Critical OpenClaw 0-Days Let Attackers Hijack Trusted AI Agent Access

Key Takeaways

• Five critical zero-day vulnerabilities in OpenClaw allowed attackers to impersonate trusted users and hijack AI agent access.
• The flaws affected OpenClaw integrations with popular platforms including Slack, Discord, Microsoft Teams, Matrix, and Zalo.
• Attackers could exploit these vulnerabilities by changing their display names to match allowlisted users, gaining full control over AI agent interactions.
• The issues stemmed from a recurring design flaw in identity resolution during service initialization, despite an earlier patch for Telegram.
• Fixes have been implemented by OpenClaw maintainers, enforcing strict ID-based matching and requiring explicit configuration for name-based resolution.

Five previously unknown zero-day vulnerabilities within the OpenClaw platform enabled threat actors to circumvent established trust boundaries, seizing control over AI agents integrated across several widely used messaging services.

OpenClaw facilitates the integration of AI agents with platforms such as Slack, Discord, Microsoft Teams, Matrix, and Telegram. Its security model critically depends on user-defined allowlists, which are intended to restrict AI agent interactions to explicitly authorized identities only.

This foundational trust model presumes that only approved users can issue commands to agents, many of which may possess access to sensitive data, internal APIs, or even system-level execution capabilities. However, cybersecurity researcher Philip Garabandic discovered that this trust mechanism was fundamentally compromised due to improper identity resolution during the processing of allowlists.

Five OpenClaw 0-Days Identified

The core of these vulnerabilities lies in a persistent design flaw where human-readable identifiers, like display names, are improperly resolved to stable user IDs during the service’s initial setup. Given that most chat platforms permit users to change their display names, malicious actors could exploit this by simply altering their own display name to match an identity on an allowlist, thereby impersonating a trusted user.

This specific vulnerability was initially identified and patched in OpenClaw’s Telegram integration, documented under advisory GHSA-mj5r-hh7j-4gxf. Despite this prior fix, the same underlying security flaw re-emerged across five additional channel extensions: Slack, Discord, Matrix, Zalo, and Microsoft Teams. Each of these implementations independently replicated the insecure pattern, pointing to a broader problem of inconsistent security practices and distributed development challenges.

The vulnerability’s root cause is a flawed resolution process during startup. While runtime checks typically validate stable user IDs, the system’s initialization logic attempts to resolve allowlist entries by performing directory lookups based on mutable fields, such as displayName or username.

If an attacker modifies their display name to match an allowlisted user before a service restart, the system can erroneously bind the attacker’s ID to the trusted allowlist. Once this occurs, the attacker gains complete control over agent interactions, while the legitimate user is silently locked out.

These vulnerabilities were uncovered through the use of agentgg, a specialized AI-driven static analysis tool. This tool is designed to generate custom detectors based on historical security advisories. By analyzing previous OpenClaw vulnerabilities, agentgg developed targeted detection logic for recurring anti-patterns, successfully identifying the replicated flaw across multiple modules.

OpenClaw maintainers have acknowledged and addressed each of these findings. The implemented fixes now mandate strict ID-based matching and place name-based resolution behind explicit configuration flags.

From a cybersecurity perspective, this type of vulnerability aligns with CWE-639, which describes authorization bypass through user-controlled identifiers. The implications are particularly severe in environments involving AI agents, where compromised access could lead to arbitrary command execution, data exfiltration, or lateral movement within interconnected systems.

As Philip Garabandic noted, this incident underscores that patching a single component does not eradicate the underlying class of vulnerability. Without robust, systemic detection mechanisms, the same flaw can silently propagate across parallel implementations. By integrating past incident data into automated detection workflows, organizations can proactively prevent recurring failures and reinforce trust boundaries within increasingly complex AI-driven architectures.

What You Should Do

• Update OpenClaw instances immediately to the latest patched versions to mitigate these zero-day vulnerabilities.
• Review and harden identity resolution configurations within OpenClaw, ensuring that allowlists strictly rely on stable user IDs rather than mutable display names.
• Implement explicit configuration flags for any name-based resolution to prevent unintended trust bindings.
• Conduct regular security audits and penetration testing, particularly for AI agent integrations, focusing on identity and access management mechanisms.
• Leverage static application security testing (SAST) tools, especially those capable of generating custom detectors from historical vulnerabilities, to identify recurring anti-patterns in your codebase.
• Educate development teams on secure coding practices, emphasizing the dangers of relying on mutable identifiers for critical authorization decisions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.