Study: Critical Exploit in Openclaw Allows Full Administrative Hijacking

The ‘Trusted Environment’ Fallacy

A March 31 study by Web3 security firm Certik has pulled back the curtain on a “systemic collapse” of security boundaries within Openclaw, an open-source artificial intelligence (AI) platform. Despite its rapid ascent to more than 300,000 Github stars, the framework has accumulated more than 100 CVEs and 280 security advisories in just four months, creating what researchers call an “unbounded” attack surface.

The report highlights a fundamental architectural flaw: Openclaw was originally designed for “trusted local environments.” However, as the platform’s popularity exploded, users began deploying it on internet-facing servers—a transition the software was never equipped to handle.

According to the study report, researchers identified several high-risk failure points that jeopardize user data, including the critical vulnerability, CVE-2026-25253, which allows attackers to seize full administrative control. By tricking a user into clicking a single malicious link, hackers can steal authentication tokens and hijack the AI agent.

Meanwhile, global scans revealed more than 135,000 internet-exposed Openclaw instances across 82 countries. Many of these had authentication disabled by default, leaking API keys, chat histories and sensitive credentials in plaintext. The report also asserts that the platform’s repository for user-shared “skills” has been infiltrated by malware and hundreds of these extensions were found to be bundling infostealers designed to siphon saved passwords and cryptocurrency wallets.

Furthermore, attackers are now hiding malicious instructions within emails and webpages. When the AI agent processes these documents, it can be forced to exfiltrate files or execute unauthorized commands without the user’s knowledge.

“Openclaw has become a case study in what happens when large language models stop being isolated chat systems and start acting inside real environments,” said a lead auditor from Penligent. “It aggregates classic software defects into a runtime with high delegated authority, making the blast radius of any single bug massive.”

Mitigation and Safety Recommendations

In response to these findings, experts are urging a “security-first” approach for both developers and end users. For developers, the study recommends establishing formal threat models from day one, enforcing strict sandbox isolation and ensuring that any AI-spawned subprocess inherits only low-privilege, immutable permissions.

For enterprise users, security teams are urged to use endpoint detection and response (EDR) tools to locate unauthorized Openclaw installations within corporate networks. On the other hand, individual users are encouraged to run the tool exclusively in a sandboxed environment with no access to production data. Most importantly, users must update to version 2026.1.29 or later to patch known remote code execution (RCE) flaws.

While Openclaw’s developers recently partnered with Virustotal to scan uploaded skills, Certik researchers warn this is “no silver bullet.” Until the platform reaches a more stable security phase, the industry consensus is to treat the software as inherently untrusted.

FAQ ❓

• What is Openclaw? Openclaw is an open‑source AI framework that quickly grew to 300,000+ GitHub stars.
• Why is it risky? It was built for trusted local use but is now widely deployed online, exposing major flaws.
• What threats exist? Critical CVEs, malware‑infected extensions, and 135,000+ exposed instances across 82 countries.
• How can users stay safe? Run only in sandboxed environments and update to version 2026.1.29 or later.