{
 "public_id": "AIR-2026-0115",
 "incident_id": "2026-05-openclaw-claw-chain",
 "date_disclosed": "2026-05-15",
 "date_occurred": null,
 "title": "Claw Chain: four chainable OpenClaw flaws take an agent from data access to privilege escalation to persistence",
 "class": "responsible_disclosure",
 "attack_surface": "agent_framework",
 "initial_vector": "agent_driven_exploitation_of_its_own_sandbox",
 "agent_capability_abused": [
  "sandboxed_file_read",
  "sandboxed_file_write",
  "shell_command_construction",
  "ownership_claim"
 ],
 "target_product": "OpenClaw / OpenShell managed sandbox",
 "target_vendor": "OpenClaw project",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "sandbox_escape",
  "privilege_escalation",
  "data_exfiltration",
  "persistence"
 ],
 "blast_radius": "all OpenClaw versions prior to the 2026-04-23 patches",
 "cve": [
  "CVE-2026-44112",
  "CVE-2026-44115",
  "CVE-2026-44118",
  "CVE-2026-44113"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "toctou",
   "symlink_attack",
   "heredoc_variable_expansion",
   "client_controlled_trust_flag",
   "exploit_chain",
   "confused_deputy"
  ]
 },
 "defense_present": "OpenShell sandbox mount root, command validation before shell execution, and a session ownership model",
 "defense_bypassed": true,
 "fix_shipped": "OpenClaw patches of 2026-04-23 (GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, GHSA-x3h8-jrgh-p8jx)",
 "primary_sources": [
  "https://www.cyera.com/blog/claw-chain-cyera-research-unveil-four-chainable-vulnerabilities-in-openclaw"
 ],
 "verified_quote": "Attackers can exploit the AI agent itself to execute the attack chain…By weaponizing the agent's own privileges, an adversary moves through data access, privilege escalation, and persistence",
 "confidence": "high",
 "notes": "Cyera Research, published 2026-05-15. CVE-2026-44112 (CVSS 9.6, TOCTOU write redirect out of the sandbox), CVE-2026-44115 (8.8, env-var expansion inside unquoted heredocs bridging validation and execution), CVE-2026-44118 (7.8, client-controlled senderIsOwner flag trusted without checking the authenticated session), CVE-2026-44113 (7.7, same TOCTOU pattern on reads via symlink swap). Grouped as one record: single coordinated disclosure of one chain. Note OpenClaw had an earlier separate TOCTOU sandbox escape in the remote FS bridge, CVE-2026-41296 (GHSA-9p3r-hh9g-5cmg, CVSS 9.4, patched 2026.3.31), and an earlier senderIsOwner escalation CVE-2026-41329.",
 "is_umbrella": true,
 "umbrella_constituents": [],
 "umbrella_reason": "One coordinated disclosure of four chainable flaws; retained as the chain, with no constituent records.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "product_misuse",
  "safety_harm"
 ],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover",
  "Persistence & Covert C2"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent chained its own sandbox flaws to escalate and persist",
 "vector_family": "other",
 "vector_detail": "agent_driven_exploitation_of_its_own_sandbox",
 "guardrail_kind": [
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-44112",
   "CVE-2026-44115",
   "CVE-2026-44118",
   "CVE-2026-44113"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "openclaw",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels",
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}