quote":"Cyera’s research team identified the four previously undisclosed vulnerabilities and disclosed them to OpenClaw maintainers in April 2026.","source_index":0,"when":"2026-04"},{"text":"Fixes covering the four vulnerabilities are dated April 23, 2026.","quote":"Patch immediately by applying the April 23, 2026, fixes covering GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, and GHSA-x3h8-jrgh-p8jx.","source_index":0,"when":"2026-04-23"},{"text":"Shodan and ZoomEye scans count roughly 245,000 publicly accessible OpenClaw instances.","quote":"Shodan and ZoomEye scans as of May 2026 reveal approximately 65,000 and 180,000 publicly accessible OpenClaw instances, respectively, totaling roughly 245,000 exposed servers.","source_index":0,"when":"2026-05"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/openclaw-chain-vulnerabilities/"]}}