Disclosed vulnerability
China's national CERT (CNCERT/CC) issues public security advisory on the OpenClaw personal AI agent, citing prompt injection, weak defaults and malicious plugins
AIR-2026-0067 AIR record · 2026-03-cverc-openclaw-security-advisory
From the supporting source
weak default security settings mean that once attackers gain access, they can easily take full control of the systemyicaiglobal.com
The record
Disclosed
2026-03-11
Occurred
2026-03-11
Vendor
OpenClaw
Product
OpenClaw
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Credential theft, Confused deputy, Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted (contested) — a national CERT advisory about the agent browsing, executing and being injected
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection via web pages and malicious plugins
Impact type
Credential theft risk, Data destruction risk, System takeover risk
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all OpenClaw users in China; Beijing subsequently curbed OpenClaw use in state-owned firms
Capability abused
Defense & remediation
Recorded defense
OpenClaw default configuration
Guardrail kinds
Unknown
Guardrail outcome
Silent
Taxonomy & references
Curator notes
Issued by China's National Computer Network Emergency Response Technical Team/Coordination Center. Advisory rather than a single incident, included because it is a national regulator acting on a specific agent product; it also warns that hidden instructions in web pages can leak the user's system keys and that OpenClaw may inadvertently delete important information in emails - the latter mirroring the Summer Yue inbox deletion. South Korea issued similar warnings (Feb 2026) and Beijing restricted OpenClaw in state firms (Mar 2026); those two were not separately verified. Confidence medium: the CNCERT/CC bulletin itself is not used as the source here.
Supporting sources
Cite as
Enkrypt AI. "China's national CERT (CNCERT/CC) issues public security advisory on the OpenClaw personal AI agent, citing prompt injection, weak defaults and malicious plugins". AIR, AIR-2026-0067. https://agentincident.vercel.app/i/AIR-2026-0067/ (accessed 2026-10-19).