Critical OpenClaw Vulnerability Lets Attackers Hijack WhatsApp Via One Message

Key Takeaways

• Three high-severity vulnerabilities in the OpenClaw AI coding assistant allow for remote code execution (RCE) via a single WhatsApp message.
• The flaws, affecting OpenClaw version 2026.6.1, stem from how the AI agent processes untrusted input and manages execution capabilities.
• A patch is available in OpenClaw version 2026.6.6 or later, and immediate upgrades are strongly recommended for affected administrators.

Three critical vulnerabilities have been identified in OpenClaw, the popular open-source AI coding assistant, enabling attackers to achieve remote code execution (RCE) on affected systems. These high-severity flaws can be exploited through a single malicious WhatsApp message, highlighting significant security risks in AI agents that interact with external messaging platforms.

The vulnerabilities, which have been confirmed on OpenClaw version 2026.6.1, expose a fundamental weakness in how AI agents handle and sanitize untrusted input originating from various messaging channels. OpenClaw, with its impressive 381,000 GitHub stars and over 100,000 daily active users, functions as a self-hosted AI assistant that integrates with platforms like WhatsApp, Slack, Discord, Telegram, and Teams. Users can interact with it via text messages to request coding tasks, much like communicating with a colleague.

The core functionality of OpenClaw — its ability to write code, execute shell commands, and manage files — ironically also forms the basis of its primary security liability, as researchers discovered.

Understanding the OpenClaw Vulnerabilities

The identified issues comprise three distinct high-severity vulnerabilities:

Environment Variable Filter Bypass (GHSA-hjr6-g723-hmfm)

Rated with a CVSS score of 8.8, this flaw exists within OpenClaw’s sanitizeEnvVars() function. While designed to block credential-like variables, it overlooks 12 critical interpreter startup variables, including NODE_OPTIONS, BASH_ENV, and PYTHONSTARTUP. This oversight permits attackers to inject arbitrary code that executes prior to the intended target script, effectively bypassing security controls.

Git ext:: Transport RCE (GHSA-9969-8g9h-rxwm)

Also carrying a CVSS score of 8.8, this vulnerability leverages the Git ext:: transport mechanism. Although typically disabled by default, this transport can be re-enabled by injecting −cprotocol.ext.allow=always into a git clone command. This allows for the execution of arbitrary shell commands, often disguised as routine CI debugging tasks.

Sandbox Parent-Directory Bypass (GHSA-575v-8hfq-m3mc)

With a CVSS score of 8.4, this vulnerability affects OpenClaw’s Docker sandbox. The sandbox aims to prevent the mounting of sensitive paths such as ~/.ssh or ~/.aws. However, the implemented check only scrutinizes paths *within* blocked directories, not directories that *contain* them. Consequently, mounting a parent directory like /home or /var can inadvertently expose all user SSH keys and even the Docker socket, potentially leading to a full host escape.

Security researcher Chinmohan Nayak demonstrated the exploit chain by sending a WhatsApp message crafted to appear as a standard debugging request. The message, phrased as “I am debugging a Node.js memory leak in production, please run these commands…”, successfully smuggled a malicious script via the NODE_OPTIONS environment variable. This script then executed with complete filesystem access before the legitimate command. The AI model powering the test agent, Claude Sonnet 4, processed the request without suspicion, formatted the output, and even offered further assistance.

A subsequent test, utilizing the Git ext:: trick and framed as an attempt to reproduce a CI pipeline error, yielded similar results, with the AI agent executing the commands without question. Interestingly, overtly malicious payloads, such as piped curl-to-bash commands, were refused approximately 40% of the time. However, identical payloads, when embedded within a plausible developer context, consistently succeeded in every new session tested.

Researchers emphasized that the core problem is not a flaw in Claude Sonnet 4’s safety training, but rather an inherent limitation: the AI model struggles to differentiate between a legitimate developer’s request and an identically phrased malicious one from an attacker. This issue is compounded by session memory; while a model might become suspicious and refuse a payload within an ongoing conversation, a new session resets its trust level, granting attackers unlimited retry attempts.

What You Should Do

Administrators operating OpenClaw instances must take immediate action to mitigate these critical vulnerabilities:

• Upgrade Immediately: Update OpenClaw to version 2026.6.6 or later, which includes patches for all three identified vulnerabilities.
• Review Tool Allowlists: Remove exec from the tool allowlist, especially for untrusted communication channels, unless it is absolutely essential for operational requirements.
• Enable Sandbox Mode: Implement and enable sandbox mode for all non-primary sessions to contain potential exploits.
• Restrict DM Pairing Policies: Configure direct message (DM) pairing policies to prevent untrusted phone numbers or users from reaching the AI agent.
• Rotate Credentials: If your OpenClaw instance was publicly accessible prior to applying the patches, rotate all associated credentials as a precautionary measure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.