AISEC > Security News > Ai Security > ClawJacked OpenClaw AI WebSocket Vulnerability Patched
February 28, 2026 #ai-security Source: The Hacker News 2 min read · 544 words

ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket

Вразливість ClawJacked дозволяє шкідливим сайтам перехопити локальні AI агенти OpenClaw через WebSocket

Context: Why This Matters Right Now

AI agents are moving from cloud-only deployments to local machines. That shift brings speed and privacy benefits. It also brings new attack surfaces that security teams haven't fully mapped yet. And when you're running AI agents locally—connected to the web through WebSocket protocols—you're trusting that those connections are locked down. According to The Hacker News, OpenClaw just learned the hard way that they weren't.

The ClawJacked vulnerability represents exactly the kind of flaw that keeps security leaders awake: it doesn't require plugins, doesn't need user interaction, and it works against the bare system.

What We Know

OpenClaw discovered and patched a high-severity vulnerability in its core gateway that allowed malicious websites to hijack locally running AI agents through WebSocket connections. The flaw affected the standard OpenClaw deployment without requiring any extensions or add-ons—it was baked into the base product.

The vulnerability had demonstrated attack potential. This wasn't theoretical. Someone built a working exploit.

The timeline here matters: disclosure came with a patch, which suggests responsible handling. But the fact that this made it into a production release at all is worth questioning. Frankly, this should have been caught in security review before shipping.

How It Works

Here's the technical breakdown: OpenClaw's gateway handles WebSocket connections from local AI agents. These connections were supposed to be isolated and authenticated. They weren't properly validated. A malicious website—one you visit in your browser—could establish its own WebSocket connection to your local OpenClaw gateway and impersonate or control the AI agents running there.

Think about what that means.

Your browser has network access to localhost. Your AI agent runs on localhost. There was nothing stopping a JavaScript payload on a malicious site from reaching across and talking directly to your agent's gateway. The attacker doesn't need to be on your network. Doesn't need admin access. Doesn't need you to download anything. Just visit the wrong website, and the attack unfolds in the background.

And because this targets the core gateway—not a plugin layer or an optional component—every OpenClaw installation was potentially exposed.

Why It Matters

Local AI agents are increasingly handling sensitive workloads. Document processing. Code generation. Data analysis. Customer interactions. If an attacker can hijack those agents, they're not just compromising one service—they're potentially accessing the data those agents touch, manipulating outputs, and establishing persistent access to your systems.

This is particularly nasty because it's browser-based. Your endpoint protection might be excellent. Your network segmentation might be tight. But if an employee visits a compromised site or clicks a malicious ad, it's game over. The attacker gets a direct line to their AI infrastructure.

The real question is: how many organizations running OpenClaw didn't realize their local deployments were exposed to web-based attacks?

Next Steps

Update immediately. If you're running OpenClaw, treat this as critical. The patch is available—apply it without delay.

Second, audit your WebSocket implementations. Not just OpenClaw, but anywhere you're exposing local services to network access. Validate origins. Authenticate connections. Don't assume localhost is safe just because it's local.

Third, review your AI agent deployments from a threat modeling perspective. Where are they running? What data do they access? How are they exposed to the network? Build that map now, before the next vulnerability makes it urgent.

And if you haven't patched yet and someone visited a suspicious site recently, you've got incident response work ahead of you.

Read original article →

// FAQ

Do I need to update OpenClaw immediately for ClawJacked?

Yes. This is a high-severity vulnerability affecting the core gateway. Apply the patch without delay if you're running OpenClaw in production or for development.

Can attackers exploit ClawJacked without accessing my network?

Yes. Since the attack works through your web browser, an attacker can exploit it by getting you to visit a malicious website—no network access or admin privileges required.

Does the ClawJacked vulnerability require OpenClaw plugins or extensions?

No. The vulnerability exists in the bare OpenClaw system without plugins. It affects the default installation, which is what makes it particularly dangerous.

// RELATED

#ai-security ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks 2026-02-27 #ai-security In Other News: ATT&CK Advisory Council, Russian Cyberattacks Aid Missile Strikes, Predator Bypasses iOS Indicators 2026-02-27 #ai-security APT37 hackers use new malware to breach air-gapped networks 2026-02-27

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →