The Hacker News

OpenClaw Bug Enables One-Click Remote Code Execution via Malicious Link

A high-severity OpenClaw flaw allows one-click remote code execution via token theft and WebSocket hijacking; patched in ...

OpenClaw patches one-click RCE as security Whac-A-Mole continues

Researchers disclose rapid exploit chain that let attackers run code via a single malicious web page Security issues continue ...
腾讯网

一键触发漏洞：OpenClaw远程代码执行漏洞分析

深度安全研究团队depthfirst General Security ...
XDA Developers on MSN

Please stop using OpenClaw, formerly known as Moltbot, formerly known as Clawdbot

It could cause you a lot of problems.
SecurityWeek

Vulnerability Allows Hackers to Hijack OpenClaw AI Assistant

OpenClaw patched a critical vulnerability that could be exploited to hijack the increasingly popular AI assistant.
至顶头条 on MSN

OpenClaw修复一键远程代码执行漏洞，安全漏洞层出不穷

OpenClaw生态系统安全问题不断，多个项目修补机器人接管和远程代码执行漏洞。安全研究员发现一键RCE攻击链，攻击过程仅需毫秒级时间，受害者只需访问恶意网页即可被攻击。漏洞利用跨站WebSocket劫持攻击，因服务器未验证WebSocket源头。此外，关联项目Moltbook数据库暴露，API密钥可被公开访问，可能导致攻击者冒充任何AI代理发布内容。