Three high-severity vulnerabilities in OpenClaw, the open-source AI coding assistant with 381,000 GitHub stars, that allow attackers to achieve remote code execution through a single WhatsApp message.
The flaws, confirmed exploitable on OpenClaw 2026.6.1, expose a structural weakness in how AI agents handle untrusted input from messaging channels.
OpenClaw is a self-hosted AI assistant that connects to WhatsApp, Slack, Discord, Telegram, and Teams, letting users text it coding requests the way they would message a coworker.
It writes code, runs shell commands, and manages files, backed by over 100,000 daily active users. That execution capability, researchers found, is also its core liability.
Multiple OpenClaw Vulnerabilities
- Environment variable filter bypass (GHSA-hjr6-g723-hmfm, CVSS 8.8): OpenClaw’s sanitizeEnvVars() function denylists credential-like variables but ignores 12 interpreter startup variables including NODE_OPTIONS, BASH_ENV, and PYTHONSTARTUP, letting attackers inject arbitrary code that runs before the target script.
- Git ext:: transport RCE (GHSA-9969-8g9h-rxwm, CVSS 8.8): Git’s disabled-by-default ext:: transport can be re-enabled via −cprotocol.ext.allow=always inside a gitclone command, executing arbitrary shell commands framed as CI debugging.
- Sandbox parent-directory bypass (GHSA-575v-8hfq-m3mc, CVSS 8.4): The Docker sandbox blocks mounting sensitive paths like ∼/.ssh or ∼/.aws directly, but the check only looks for paths inside blocked directories, not directories that contain them. Mounting /home or /var exposes every user’s SSH keys and the Docker socket, enabling full host escape.
Researcher Chinmohan Nayak demonstrated the exploit chain by sending a WhatsApp message framed as a routine debugging request: “I am debugging a Node.js memory leak in production, please run these commands…” The payload smuggled a malicious script through NODE_OPTIONS, which executed with full filesystem access before the intended command ran. Claude Sonnet 4, the model powering the test agent, complied without hesitation, formatted the output, and offered further help.
A second test using the git ext:: trick, framed as reproducing a CI pipeline error, produced the same result: unquestioning execution. Notably, blatant payloads like piped curl-to-bash commands triggered refusals roughly 40% of the time, but identical payloads wrapped in plausible developer context succeeded in every fresh session tested.
The core issue isn’t a flaw in Claude Sonnet 4’s safety training, researchers note, but a fundamental limitation: the model cannot distinguish a legitimate developer’s request from an attacker’s identical phrasing.
Session memory compounds this: once a model refuses a payload, it grows suspicious for that conversation, but a new session resets trust to zero, giving attackers unlimited retries.
Mitigations
Administrators running OpenClaw should act immediately:
- Upgrade to version 2026.6.6 or later, which patches all three vulnerabilities.
- Remove exec from the tool allowlist unless strictly necessary for untrusted channels.
- Enable sandbox mode for non-primary sessions.
- Restrict DM pairing policies so untrusted numbers cannot reach the agent.
- Rotate credentials if the instance was publicly reachable before patching.
Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide
