OpenClaw Exploit / Security Flaw CVE-2026-25253(ClawJacked)- Malicious Websites Can Take Over Agents скачать в хорошем качестве

OpenClaw Exploit / Security Flaw CVE-2026-25253(ClawJacked)- Malicious Websites Can Take Over Agents

The OpenClaw vulnerability, tracked as CVE-2026-25253 and known as ClawJacked, is a confirmed security flaw that allows malicious websites to take over locally running AI agents. This exploit occurs because of how the software handles web connections and authentication tokens. When OpenClaw users visit a malicious or compromised webpage, hidden scripts can automatically attempt to connect to the agent's local gateway on their computer. In older versions of the software, the system often trusted these local connections or could be tricked into sending its secret authentication token to an attacker's server. Because browsers do not always block these types of background connections to a user's own machine, the attack can happen silently without any visible warning. Once a connection is established, an attacker effectively gains the same power as the user. They can instruct the AI agent to read private files, steal stored API keys for other services, or execute terminal commands directly on the computer. This is particularly dangerous because OpenClaw agents are often given broad permissions to automate tasks across a user's entire system. OpenClaw users should be highly concerned if they are running any version older than 2026.2.25. Versions released before late February 2026 are considered vulnerable to this "one-click" takeover. Users of the software are urged to update to the latest version immediately to enable new security features like origin validation and connection prompts. In addition to updating, OpenClaw users should rotate any API keys or passwords that were stored within the agent, as those credentials may have been exposed. It is also recommended to run the agent in a restricted sandbox environment to ensure that even if a session is compromised, the attacker cannot access the rest of the computer.