OpenClaw AI Flaw Allows Malicious Site Hijacking

Security researchers at Oasis Security have disclosed a high-severity vulnerability in the OpenClaw AI assistant that allowed malicious websites to silently hijack users' local installations, potentially granting attackers full control over the tool's functions. The flaw, dubbed ClawJacked, was patched by the OpenClaw team within 24 hours of notification, with users urged to update to version 2026.2.25 or later to mitigate risks.

OpenClaw is an open-source, self-hosted AI agent framework popular among developers for automating tasks such as summarizing conversations, scheduling meetings, executing code, and managing calendars. It integrates with messaging apps like WhatsApp, Telegram, and Discord, as well as browsers and system resources. The platform operates through a local WebSocket server, known as the gateway, which handles authentication, manages chat sessions, stores configurations, and orchestrates the agent's actions. Connected devices, or nodes—such as macOS apps, iOS devices, or other machines—register with the gateway to expose capabilities like running system commands, accessing cameras, or reading contacts.

The vulnerability stemmed from the gateway's default...