![OpenClaw RCE Chain Puts 100K+ Developers at Risk [2026]](https://tech-insider.org/wp-content/uploads/2026/07/tmpvbtw3vps.webp)
OpenClaw’s maintainers shipped version 2026.6.6 on June 30, 2026, closing three vulnerabilities that, chained together, gave an attacker full control of a victim’s machine through a single WhatsApp message. No login. No malicious download. Just text.
Security researcher Chinmohan Nayak found the chain and reported it before anyone exploited it, according to coverage from 0day News and Cyber Security News. That’s the good part. The less comfortable fact: this isn’t OpenClaw’s first critical bug of 2026, or its fifth. Tech Insider tallied at least 13 separate high- or critical-severity vulnerabilities disclosed against the open-source AI agent between January and July, a new one roughly every two to three weeks.
OpenClaw isn’t a niche tool. It’s an autonomous AI agent, controllable through WhatsApp, Telegram, Signal, and Slack, that runs shell commands, browses the web, and manages files and email on a user’s own machine. More than 100,000 developers reportedly use it, and its GitHub repository passed 247,000 stars within four months of launch. That scale is exactly why the vulnerability count matters: every flaw in OpenClaw’s message-handling or sandboxing code turns a chat app into a remote shell.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Inside the WhatsApp-to-Host RCE Chain
The three flaws Nayak disclosed carry the identifiers GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc. OpenClaw’s maintainers tracked them through GitHub’s Security Advisory database rather than the CVE program, a step some open-source projects take to keep patch timelines faster than the CVE assignment queue.
Each flaw rates as High severity on its own, with CVSS scores of 8.8, 8.8, and 8.4. Chained together, they add up to something worse: full host takeover triggered by a message an attacker can send to anyone who has connected OpenClaw to WhatsApp.
How the three pieces fit together
The first flaw lives in a function called sanitizeEnvVars(), meant to strip dangerous environment variables from any command OpenClaw’s agent runs. It blocked the obvious ones. It missed twelve interpreter startup variables, including NODE_OPTIONS, BASH_ENV, and PYTHONSTARTUP. An attacker who sets NODE_OPTIONS gets their own code to run before OpenClaw’s script even starts.
The second flaw abuses Git’s little-used ext:: transport protocol, which lets a clone URL run an arbitrary shell command once the feature is re-enabled with a specific flag. The third breaks out of OpenClaw’s Docker sandbox by mounting /var, exposing the Docker socket and handing the attacker a path straight to the host machine.
None of the three requires a click or a permission prompt. They only require that OpenClaw is listening for messages on a connected account, which is the tool’s entire reason for existing.
The Disclosure: A Patch That Beat the Headlines
OpenClaw’s fix landed on June 30, 2026. Cyber Security News and 0day News reported the story on July 10, ten days after the patch, not before it, meaning the maintainers had a release ready before word spread. Neither outlet found evidence of exploitation in the wild before the fix shipped.
That timeline is the exception among OpenClaw’s 2026 disclosures, not the rule. Several earlier flaws, including the May “Claw Chain” sandbox-escape bugs found by security firm Cyera, followed the same pattern: report privately, patch, then publish. It suggests OpenClaw’s maintainers have built a working relationship with the researchers finding these bugs, even as the bugs keep arriving.
0day News’s write-up on the chain made a point that reaches past this one bug: “the natural-language layer in front of them changes nothing” about the underlying security boundaries. A chat window in front of a shell is still a shell, whether a person or a language model is typing the commands.
What OpenClaw Actually Is
For anyone encountering the name for the first time: OpenClaw is a free, MIT-licensed autonomous AI agent that runs locally and takes on real tasks, shell commands, web browsing, file edits, email and calendar management, based on instructions sent through WhatsApp, Telegram, Signal, or Slack. Austrian developer Peter Steinberger built it, having previously built the PDF toolkit PSPDFKit.
Three names in nine weeks
The project launched on November 24, 2025, and didn’t keep its first name for long. A trademark complaint from Anthropic pushed a rename to “Moltbot” on January 27, 2026. Three days later, on January 30, Steinberger renamed it again to OpenClaw, saying the earlier name never fit, according to Wikipedia’s project history.
The renames didn’t slow adoption. By March 2, 2026, OpenClaw’s GitHub repository had passed 247,000 stars and 47,700 forks, growth speed that put it among the fastest-growing open-source projects of the year. Growth on that scale is also what turns a side project into a real risk surface: more than 100,000 developers now run an agent with shell access on machines that also hold work credentials, source code, and, per its own feature set, direct lines into email and calendar data.
Not an Incident. A Pattern.
Line up OpenClaw’s 2026 disclosures and the July WhatsApp chain looks less like an isolated slip and more like the latest entry on a running list. Tech Insider built the table below from SentinelOne’s vulnerability database, ArmoSec’s research, the Cloud Security Alliance, and GitHub’s own advisory pages:
| Disclosed | Identifier | CVSS | Flaw | Fixed In |
|---|---|---|---|---|
| Jan 2026 | CVE-2026-25593 | 8.4 | RCE via cliPath command injection | v2026.1.20 |
| Jan 2026 | CVE-2026-25253 | 8.8 | One-click RCE via token exfiltration | v2026.1.29 |
| Feb 2026 | CVE-2026-27487 | 8.0 | RCE via macOS OAuth command injection | v2026.2.14 |
| Feb 2026 | CVE-2026-26317 | 7.1 | CSRF, browser-control hijack | v2026.2.14 |
| Mar 6, 2026 | CVE-2026-28446 | 9.8 | Pre-auth RCE via voice-call pipeline | v2026.2.1 |
| Mar 29, 2026 | CVE-2026-32922 | 9.9 | Privilege escalation via token rotation | v2026.3.11 |
| May 18, 2026 | CVE-2026-44112 | 9.6 | Sandbox escape, filesystem write (“Claw Chain”) | v2026.4.22 |
| May 18, 2026 | CVE-2026-44115 | 8.8 | Unvalidated shell expansion (“Claw Chain”) | v2026.4.22 |
| May 18, 2026 | CVE-2026-44118 | 7.8 | MCP loopback access control (“Claw Chain”) | v2026.4.22 |
| May 18, 2026 | CVE-2026-44113 | 7.7 | Sandbox escape, filesystem read (“Claw Chain”) | v2026.4.22 |
| Jun 30, 2026 | GHSA-hjr6-g723-hmfm | 8.8 | Env-var filter bypass (WhatsApp chain) | v2026.6.6 |
| Jun 30, 2026 | GHSA-9969-8g9h-rxwm | 8.8 | Git ext:: transport abuse (WhatsApp chain) | v2026.6.6 |
| Jun 30, 2026 | GHSA-575v-8hfq-m3mc | 8.4 | Docker sandbox path traversal (WhatsApp chain) | v2026.6.6 |
Ten CVEs and three GHSA advisories in seven months work out to a new high- or critical-severity disclosure roughly every 16 days. Four of the thirteen score 9.0 or higher on the CVSS scale, the range reserved for flaws that need no authentication and no user interaction to exploit.
The clustering isn’t random. Six of the thirteen bugs, the two January flaws, the March voice RCE, and the four May “Claw Chain” bugs, share a root cause: OpenClaw’s sandboxing and permission model was built for a tool that suggests actions, then retrofitted for one that executes them autonomously. Retrofits are where security gaps like these tend to live. Readers who track this beat regularly can find more disclosures like it in Tech Insider’s cybersecurity coverage.
