ClawJacked: websites could brute-force and hijack local OpenClaw agents

Oasis Security found that any web page open in your browser could take over a locally running OpenClaw AI agent. The page didn't need an exploit chain or any clicks. It just used JavaScript to open a WebSocket to the agent's gateway on localhost and guess the password at hundreds of attempts per second. Because so many developers now run agents with shell access on their laptops, the pattern behind "ClawJacked" is worth understanding even if you don't use OpenClaw.

What happened

OpenClaw is a self-hosted AI agent platform. A local gateway connects the agent to messaging apps, files and paired "nodes" where it can run commands. Oasis Security reported a chain of weaknesses in that gateway, together with proof-of-concept code. The OpenClaw maintainers rated it high severity and fixed it in under 24 hours. The fix shipped in OpenClaw 2026.2.26 on 26 February 2026, and the research was made public in the following days. No CVE identifier was cited in the coverage.

The chain had three links:

1. Reachable from any site. The gateway listens on localhost and exposes a WebSocket interface. Browsers don't stop a page from opening WebSocket connections to 127.0.0.1, so a malicious site can talk to the gateway directly.
2. No throttling for loopback. Connections from localhost were exempt from rate limiting, and failed logins weren't logged. Oasis measured hundreds of password guesses per second from browser JavaScript, which is fast enough to break a typical human-chosen password.
3. Silent trust. Device pairing requests from localhost were approved automatically. After guessing the password, the script could register itself as a trusted device without any prompt.

With that admin session an attacker could read configuration and logs, list connected nodes, pull credentials, search message histories, exfiltrate files and run shell commands on paired machines. All of this could come from one open tab.

Who is affected

• Anyone running an OpenClaw gateway older than 2026.2.26, especially on a workstation that is also used for everyday browsing.
• Organizations with unmanaged agent installs. Developers often set up OpenClaw and similar tools without IT knowing, which makes patch coverage hard to measure.
• Systems paired to the agent: servers, other laptops and the messaging accounts it can use.

What it means for developers and engineering teams

"It only listens on localhost" is not a security boundary when a browser runs on the same machine. The same-origin policy and CORS control what a page can read from HTTP responses. They don't stop a page from opening a WebSocket to a local port, and the WebSocket handshake doesn't enforce CORS. The server is responsible for checking the Origin header. Any local dev server, agent, MCP bridge or desktop helper that exposes a WebSocket or HTTP API therefore needs its own authentication and origin checks.

ClawJacked also shows two anti-patterns that are common in developer tooling:

• Treating loopback as trusted. Exempting 127.0.0.1 from rate limits, logging or approval prompts assumes that only the local user can produce local traffic. Browsers break that assumption.
• Weak secrets on powerful endpoints. A password a person chose is fine behind strict throttling and terrible without it. Local agents should use long random tokens, pairing codes shown in the UI, or OS-level IPC instead of a TCP port.

For teams building agent tooling: reject WebSocket upgrades whose Origin isn't on an explicit allowlist, rate-limit and log every authentication attempt whatever its source, and require a human to confirm every new device pairing.

What to do now

• Update OpenClaw to 2026.2.26 or later on every machine, and confirm the running version after restarting the gateway.
• Inventory AI agents across developer machines, including ones IT never approved. Look for listening local ports with tools like lsof -iTCP -sTCP:LISTEN (macOS/Linux) or Get-NetTCPConnection -State Listen (Windows).
• Rotate the gateway password to a long random value, and review paired devices and nodes for entries you don't recognize.
• Rotate credentials the agent could reach if you ran a vulnerable version: API tokens, chat integrations and SSH keys on paired nodes.
• Give agents least privilege. Limit which nodes can run shell commands and which credentials the agent holds, and treat it as a non-human identity with audit logging.
• Install skills carefully. Separate reporting has documented malicious skills promoted on OpenClaw's ClawHub repository.

Related on TechLogHub

• CORS explained
• Authentication explained
• AI agents vs AI workflows
• farfa.tech, a prompt application firewall

Sources

• Oasis Security: OpenClaw vulnerability research
• BleepingComputer: ClawJacked attack let malicious websites hijack OpenClaw to steal data
• Security Affairs: ClawJacked flaw exposed OpenClaw users to data theft
• CSO Online: Your personal OpenClaw agent may also be taking orders from malicious websites