OpenClaw AI Assistant Compromised via WhatsApp: Three Critical Vulnerabilities Allowed Credential Theft, Sandbox Escape, and Arbitrary Code Execution on Host
Security researchers have disclosed three serious vulnerabilities in OpenClaw that could allow attackers to steal credentials, escalate privileges, and execute arbitrary code on systems running the AI assistant. The flaws affected both home users and corporate deployments, highlighting risks associated with insufficient input validation and sandbox isolation in AI tooling.
Command Filtering Failures (CVSS 8.8)
Two of the vulnerabilities received a CVSS score of 8.8. They were caused by incomplete command filtering mechanisms that did not block all malicious inputs. As a result, an attacker could inject system commands into contexts where they should have been prohibited, enabling unauthorized actions ranging from data exfiltration to privilege escalation.
Sandbox Bypass via Directory Mounting (CVSS 8.4)
The third vulnerability, rated 8.4, allowed attackers to circumvent sandbox restrictions by mounting parent directories. Although OpenClaw blocked direct access to sensitive folders such as ~/.ssh, ~/.aws, and ~/.gnupg, it could still permit mounting of the entire /home directory. This effectively placed SSH keys, cloud tokens, and GPG secrets directly accessible to the attacker.
Further escalation was possible through the /var directory, which could grant access to the Docker socket and enable escape from the sandbox directly onto the host system. Researcher Chinmohan Nayak demonstrated that the attack could be initiated remotely via an external message sent through WhatsApp (owned by Meta, designated as extremist and banned in Russia) without requiring any prior foothold on the target machine.
Impact and Recommendations
In the worst-case scenario, an attacker could exfiltrate sensitive data, establish persistence, and execute arbitrary code on the victim’s machine. Developers addressed all three issues in OpenClaw 2026.6.6. Users are strongly advised to:
- Update to the latest version immediately
- Enable sandboxing for all secondary sessions
- Remove exec from the list of allowed tools
- Narrow the list of trusted communication channels to the minimum necessary
These measures significantly reduce the attack surface and help prevent similar exploitation attempts in the future.
Related articles
PKCE Becomes Mandatory for OAuth Public Clients as RFC 9700 and OAuth 2.1 Close Authorization Code Interception Risks
PKCE, or Proof Key for Code Exchange, was introduced in RFC 7636 to prevent code interception attacks in OAuth 2.0 flows used by mobile and single-page applications. The mechanism generates a code_verifier and derives a code_challenge using S256 hashing to bind the authorization code to the original client session. Without PKCE, malicious apps on the same device can hijack custom URI schemes like myapp://callback and exchange stolen codes for access tokens. RFC 9700, published in January 2025, now mandates PKCE for public clients and recommends it for confidential ones while requiring S256 over the weaker plain method. The upcoming OAuth 2.1 draft further embeds PKCE into the core authorization code flow and removes implicit and resource owner password credentials grants. Major providers including Auth0, Okta, and Microsoft Entra ID show varying default support, highlighting the need for explicit S256 implementation. The standard also protects against code injection attacks even when client secrets are present.
Attackers Chain JFrog Artifactory CVEs for Rapid Admin Takeover and Backdoor Deployment
Real-world attacks against self-hosted JFrog Artifactory have chained multiple CVEs to escalate from unauthenticated requests to full administrative control. Attackers achieved persistence by installing malicious Groovy plugins, executing shell commands, and deploying Rust-based backdoors within minutes. The primary chain relies on CVE-2026-42018 and CVE-2026-42016, allowing anonymous token acquisition and privilege escalation without proper scope validation. A separate critical flaw, CVE-2026-82329 with CVSS 9.8, enables direct authentication bypass and admin token creation on default configurations. Patches are available across multiple 7.x branches, and defenders are urged to audit logs for anonymous admin actions and inspect for unauthorized plugins and binaries. The incidents highlight risks to software supply chains when artifact repositories are compromised.
Check Point Patches Two Critical VPN Vulnerabilities Allowing Unauthenticated Remote Code Execution
Check Point has released fixes for two critical vulnerabilities affecting its Security Gateway, Security Management Server, and locally managed Spark Firewall products. Both flaws received a CVSS score of 9.8 and enable remote code execution without requiring authentication. CVE-2026-85102 resides in certificate trust validation during VPN negotiation, allowing an unauthenticated attacker to force the process and execute arbitrary code. CVE-2026-85103 is a heap buffer overflow triggered while parsing the ASN.1 structure of VPN certificates. Affected versions include R81.20, R82, and R82.10 before the listed hotfixes, as well as unsupported R80.40 and R81 releases. R82.20 remains unaffected. The issues were discovered internally by Check Point researchers, with no active exploitation or public proof-of-concept observed as of the September 10 disclosure.
Positive Technologies Acquires Stake in CyberOK to Advance EASM and PentOps Technologies
Positive Technologies has acquired a stake in cybersecurity developer CyberOK, with the size of the investment and deal terms remaining undisclosed. The partnership will focus on developing External Attack Surface Management (EASM) solutions and PentOps technologies that identify overlooked external assets and validate whether attackers can exploit them. Collaboration between the companies began in 2026, with CyberOK technologies already integrated into PT EASM and the PT X cloud platform. In less than six months, pilot projects for PT EASM exceeded 70, and Positive Technologies expects 80 percent of successful trials to convert into deals by late 2026 or early 2027. The Russian EASM market is projected at 2-2.5 billion rubles by the end of 2026, potentially reaching 8 billion rubles by 2031 when combined with continuous security validation solutions. PentOps will provide continuous cloud-based penetration testing that automatically verifies exploitability of discovered issues, moving beyond simple vulnerability lists. In 96 percent of pilots, unaccounted IT assets with critical vulnerabilities were identified, and CyberOK continues to develop the Vulnum knowledge base along with AI agents and Offensive SOC capabilities.