OpenClaw Security Risks: ClawJacked Vulnerability, Malicious Extensions & Enterprise Protection Guide

Misconfigured Defaults and Exposed Management Interfaces

One of OpenClaw's most significant problems lies in its loose default security mechanisms. There are over 200,000 active OpenClaw instances worldwide — tens of thousands of them in Asia — and many developers have deployed them without proper authentication, exposing the management interface directly to the public internet. This allows attackers to easily bypass security controls and obtain full administrative privileges over the host system without any authorization, enabling them to manipulate the AI into executing malicious commands.

Zero-Click Critical Vulnerability: "ClawJacked"

Discovered by security firm Oasis Security, "ClawJacked" is an extremely dangerous critical vulnerability that allows malicious websites to silently hijack OpenClaw instances running in the background. When a user's computer is running OpenClaw, simply visiting an attacker-controlled webpage is enough — the malicious script embedded in that page can establish a WebSocket connection directly to localhost and gain control by brute-forcing the default password. Through this, attackers can steal sensitive data, extract API keys, and even leverage the AI agent to execute remote code on the victim's device.

Malicious Extensions and an Infostealer Breeding Ground

OpenClaw relies heavily on third-party Skills from its official marketplace, "ClawHub," to extend its functionality — but the marketplace suffers from a severe lack of code review mechanisms. Security researchers found that ClawHub is riddled with malicious packages disguised as legitimate tools, such as cryptocurrency trading bots or Google integration utilities. These malicious Skills trick users or the AI into downloading trojanized files — for example, AMOS (Atomic macOS Stealer), a macOS-targeting infostealer — which then exfiltrate browser passwords and cryptocurrency wallets.

Prompt Injection and Uncontrolled Behavior

Because OpenClaw holds permissions to "take action" on behalf of users, it is especially susceptible to prompt injection attacks. If OpenClaw is helping you summarize an email or reading a Slack message that contains hidden malicious instructions, an attacker can exploit this to trick the AI into bypassing its safety guardrails. This can cause the AI agent to exfiltrate confidential internal data without the user's knowledge, or trap it in an infinite loop of external API calls — resulting in catastrophic API cost overruns.

Government and Enterprise Bans

Given that these risks are exceptionally high — with a blast radius far exceeding that of conventional software vulnerabilities — multiple government agencies (including China's national cybersecurity authority) and large enterprises issued official warnings in early 2026, explicitly prohibiting employees from installing OpenClaw on work devices.

ThunderShield's Security Recommendations

While embracing the powerful automation that AI agents offer, we must never sacrifice system control or privacy in exchange. ThunderShield recommends the following:

• Update and inventory immediately: If your team has deployed OpenClaw, update it immediately to a version that patches the ClawJacked vulnerability (2026.2.26 or later), and pair this with host vulnerability detection to continuously scan your environment for other known vulnerabilities.
• Enforce strict least-privilege permissions: Audit the credentials held by your AI agents, grant only the minimum permissions required to complete each task, and conduct regular permission reviews.
• Strengthen extension vetting: Before installing any third-party ClawHub Skill, conduct rigorous code review to prevent malicious packages from entering your enterprise environment and eliminate supply chain attack risks.
• Deploy endpoint detection and response: Use EDR/MDR solutions to monitor AI agent behavior in real time — so that unexpected outbound connections or data exfiltration attempts are detected and contained quickly.
• Evaluate secure alternatives: For environments handling sensitive data, consider evaluating "local-first," sandboxed alternatives such as Stanford University's OpenJarvis, which ensure data remains on-premise and is not easily hijacked.

ThunderShield will continue monitoring the latest AI threat landscape on your behalf, ensuring your digital assets remain secure in the age of AI.