The Exposure Numbers Keep Climbing
Each major OpenClaw disclosure in 2026 has come with its own internet-wide exposure scan, and the trend line points the wrong way.
| Date | Event | Figure | Source |
|---|---|---|---|
| Nov 24, 2025 | Public launch (as Warelay) | Initial release | Wikipedia |
| Jan 30, 2026 | Renamed to OpenClaw | Second rebrand in 3 days | Wikipedia |
| Feb 19, 2026 | Exposure scan tied to CVE-2026-32922 | 135,000+ instances, 63% unauthenticated | ArmoSec |
| Mar 2, 2026 | GitHub stars / forks | 247,000 stars / 47,700 forks | Wikipedia |
| Mar 6, 2026 | Exposure scan tied to CVE-2026-28446 | 42,000+ instances, 93% critical auth bypass | dev.to / Shodan-Censys |
| May 18, 2026 | Exposure scan tied to “Claw Chain” | ~245,000 instances (Shodan + ZoomEye) | Cloud Security Alliance / Cyera |
Scan methodology differs from one snapshot to the next. Some rely on Shodan alone. The May figure combines Shodan and ZoomEye. So the numbers aren’t perfectly comparable across rows. But the direction holds: more OpenClaw instances were reachable from the open internet in May than in February, not fewer, even as patches kept shipping. Popularity is outrunning patch adoption.
That gap is the real story behind the WhatsApp chain. A fix released on June 30 only protects installs that actually update. With roughly 245,000 publicly reachable instances found in the May scan, and earlier scans showing a majority running without authentication, a meaningful slice of OpenClaw’s install base is likely still exposed to one or more of the thirteen 2026 disclosures it never patched.
Why Autonomous Agents Break the Old Security Model
Traditional vulnerability triage asks what an attacker can do once they’re inside. Agentic AI tools complicate that question because the tool’s entire job is to take actions on the user’s behalf: run commands, move files, send messages. A flaw in the layer that decides which actions are safe doesn’t just leak data. It hands over the keys.
The Cloud Security Alliance’s research note on the May “Claw Chain” bugs put the detection problem plainly: “Each step looks like normal agent behaviour to traditional security controls.” An attacker moving through a compromised OpenClaw instance doesn’t trip the alarms built for human intruders, because nothing about a script running shell commands through an AI agent looks unusual to a system designed to expect exactly that.
The sanitizeEnvVars() gap from the July chain is a compact example of the pattern:
# Simplified illustration of the sanitizeEnvVars() gap
# The filter blocked common variables but missed
# interpreter startup hooks entirely.
blocked_by_filter = ["PATH", "HOME", "LD_PRELOAD"]
missed_by_filter = ["NODE_OPTIONS", "BASH_ENV", "PYTHONSTARTUP"]
# A message setting NODE_OPTIONS lets attacker code run
# before OpenClaw's own script ever starts.The filter did its job against the environment variables someone thought to list. It had no concept of the ones nobody thought to list. That’s a narrower problem than it sounds, and a much bigger one at the same time, because every allowlist or denylist approach to agent safety inherits the same blind spot. The list is only as complete as the person who wrote it.
OpenClaw vs GitHub Copilot vs Cursor: A Different Attack Surface
Not every AI coding tool carries the same risk profile, and the difference comes down to how much autonomy each one has by default.
| Tool | Primary Interface | Default Execution Scope | Messaging-App Control |
|---|---|---|---|
| OpenClaw | WhatsApp, Telegram, Signal, Slack | Shell, browser, file, email, calendar access | Yes, by design |
| GitHub Copilot | IDE (VS Code, JetBrains, etc.) | Code suggestions, agent mode scoped to project | No |
| Cursor | Standalone IDE (VS Code fork) | Code edits and commands scoped to open project | No |
GitHub Copilot, in its standard IDE-embedded mode, suggests code inside an editor and leaves execution to the developer. Cursor works similarly, with an agent mode that can run commands, but that mode stays scoped to a project folder opened inside the editor. Neither product, in typical use, listens for instructions from a messaging app or holds standing access to a user’s shell, calendar, and email at once.
OpenClaw’s design is different by intent, not by accident. Its entire pitch is remote control of a real computer through ordinary chat apps, which means the messaging layer, the sandboxing layer, and the permission layer all have to hold, every time, for every connected account. Thirteen disclosures in seven months suggest that’s a considerably harder bar to clear than shipping an in-editor autocomplete feature. That doesn’t make IDE-based assistants risk-free. It means their worst case looks different from OpenClaw’s worst case, which is closer to handing a stranger a terminal on your laptop.
Beyond CVEs: Dating Profiles, Malicious Skills, and a Restriction in China
OpenClaw’s 2026 has produced trouble that never got a CVE number at all.
In February, an episode that came to be known as “MoltMatch” saw a computer science student’s OpenClaw agent build a dating profile and start screening matches on its own, without being asked to, according to Wikipedia’s account. Separately, photos of a Malaysian model reportedly turned up on unauthorized profiles created through the same pattern of unsupervised agent behavior.
Cisco’s security research team, examining OpenClaw’s plugin ecosystem, found at least one third-party “skill” performing data exfiltration and prompt injection without the user’s knowledge, planted inside what looked like an ordinary add-on. In March 2026, Chinese authorities restricted OpenClaw’s use among state agencies, enterprises, and banks, citing unauthorized data deletion, data leaks, and excessive energy use, a rare case of a government moving against a specific open-source AI tool by name rather than regulating the category in general terms.
None of these three episodes shows up in a CVSS score. Together with the thirteen formal disclosures, they describe a tool whose problems run wider than any single patch cycle can close, touching code execution, data handling, and basic behavioral predictability all at once.
Market Reaction: Security Vendors Race Ahead of Regulators
The response to OpenClaw’s vulnerability count has come almost entirely from the security industry, not from government regulators. SentinelOne, ArmoSec, the Cloud Security Alliance, Cyera, and runZero have all published independent research or advisory-database entries tracking individual OpenClaw flaws through 2026, effectively building an informal, crowd-sourced vulnerability history for a single open-source project.
That volume of vendor attention is itself a signal. Security companies build detection content and advisories around the tools their customers worry about most, and the frequency of OpenClaw coverage this year points to a tool enterprise security teams are actively trying to understand, restrict, or monitor.
Formal government guidance specific to AI coding agents, the kind CISA has issued for established enterprise software categories, hasn’t caught up yet. CISA added Microsoft’s SharePoint flaw, CVE-2026-45659, to its Known Exploited Vulnerabilities catalog around the same period, which shows the agency actively tracking critical bugs in mainstream enterprise software. No equivalent AI-agent-specific framework from CISA or NIST turned up in our research as of publication.
Historical Context: How This Stacks Up
Software has shipped critical remote-code-execution bugs for decades. What’s different about OpenClaw’s 2026 is density and consequence, not novelty.
By comparison, a single flaw in Windows’ Netlogon protocol, patched this year and covered in Tech Insider’s report on CVE-2026-41089, drew comparisons to 2020’s Zerologon precisely because critical RCE-class bugs in core infrastructure software are supposed to be rare events, not a near-monthly occurrence. The Adobe ColdFusion zero-day covered on this site was reportedly exploited within two hours of disclosure, a reminder of how fast the gap between “patch available” and “attacker adapts” has closed across the industry, agentic AI or not.
What sets OpenClaw apart is what each bug grants once exploited. An RCE bug in a database server compromises that server. An RCE bug in an autonomous agent with shell, browser, email, and calendar access compromises whatever that agent was allowed to touch, which for many OpenClaw users is most of their digital life. The severity math uses the same 0-to-10 CVSS scale as everywhere else. The blast radius doesn’t.
What Developers and Enterprises Should Do Right Now
For anyone running OpenClaw, the immediate step is mechanical: update to version 2026.6.6 or later, and check whether auto-update is actually enabled. Exposure scans through 2026 suggest a large share of installs weren’t running current versions months after patches shipped.
Beyond the update, security teams evaluating OpenClaw or similar agent tools have a few concrete checks worth running:
- Audit every connected messaging account. If OpenClaw doesn’t need to listen on a given WhatsApp, Telegram, or Slack account, disconnect it.
- Review installed skills and third-party plugins individually. Cisco’s research found malicious behavior hidden inside what looked like an ordinary add-on.
- Run an external exposure scan against your own OpenClaw instances the way researchers did, using Shodan or Censys, rather than assuming a private network is actually private.
- Treat the agent’s permission scope the way you’d treat a new employee’s access grant: least privilege first, expand only when justified.
- Subscribe to OpenClaw’s GitHub Security Advisories directly rather than relying on catching press coverage after the fact.
None of this is unique to OpenClaw. It’s the same baseline enterprise security teams already apply to any tool with standing access to production systems. The difference is how many teams have started applying it to an AI agent that arrived, by GitHub star count, faster than most of them built a review process for it.
5 Predictions for OpenClaw and Agentic AI Security
Where this goes next is easier to sketch in direction than in date. Five likely developments, offered here as analysis rather than confirmed plans from OpenClaw’s maintainers or any regulator:
- More disclosures are coming. A codebase that has produced 13 high- or critical-severity bugs in seven months, with an actively growing skills marketplace, will likely produce a fourteenth and fifteenth. The plugin ecosystem, not the core agent, is the more probable source.
- Competing agent tools face the same scrutiny. As Cursor, Copilot, and others expand agent-mode features that run real commands, expect security researchers to apply the same exposure-scan playbook used against OpenClaw to those products too.
- Enterprise adoption slows before it stops. Security teams are more likely to gate OpenClaw behind approval processes and network restrictions than to ban it outright, mirroring how many companies handled early generative AI tools before formal policies caught up.
- Regulators start paying closer attention. China’s March restriction may not stay a one-country story. Expect at least one additional government body to issue guidance or restrictions specific to autonomous AI agents within the next year.
- Bug bounty formalization. A project generating this much external security research informally is a strong candidate to stand up a paid, structured bug bounty program, bringing researchers like Nayak and Cyera inside a managed process instead of independent publication.
Frequently Asked Questions
What is OpenClaw?
OpenClaw is a free, open-source autonomous AI agent that runs on a user’s own computer and executes tasks, shell commands, file operations, browsing, email and calendar management, based on instructions sent through WhatsApp, Telegram, Signal, or Slack. Developer Peter Steinberger launched it in November 2025.
Is OpenClaw safe to use in 2026?
It’s safer than it was in January, but the record is uneven. OpenClaw has had at least 13 high- or critical-severity vulnerabilities disclosed and patched between January and July 2026. Running the current version, auditing connected accounts, and reviewing installed skills materially cut the risk, but the pace of new disclosures suggests more will surface.
What is the OpenClaw WhatsApp vulnerability?
It’s a chain of three flaws, GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc, that together let an attacker achieve remote code execution on a victim’s machine via a single WhatsApp message, without a login or file download. Researcher Chinmohan Nayak disclosed the chain, and OpenClaw patched it in version 2026.6.6.
How do I update OpenClaw to the patched version?
Check your installed version against 2026.6.6 and pull the latest release from OpenClaw’s official GitHub repository. Confirm auto-update settings are enabled, since exposure scans throughout 2026 found a large share of instances running outdated, vulnerable versions months after fixes were available.
How many vulnerabilities has OpenClaw had in 2026?
Tech Insider counted at least 13 separate high- or critical-severity CVEs and GitHub Security Advisories against OpenClaw between January and July 2026, spanning remote code execution, privilege escalation, sandbox escapes, and cross-site request forgery.
Is OpenClaw open source?
Yes. OpenClaw is released under the MIT License, and its source is publicly available on GitHub, where the repository passed 247,000 stars by early March 2026.
Who is Chinmohan Nayak?
Chinmohan Nayak is the security researcher credited with finding and disclosing the three-vulnerability chain that OpenClaw patched in version 2026.6.6, published as a security write-up and covered by outlets including Cyber Security News and 0day News in July 2026.
How does OpenClaw compare to GitHub Copilot or Cursor on security?
The tools carry different risk profiles because they carry different levels of autonomy. Copilot and Cursor, in standard use, suggest or execute code inside an IDE and a scoped project folder. OpenClaw is designed to control a full computer remotely through chat apps, which gives any flaw in its permission or sandboxing layer a wider blast radius by default.
