Critical ClawJacked Vulnerability Allows Remote Hijacking of OpenClaw Instances

What Happened

Security researchers disclosed a zero-click exploit that lets attackers hijack an OpenClaw instance by getting the user to visit a single webpage. The vulnerability exploited the WebSocket interface on TCP port 18789. OpenClaw patched it within 24 hours in version 2026.2.25.

According to The Hacker News, this development represents a significant moment in the OpenClaw ecosystem's rapid evolution during early 2026.

Why It Matters

Demonstrates that self-hosted AI agents face unique attack surfaces. The rapid patch response (24 hours) shows the project's security responsiveness, but the vulnerability's severity highlights the risks of running AI agents with system access.

What's Next

The OpenClaw ecosystem continues to evolve at a breakneck pace. With the project now moving to an independent foundation backed by OpenAI, the community is watching closely to see how governance, security, and growth will be balanced in the months ahead.

Related

Related directory items: openclaw, secureclaw

---

Source: The Hacker News | Published: 2026-02-26