How OpenClaw could be hijacked with a simple website visit

A recently patched OpenClaw vulnerability could allow any website to hijack the AI agent when visited, Oasis Security revealed Thursday.

OpenClaw, a massively popular open-source AI assistant, runs a local WebSocket server that serves as a gateway, handling authentication and coordinating communication between the AI agent and its connected services.

This gateway is typically bound to localhost and protected with a token or password, meaning the OpenClaw agent is generally not exposed on the internet and only accepts connections from authenticated clients.

However, JavaScript that runs on a web page is able to open a WebSocket connection to localhost via the OpenClaw gateway. This alone is not a vulnerability; browsers normally allow cross-origin WebSocket connections and rely on the server to validate the connection’s origin.

Related reading:

The main vulnerability arises from a lack of rate limiting by the OpenClaw gateway on authentication attempts originating from localhost. This allows a website with malicious JavaScript to attempt to brute force the gateway’s password indefinitely with up to hundreds of attempts per second, Oasis Security demonstrated.

If the script is able to authenticate, it can then register a trusted device, giving the attacker control over the AI agent. The OpenClaw gateway automatically approves device pairings from localhost without prompting the user, meaning the attack can occur silently without the user’s awareness, Oasis explained.

“The modern web browser acts as a porous membrane, permitting untrusted, external JavaScript to bridge the gap to local services via WebSockets. By relying on a local IP address to grant immunity from rate-limiting and to silently auto-approve device pairings, the system abandons the core tenets of a zero-trust architecture,” said Jason Soroko, senior fellow at Sectigo, in an email to SC Media.

Authenticated access to the agent could allow the attacker to send messages to the large language model (LLM), potentially providing malicious instructions or requesting sensitive information, as well as retrieve gateway configuration details, enumerate other connected devices and access application logs.

This vulnerability was patched by OpenClaw within 24 hours of Oasis Security’s report, with the flaw being classified as high severity by OpenClaw’s security team. OpenClaw users should immediately update to version 2026.2.25 to remediate the flaw.

“What elevates this from a routine patching exercise to an industry warning is the blast radius of locally hosted AI agents. We are exposing autonomous workflow engines given privileges with access to local file systems, credential stores, and enterprise infrastructure,” noted Soroko.

Last month, researchers at Ethiack and Depthfirst discovered a vulnerability, tracked as CVE-2026-25253, that could similarly be used to hijack an OpenClaw agent when the user visits a malicious website. In this exploit, JavaScript on a webpage could force the victim’s browser to open a URL that causes OpenClaw to leak its gateway authentication token via a gatewayURL parameter pointed to the attacker’s server. This flaw was patched in version 2026.1.29 on January 31, 2026.