On 31 January 2026, the maintainers of OpenClaw, the fast-growing open-source personal AI agent formerly known as Clawdbot and Moltbot, published an advisory for CVE-2026-25253, a one-click remote code execution flaw. A crafted link could make the agent's web control panel send its authentication token to an attacker, who could then run arbitrary code on the machine hosting the agent, even when the service listened only on localhost. Within weeks, security researchers were also reporting malicious "skills" in OpenClaw's plugin ecosystem, and Microsoft advised that the agent should not run on ordinary work machines at all. Together, these reports became an early lesson in what happens when autonomous agents with real credentials spread faster than their security controls.

Key Facts#

  • Vulnerability: CVE-2026-25253, "1-Click RCE via Authentication Token Exfiltration From gatewayUrl," rated high severity with a CVSS 3.1 score of 8.8 (CWE-668).
  • Affected versions: The clawdbot npm package at version 2026.1.28 and earlier. The fix shipped in 2026.1.29.
  • Disclosure: Published on 31 January 2026 and added to the GitHub Advisory Database on 2 February 2026. The report is credited to DepthFirstDisclosures, with 0xacb and mavlevin as finders.
  • Malicious skills: In early February 2026, VirusTotal researchers reported malicious packages disguised as OpenClaw skills, according to Google's threat intelligence group.
  • Microsoft guidance: On 19 February 2026, Microsoft said OpenClaw should be treated as "untrusted code execution with persistent credentials" and run only in isolated environments.
  • Scale: OpenClaw is MIT-licensed, developed by the nonprofit OpenClaw Foundation, and connects to more than 20 messaging platforms. Its GitHub repository showed about 390,000 stars in September 2026.

What Happened#

OpenClaw runs locally as a gateway that links a language model to a user's chat apps, files and accounts, with a browser-based Control UI for configuration. According to the advisory, the Control UI accepted a gatewayUrl query parameter without validating it and connected automatically when the page loaded, sending the stored gateway token in the WebSocket connection payload. An attacker only had to persuade a user to click a crafted link. With the token, the attacker gained operator-level access, which allowed them to change sandbox settings and tool policies and execute code on the host.

The advisory notes a detail that many developers get wrong: binding a service to the loopback interface did not help, because the victim's own browser made the outbound connection. The fix requires users to confirm any new gateway URL before the interface connects to it.

The CVE was only the start. Google's May 2026 threat report describes malicious packages masquerading as OpenClaw skills, with hidden routines that could execute code, download further payloads and steal local data using the broad access users grant the agent. It also observed threat actors experimenting with OpenClaw as part of their own vulnerability research workflows.

Background#

Microsoft's February analysis explains why agents like OpenClaw change the security model. The runtime ingests untrusted text, downloads and runs skills from external sources such as ClawHub, its public skills registry, and acts with the credentials it has been given. Microsoft describes two supply chains converging in one execution loop: untrusted code in the form of skills and untrusted instructions arriving through messages and shared feeds. It highlights Moltbook, an agent-focused platform where agents post and read content through APIs, as a channel where one malicious post could reach many agents at once.

Microsoft's recommended minimum posture for anyone who still wants to evaluate OpenClaw is strict: use a dedicated virtual machine or physical device that is not used for daily work, give the agent dedicated, non-privileged credentials and only non-sensitive data, monitor its saved state for unexpected rules, back up state and treat rebuilding as a routine control. OpenClaw's own README makes related points, including that inbound messages should be treated as untrusted and that tools run on the host by default unless sandboxing is configured.

Security work on the project has continued. By September 2026, its GitHub security advisory list ran to dozens of pages, including a September advisory about an OpenAI-compatible transport that could send provider credentials to the wrong endpoint.

Why It Matters for Developers#

Many .NET developers try personal agents on the same laptop that holds GitHub tokens, Azure CLI sessions and NuGet API keys. This episode is a strong argument against that.

  • Isolate agents that can run code. Use a separate VM, container or device with its own identities, and assume it will eventually process malicious input.
  • Treat skills and plugins as executable dependencies. Review them, pin versions and restrict install sources, just as you would for NuGet packages. The supply chain security interview guide covers the practices.
  • Do not trust localhost as a boundary. Browser-initiated connections, cross-site WebSocket requests and redirects all reach local services. Validate origins and require explicit confirmation before connecting to a new endpoint.
  • Scope credentials to their destination. Both the CVE and the later credential-routing advisory come down to tokens being sent somewhere they did not belong.

If your own tools attach bearer tokens to outgoing requests, a small handler can make sure a token is only ever sent to the origin it was issued for:

C#
public sealed class ScopedTokenHandler(
    Uri trustedOrigin, Func<CancellationToken, ValueTask<string>> getToken) : DelegatingHandler
{
    protected override async Task<HttpResponseMessage> SendAsync(
        HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var sameOrigin = request.RequestUri is { } uri && Uri.Compare(uri, trustedOrigin,
            UriComponents.SchemeAndServer, UriFormat.Unescaped,
            StringComparison.OrdinalIgnoreCase) == 0;

        if (sameOrigin)
        {
            request.Headers.Authorization = new("Bearer", await getToken(cancellationToken));
        }

        return await base.SendAsync(request, cancellationToken);
    }
}

For deeper background, see the AI agent patterns guide and the Responsible AI and LLM security guide.

What's Next#

OpenClaw's advisory stream suggests that security fixes will keep arriving as the project grows, so anyone running it should update frequently and follow the project's security and sandboxing guides. The broader question is whether self-hosted agent ecosystems can adopt the controls Microsoft recommends, such as vetted skill sources, scoped identities and monitored state, without losing the ease of setup that made them popular. That remains open, and until it is answered, isolation is the safest default.

Sources#