OpenClaw AI Assistant Compromised via WhatsApp: Three Critical Vulnerabilities Allowed Credential Theft, Sandbox Escape, and Arbitrary Code Execution on Host
Security researchers discovered three high-severity vulnerabilities in OpenClaw that could let attackers steal credentials, escalate privileges, and execute arbitrary code on the host system running the AI assistant. Two flaws rated 8.8 on the CVSS scale stemmed from incomplete command filtering that failed to block dangerous inputs, while a third issue rated 8.4 enabled sandbox bypass by mounting parent directories such as /home or /var. The weaknesses potentially exposed sensitive data in ~/.ssh, ~/.aws, and ~/.gnupg, and even allowed attackers to reach the Docker socket for full host escape. Notably, the attack could be triggered remotely through an external WhatsApp message without any prior system access, according to researcher Chinmohan Nayak. All issues were patched in OpenClaw version 2026.6.6, and users are urged to update immediately while tightening sandbox and tool permissions.
AntiMalware•Vulnerabilities & Exploits
