AI Risk Wire

Cases › security breach › LR-2026-0551

Claw Chain vulnerabilities expose OpenClaw deployments to attack

Preliminary Why: 1 report: Cyber Security News · subject to change · 1 independent report

Status: fix reported

Severity moderate
Reported 15 May 2026
Agent tool OpenClaw

No source states: loss or records, developer and model, could do, deployer, industry.

Severity moderate: Test: data or systems of others touched, with a bounded scope stated. Fact: an estimated 245,000 publicly accessible server instances are exposed, a stated count, but no compromise of them is stated.

Researchers at Cyera reported four vulnerabilities in OpenClaw, an open-source platform for autonomous AI agents that connects language models to filesystems, SaaS applications, credentials and execution environments. The flaws, which Cyera named Claw Chain, include a sandbox escape through a race condition, credential leakage through environment variables, privilege escalation via a client-controlled ownership flag, and symbolic-link access to files outside the allowed root. Chained from a single foothold, they could allow credential theft and persistent backdoors. Cyera disclosed the flaws to OpenClaw maintainers in April 2026, and all four have since been patched. Shodan and ZoomEye scans as of May 2026 counted roughly 245,000 publicly accessible instances.

What happened

1 · What it reached or didScans as of May 2026 counted roughly 245,000 publicly accessible OpenClaw instances.
2 · How it was caughtCyera’s research team identified the flaws and disclosed them to OpenClaw maintainers in April 2026.

What was done

All four vulnerabilities have since been patched.
Fix reported

“All four have since been patched.”

Known flaws patched

Risks

AI system attacked or breached
Primary23 incidents
Credential and privilege abuse
Also37 incidents
Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Evidence

No source states: what the AI was doing, what went wrong, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 4 items from the primary sources

What happened, in order

  1. late 2025 OpenClaw, originally launched as Clawdbot, begins to be developed and offered.
  2. 2026-04 Cyera discloses the four vulnerabilities to OpenClaw maintainers.
  3. 2026-05 Shodan and ZoomEye scans count roughly 245,000 publicly accessible OpenClaw instances.
  4. 2026-04-23 Fixes covering the four vulnerabilities are dated April 23, 2026.
Show every field, with its source and grade

The AI system

Software around the model
OpenClaw
C one secondary source states it
What it was for
IT automation, customer service pipelines, and operational integrations
C one secondary source states it

What happened

Earliest source we hold
2026-05-15
D inferred by us from the described behaviour, reason shown
Cause in detail
A time-of-check/time-of-use (TOCTOU) race condition in the OpenShell sandbox allows attackers to redirect write operations outside the sandbox boundary
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown
secondary risks
RK03, RK04
D inferred by us from the described behaviour, reason shown
remediations
kind: fix; controls added: J1; quote: All four have since been patched.; source index: 0
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
Approximately 245,000 publicly accessible OpenClaw server instances (about 65,000 Shodan and 180,000 ZoomEye) as of May 2026
C one secondary source states it
Why this severity
Test: data or systems of others touched, with a bounded scope stated. Fact: an estimated 245,000 publicly accessible server instances are exposed, a stated count, but no compromise of them is stated.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The sources state no date of occurrence, no confirmed in-the-wild exploitation, and no affected organisation; the chain is described as possible, not observed. The 245,000 figure is an estimate summing two scans, and the sources do not say how many of those instances were compromised. Remediation controls J1 and A1 are my mapping of the patch and advice.

LR-2026-0551 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON