OpenClaw at a glance
OpenClaw (formerly Clawdbot and Moltbot) fixed CVE-2026-25253 in 2026.1.29: a crafted link could leak the gateway token and let an attacker run code on the host. On February 7, OpenClaw began scanning every ClawHub skill with VirusTotal to block malicious uploads.
OpenClaw: status
- Affected
- OpenClaw (npm package clawdbot) 2026.1.28 and earlier
- CVE identifiers
- Status as of
- Discovered by
- Ethiack (AI pentesting agent) and depthfirst; credited in the GHSA as 0xacb, mavlevin, and DepthFirstDisclosures · Found by an AI system
What changed with OpenClaw
The OpenClaw Control UI took a gatewayUrl value from the page's query string and connected to it automatically, sending the stored gateway token. The project's advisory says a victim who clicked a crafted link or visited a malicious site could leak that token to an attacker, who could then connect to the victim's gateway, change sandbox and tool-approval settings, and run commands on the host. Because the victim's own browser made the connection, gateways listening only on loopback were exposed too.
The advisory lists the clawdbot npm package at 2026.1.28 and earlier as affected and 2026.1.29 as patched; the UI now asks the user to confirm a new gateway URL. NVD rates the CVE 8.8 (high). Ethiack, whose researcher is credited as a finder, says its autonomous AI pentesting agent found the flaw, and depthfirst, credited as reporter, says its analysis engine flagged the data flow before a researcher built the exploit.
Days later, OpenClaw announced that every skill published to its ClawHub marketplace is scanned with VirusTotal, including the LLM-based Code Insight review. Skills judged malicious are blocked from download, suspicious ones carry a warning, and active skills are rescanned daily. OpenClaw cautions that a clean scan is a signal rather than a guarantee, since prompt-injection instructions written in plain language may not trip any signature.
How to fix it: OpenClaw
1. Update
Update OpenClaw to 2026.1.29 or later, which requires the user to confirm any new gateway URL instead of connecting automatically.
github.com (opens in a new tab)2. Monitor
Treat a clean ClawHub scan as a signal, not a guarantee: review the permissions a skill requests, start with publishers you trust, and report suspicious skills to security@openclaw.ai.
openclaw.ai (opens in a new tab)
Advisories
- GHSA-g8p2-7wf7-98mq (opens in a new tab)github.com
- NVD CVE-2026-25253 (opens in a new tab)nvd.nist.gov
Where to compare OpenClaw
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why OpenClaw matters for businesses
Personal AI agents like OpenClaw hold tokens, run shell commands, and install third-party skills, so one link or one skill can hand over a machine. Businesses testing them should update, keep agents off hosts with sensitive data, review the permissions each skill requests, and install skills only from publishers they trust.
Sources for this story
- 1-Click RCE via Authentication Token Exfiltration From gatewayUrl (opens in a new tab)Official
GitHub Security Advisory (OpenClaw) · github.com
- CVE-2026-25253 (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- OpenClaw Partners with VirusTotal for Skill Security (opens in a new tab)Official
OpenClaw Blog · openclaw.ai
- One-click RCE in Moltbot (opens in a new tab)Press
Ethiack · ethiack.com
- 1-Click RCE to steal your Moltbot data and keys (opens in a new tab)Press
depthfirst · depthfirst.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #openclaw
- #ai-agents
- #agent-skills
- #supply-chain
- #remote-code-execution