Disclosed vulnerability
Claw Chain: four chainable OpenClaw flaws take an agent from data access to privilege escalation to persistence
AIR-2026-0115 AIR record · 2026-05-openclaw-claw-chain
From the supporting source
Attackers can exploit the AI agent itself to execute the attack chain…By weaponizing the agent's own privileges, an adversary moves through data access, privilege escalation, and persistencecyera.com
The record
Disclosed
2026-05-15
Vendor
OpenClaw project
Product
OpenClaw / OpenShell managed sandbox
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the agent chained its own sandbox flaws to escalate and persist
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Agent driven exploitation of its own sandbox
Impact type
Sandbox escape, Privilege escalation, Data exfiltration, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all OpenClaw versions prior to the 2026-04-23 patches
Capability abused
Defense & remediation
Recorded defense
OpenShell sandbox mount root, command validation before shell execution, and a session ownership model
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
OpenClaw patches of 2026-04-23 (GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, GHSA-x3h8-jrgh-p8jx)
Taxonomy & references
Curator notes
Cyera Research, published 2026-05-15. CVE-2026-44112 (CVSS 9.6, TOCTOU write redirect out of the sandbox), CVE-2026-44115 (8.8, env-var expansion inside unquoted heredocs bridging validation and execution), CVE-2026-44118 (7.8, client-controlled senderIsOwner flag trusted without checking the authenticated session), CVE-2026-44113 (7.7, same TOCTOU pattern on reads via symlink swap). Grouped as one record: single coordinated disclosure of one chain. Note OpenClaw had an earlier separate TOCTOU sandbox escape in the remote FS bridge, CVE-2026-41296 (GHSA-9p3r-hh9g-5cmg, CVSS 9.4, patched 2026.3.31), and an earlier senderIsOwner escalation CVE-2026-41329.
Supporting sources
Cite as
Enkrypt AI. "Claw Chain: four chainable OpenClaw flaws take an agent from data access to privilege escalation to persistence". AIR, AIR-2026-0115. https://agentincident.vercel.app/i/AIR-2026-0115/ (accessed 2026-10-19).