A Security Analysis of the OpenClaw AI Agent Framework

Summary

Three now-patched, high-severity vulnerabilities in the OpenClaw open-source AI agent framework can be chained to achieve credential theft, privilege escalation, and arbitrary code execution on the host. The flaws — GHSA-hjr6-g723-hmfm (CVSS 8.8), GHSA-9969-8g9h-rxwm (CVSS 8.8), and GHSA-575v-8hfq-m3mc (CVSS 8.4) — were all addressed in OpenClaw version 2026.6.6.^[0]

Security researcher Chinmohan Nayak, credited with discovering and reporting the issues, demonstrated that they can be combined to trigger host code execution from an external message sent via WhatsApp, without requiring the attacker to first establish a foothold. This distinguishes them from the earlier 'Claw Chain' vulnerabilities disclosed by Cyera in May 2026, which required a prior foothold.^[0]

The findings are corroborated by an academic security analysis of the OpenClaw AI agent framework (arXiv:2603.27517), which catalogs 470 advisories and reports that three Moderate/High-severity Gateway and Node-Host advisories compose into a complete unauthenticated remote code execution path from an LLM tool call to the host process, that the exec allowlist relies on a flawed closed-world lexical-parsing assumption, and that the dominant structural weakness is per-layer trust enforcement rather than unified policy boundaries.^[13]

Attack chain

1. Delivery: An attacker sends an external, lower-trust message (for example via WhatsApp) that reaches a channel-facing OpenClaw agent, allowing untrusted input to reach a privileged execution path. The academic analysis frames this as the delivery stage of an unauthenticated RCE path from an LLM tool call to the host process.^[0][13]
2. Exploitation — command filtering bypass: The exec allowlist, OpenClaw's primary command-filtering mechanism, is bypassed via OS command injection and an incomplete disallowed-input list in the host execution environment filtering mechanism (GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm). The academic analysis attributes this to a closed-world assumption invalidated by shell line continuation, busybox multiplexing, and GNU option abbreviation.^[0][13]
3. Sandbox escape via path traversal: GHSA-575v-8hfq-m3mc allows sandbox bind mounts to bypass parent-directory denylist checks. getBlockedReasonForSourcePath() checks whether the source path is under a blocked path but never the reverse, so mounting a parent directory such as /home or /var undermines individual blocks on ~/.ssh, ~/.aws, and ~/.gnupg.^[0]
4. Impact — credential theft and host escape: Mounting /home exposes every user's SSH keys, AWS credentials, and GPG secrets; mounting /var exposes the Docker socket, enabling full host escape from inside the sandbox and arbitrary code execution on the host.^[0]

Disclosure timeline

How it works

GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm are OS command injection plus incomplete-disallowed-input vulnerabilities in the host execution environment filtering mechanism, allowing execution or persistence of actions beyond the caller's intended authorization. The academic analysis explains the exec allowlist relies on a closed-world assumption that command identity is recoverable via lexical parsing — an assumption defeated by shell line continuation, busybox multiplexing, and GNU option abbreviation.^[0][13]

GHSA-575v-8hfq-m3mc is a path traversal and link-following flaw in the sandbox bind-mount logic. getBlockedReasonForSourcePath() only checks whether the source path is under a blocked path, never whether a blocked path is under the source. Because the denylist blocks specific directories (~/.ssh, ~/.aws, ~/.gnupg) but permits mounting their parents (/home, /var), mounting the parent directory undermines every individual block — exposing all users' SSH keys, cloud credentials, and GPG secrets, or the Docker socket for full host escape.^[0]

Beyond the exec pipeline, the academic analysis reports a malicious skill distributed through the plugin channel executed a two-stage dropper within the LLM context, bypassing exec filtering entirely and showing the skill-distribution surface lacks runtime policy enforcement. The paper identifies per-layer trust enforcement, rather than unified policy boundaries, as the dominant structural weakness that keeps cross-layer attacks resilient to local remediation.^[13]

Affected versions and patch status

Key takeaways

• AI agent frameworks that connect LLM reasoning to host execution surfaces introduce security challenges structurally distinct from conventional software; individually Moderate/High advisories in OpenClaw compose into a complete unauthenticated RCE path from an LLM tool call to the host.^[13]
• Command allowlists built on lexical parsing are fragile: shell line continuation, busybox multiplexing, and GNU option abbreviation all defeat the closed-world assumption that command identity can be recovered from the command string.^[13]
• Denylist-based sandbox bind-mount controls must check both directions of path containment; blocking sensitive directories while permitting their parents (e.g. /home, /var) leaves SSH keys, cloud credentials, and the Docker socket exposed.^[0]
• Per-layer trust enforcement without unified policy boundaries lets attackers chain across layers — and lets a plugin-channel skill bypass exec filtering entirely with an in-context two-stage dropper — so local per-advisory fixes are insufficient.^[13]

Defensive actions

• Upgrade OpenClaw to version 2026.6.6 or later.: All three vulnerabilities have been addressed in this release.^[0]
• Enable sandbox mode for all non-main sessions and remove 'exec' from the tool allowlist for channel-facing agents.: Reduces the exposure that lets external, lower-trust messages reach privileged host execution paths.^[0]
• Monitor for git clone commands containing the 'ext::' external protocol helper.: This helper can be abused to run arbitrary system commands as part of the exploitation chain.^[0]
• Keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and restrict or disable affected features to trusted operators before upgrading.: OpenClaw's recommended hardening; because per-layer trust enforcement makes cross-layer attacks resilient to local remediation, narrowing trust boundaries limits impact.^[0][13]