Cases › security breach › LR-2026-0421

OpenClaw one-click remote code execution via crafted malicious link (CVE-2026-25253)

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

Severity major

Reported 2 Feb 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: Unbounded scope stated: the flaw impacts any Moltbot deployment where a user has authenticated to the Control UI. No count of affected parties is stated.

OpenClaw, an open-source autonomous AI personal assistant that runs locally on user devices, was found to have a high-severity flaw, tracked as CVE-2026-25253, that could allow remote code execution through a crafted malicious link. The Control UI trusted a gatewayUrl from the query string and sent the stored gateway token to an attacker-controlled server. Using the stolen token, an attacker could connect to a victim's local gateway, change sandbox and tool policies, and invoke privileged actions. Security researcher Mav Levin, credited with discovering the flaw, described a one-click exploit chain that takes milliseconds after a victim visits a single malicious web page. The issue was addressed in version 2026.1.29, released on January 30, 2026.

What happened

1 · What it was doingOpenClaw, an open-source autonomous AI personal assistant, runs locally on user devices and connects to messaging platforms.

2 · What went wrongThe server did not validate the WebSocket origin header, so clicking a link was enough to trigger a cross-site WebSocket hijacking attack.

3 · What it reached or didThe attacker could connect to the victim's local gateway, change sandbox and tool policies, and invoke privileged actions.

4 · How it was caughtSecurity researcher Mav Levin, credited with discovering the shortcoming, reported it.

What was done

The issue was addressed in version 2026.1.29, released January 30, 2026.

Risks

Credential and privilege abuse
Primary37 incidents

Agent escapes its sandbox
Also19 incidents

AI system attacked or breached
Also23 incidents

Read from the sources; not yet reviewed by a person.

Controls

Harness

Not effective (bypassed) Sandboxed code execution
Not effective Sandboxed code execution

Application

Not effective (bypassed) Human approval for high-impact actions

Control failure chain

L1 · Model Not stated in sourcesProvider not named

L2 · Harness Not effective (bypassed)Harness not named

L3 · Application Not effective (bypassed)Deployer not named

L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelProvider not namedModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

Not effective (bypassed)Sandboxed code execution“To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting "exec.approvals.set" to "off" and escape the container used to run shell tools by setting "tools.exec.host" to "gateway."”The Hacker News

Not effectiveSandboxed code execution“And users might think these defenses would protect from this vulnerability (or limit the blast radius), but they don't.”The Hacker News

L3 · ApplicationDeployer not namedDeployer

Not effective (bypassed)Human approval for high-impact actions“To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting "exec.approvals.set" to "off" and escape the container used to run shell tools by setting "tools.exec.host" to "gateway."”The Hacker News

Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Least-privilege access for the agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Multi-factor sign-in and password policy, Secrets scanning.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Sandboxed code execution	L2 Harness	Not effectiveNot effective (bypassed)
Human approval for high-impact actions	L3 Application	Not effective (bypassed)
Least-privilege access for the agent	L3 Application	Not stated in sources
Separate identity for each agent	L3 Application	Not stated in sources
Short-lived, scoped credentials	L3 Application	Not stated in sources
Secrets kept out of the model's context	L3 Application	Not stated in sources
Activity logs	L3 Application	Not stated in sources
Alerts on unusual tool use	L3 Application	Not stated in sources
Sensitive-data checks on outbound data	L3 Application	Not stated in sources
Multi-factor sign-in and password policy	L4 Infrastructure / target	Not stated in sources
Secrets scanning	L4 Infrastructure / target	Not stated in sources

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

2025-11 OpenClaw was initially released.
2026-01-30 Version 2026.1.29 released, addressing the issue.
2026-02-02 The flaw was disclosed in the source article.

Show every field, with its source and grade

The AI system

What it was allowed to do

operator.admin and operator.approvals scopes

C one secondary source states it

What happened

Earliest source we hold

2026-02-02

D inferred by us from the described behaviour, reason shown

Who caught it

an independent researcher or journalist

C one secondary source states it

Who caused it

an outside attacker

C one secondary source states it

What went wrong

security breach

C one secondary source states it

AI agent

an AI agent acted

C one secondary source states it

primary risk

RK03

D inferred by us from the described behaviour, reason shown

secondary risks

RK05, RK08

D inferred by us from the described behaviour, reason shown

control chain

layer: L2; party: harness vendor; control id: E1; outcome: got around; quote: To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting "exec.approvals.set" to "off" and escape the container used to run shell tools by setting "tools.exec.host" to "gateway."; source index: 0, layer: L3; party: deployer; control id: B1; outcome: got around; quote: To make matters worse, by leveraging the token's privileged operator.admin and operator.approvals scopes, the attacker can use the API to disable user confirmation by setting "exec.approvals.set" to "off" and escape the container used to run shell tools by setting "tools.exec.host" to "gateway."; source index: 0, layer: L2; party: harness vendor; control id: E1; outcome: failed; quote: And users might think these defenses would protect from this vulnerability (or limit the blast radius), but they don't.; source index: 0

C one secondary source states it

Impact

Severity

major

D inferred by us from the described behaviour, reason shown

Why this severity

Unbounded scope stated: the flaw impacts any Moltbot deployment where a user has authenticated to the Control UI. No count of affected parties is stated.

D inferred by us from the described behaviour, reason shown

Notes on gaps

The date the vulnerability occurred, the number of affected deployments or victims, and any confirmed exploitation in the wild are not stated.

LR-2026-0421 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON