The Hacker News

OpenClaw Bug Enables One-Click Remote Code Execution via Malicious Link

A high-severity OpenClaw flaw allows one-click remote code execution via token theft and WebSocket hijacking; patched in ...

OpenClaw patches one-click RCE as security Whac-A-Mole continues

Researchers disclose rapid exploit chain that let attackers run code via a single malicious web page Security issues continue ...
XDA Developers on MSN

Please stop using OpenClaw, formerly known as Moltbot, formerly known as Clawdbot

It could cause you a lot of problems.
腾讯网

一键触发漏洞：OpenClaw远程代码执行漏洞分析

深度安全研究团队depthfirst General Security ...
SecurityWeek

Vulnerability Allows Hackers to Hijack OpenClaw AI Assistant

OpenClaw patched a critical vulnerability that could be exploited to hijack the increasingly popular AI assistant.
至顶头条 on MSN

OpenClaw修复一键远程代码执行漏洞，安全漏洞层出不穷

OpenClaw生态系统安全问题不断，多个项目修补机器人接管和远程代码执行漏洞。安全研究员发现一键RCE攻击链，攻击过程仅需毫秒级时间，受害者只需访问恶意网页即可被攻击。漏洞利用跨站WebSocket劫持攻击，因服务器未验证WebSocket源头。此外，关联项目Moltbook数据库暴露，API密钥可被公开访问，可能导致攻击者冒充任何AI代理发布内容。