The ClawJacked flaw is a critical security vulnerability in the OpenClaw (formerly Moltbot/Clawdbot) AI agent that allows malicious websites to take full control of locally running agents. Discovered by researchers at Oasis Security, the vulnerability exploits a breakdown in the trust model for local WebSocket connections.

How the Attack Works

The flaw stems from the way the OpenClaw gateway—a local WebSocket server—handles connections from the browser:

• Implicit Trust: The gateway traditionally assumes that any connection originating from localhostis safe.
• WebSocket Hijacking: Modern browsers allow external websites to open WebSocket connections to local services. A malicious site can use a victim’s browser as a “bridge” to reach the local OpenClaw gateway silently.
• Brute-Force Gateway: Because localhost connections often bypass rate limits, a malicious site can rapidly brute-force the gateway’s password.
• Full Hijacking: Once connected, the attacker can silently pair a new “trusted device,” gain administrative control, and execute arbitrary commands on the victim’s machine.

Impact and Scope

• Zero-Click: The attack can be triggered simply by a user visiting a malicious webpage; no further interaction is required to initiate the hijack.
• Privilege Escalation: Attackers can exfiltrate sensitive data, enumerate local systems, and interact with the AI agent’s broad permissions (terminal access, file management).
• Vulnerability Status: This high-severity issue was patched in late February 2026.

How to Protect Your System

1. Update OpenClaw: Ensure you are running version 2026.2.15 or later, which includes critical hardening against these attacks.
2. Verify Gateway Settings: Check that your gateway is not bound to 0.0.0.0 (making it accessible to the public internet) and has a strong, non-default password.
3. Monitor Local Ports: Use tools like the OpenClaw Doctor to check for misconfigured sandboxes or missing authentication.