Critical OpenClaw Chain Flaws Expose 245,000 AI Agent Servers

Key Takeaways

• Four critical vulnerabilities, collectively termed “Claw Chain,” have been identified in the OpenClaw AI agent platform.
• These flaws enable remote exploitation, credential theft, and the installation of persistent backdoors on an estimated 245,000 exposed server instances.
• The vulnerabilities allow attackers to weaponize the AI agent’s own privileges, making detection challenging.
• Patches were released in April 2026, and immediate action is advised for all OpenClaw users.

A series of four critical security vulnerabilities has been uncovered in OpenClaw, a rapidly expanding open-source platform designed for autonomous AI agents. These flaws collectively expose an estimated 245,000 publicly accessible server instances, making them susceptible to remote exploitation, the unauthorized acquisition of credentials, and the establishment of persistent backdoors.

OpenClaw, initially launched in late 2025 under the name “Clawdbot,” serves as a crucial bridge, connecting large language models directly to vital system components such as filesystems, Software-as-a-Service (SaaS) applications, sensitive credentials, and various execution environments.

Its adoption has surged across enterprises, where it is leveraged for diverse applications including IT automation, streamlining customer service pipelines, and integrating operations with popular platforms like Telegram, Discord, and Microsoft Agent 365. This extensive and privileged access inherently positions OpenClaw as a prime target for malicious actors.

The research team at Cyera discovered these four previously undisclosed vulnerabilities and promptly reported them to the OpenClaw maintainers in April 2026. All identified issues have since been addressed through official patches.

Understanding the Claw Chain Vulnerabilities

While each vulnerability presents a significant risk individually, their combined impact, referred to as “Claw Chain” by Cyera, creates a far more severe threat landscape. The flaws are detailed as follows:

• CVE-2026-44112 (CVSS 9.6 – Critical): This vulnerability involves a time-of-check/time-of-use (TOCTOU) race condition within the OpenShell sandbox. Attackers can exploit this to redirect write operations beyond the sandbox’s intended boundaries, facilitating configuration tampering and the persistent installation of backdoors on the host system.
• CVE-2026-44115 (CVSS 8.8 – High): A critical design flaw exists between OpenClaw’s command validation process and its shell execution. This gap allows environment variables, which often contain sensitive data like API keys, tokens, and credentials, to leak through unquoted heredocs that appear secure during the validation phase.
• CVE-2026-44118 (CVSS 7.8 – High): OpenClaw exhibits a blind trust in a client-controlled ownership flag (senderIsOwner) without verifying it against the authenticated session. This allows a local process possessing a valid bearer token to escalate its privileges to owner-level control, gaining command over gateway configuration, scheduling, and execution management.
• CVE-2026-44113 (CVSS 7.7 – High): Mirroring the TOCTOU race condition in write operations, this vulnerability affects read operations. Attackers can swap validated file paths with symbolic links that point outside the permitted mount root, thereby exposing system files and internal artifacts that the AI agent was never intended to access.

The Attack Chain Explained

The true danger of the “Claw Chain” lies in its ability to be exploited in a multi-stage attack. From an initial point of compromise, such as a malicious plugin, a prompt injection attack, or compromised external input, an attacker can link three vulnerabilities in sequence to achieve comprehensive control:

1. Foothold: The attacker first establishes code execution within the OpenShell sandbox, typically via a malicious plugin or a crafted prompt injection.
2. Exfiltration: Subsequently, CVE-2026-44113 and CVE-2026-44115 are leveraged to extract sensitive data, including credentials, secrets, and confidential files.
3. Privilege Escalation: CVE-2026-44118 is then exploited to elevate the attacker’s control to an owner-level status over the agent’s runtime environment.
4. Persistence: Finally, CVE-2026-44112 is deployed to implant backdoors and alter the future behavior of the AI agent, ensuring long-term access.

This attack chain is particularly insidious because it weaponizes the AI agent’s inherent privileges. Each step of the exploitation process closely mimics legitimate agent behavior, making these attacks significantly more challenging to detect with traditional security controls.

Scans conducted in May 2026 by Shodan and ZoomEye revealed approximately 65,000 and 180,000 publicly accessible OpenClaw instances, respectively. This totals an estimated 245,000 servers that are currently exposed to these critical vulnerabilities.

Organizations operating in financial services, healthcare, and legal sectors face heightened risks, especially those where AI agent workflows process Personally Identifiable Information (PII), Protected Health Information (PHI), or privileged credentials.

What You Should Do

Organizations utilizing OpenClaw should consider this a Priority 1 security advisory and take immediate action:

• Apply Patches Immediately: Implement the fixes released on April 23, 2026, which address GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, and GHSA-x3h8-jrgh-p8jx.
• Rotate All Secrets: Assume that any environment variable or credential accessible by OpenClaw processes may have been compromised and rotate them without delay.
• Identify and Secure Exposed Instances: Utilize tools like Shodan or conduct internal asset inventories to identify all publicly accessible OpenClaw instances. Place these instances behind robust authentication mechanisms or firewall controls.
• Audit Agent Access: Treat OpenClaw deployments as highly privileged identities. Implement the same rigorous lifecycle controls and access audits typically applied to service accounts to manage and monitor their access.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.