Disclosed vulnerability
ClawJacked: any website can take over a local OpenClaw agent over a localhost WebSocket
AIR-2026-0054 AIR record · 2026-02-openclaw-clawjacked
From the supporting source
any website to silently take full control of a developer's AI agent—with no plugins, extensions, or user interaction requiredoasis.security
The record
Disclosed
2026-02-26
Vendor
OpenClaw project
Product
OpenClaw
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — any website could drive the local agent's tool execution
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Malicious website localhost websocket
Impact type
Agent takeover, Remote code execution, Workstation compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any OpenClaw install before 2026.2.25 with the gateway listening on localhost while the user browses the web
Capability abused
Defense & remediation
Recorded defense
gateway password plus device approval, both defeated by unthrottled localhost WebSocket brute force
Guardrail kinds
Human approval, Authentication
Guardrail outcome
Silent
Fix shipped
OpenClaw 2026.2.25
Taxonomy & references
Curator notes
Oasis Security, published 2026-02-26. WebSocket connections to localhost are not blocked by cross-origin policy, so page JavaScript could reach the gateway port, brute-force the password past the rate limiter and bypass device approval. Oasis characterises the result as 'full workstation compromise, initiated from a browser tab.' Same structural class as the MCP Inspector DNS-rebinding RCE (CVE-2025-49596): agent control planes bound to localhost with no origin checks.
Supporting sources
Cite as
Enkrypt AI. "ClawJacked: any website can take over a local OpenClaw agent over a localhost WebSocket". AIR, AIR-2026-0054. https://agentincident.vercel.app/i/AIR-2026-0054/ (accessed 2026-10-19).