Researcher Details an Attack Chain Against OpenClaw via WhatsApp

A security researcher has published the details of an attack on the OpenClaw personal AI assistant that hinges on three vulnerabilities. All of them have already been fixed by the developers.

According to the write-up, the exploitation chain begins through WhatsApp and ultimately makes it possible to gain control of the host system. Taken together, the vulnerabilities gave an attacker the ability to steal credentials, escalate privileges and execute arbitrary code on the device.

Vulnerability details

One of the vulnerabilities, assigned the identifier GHSA-hjr6-g723-hmfm, is rated 8.8 on the CVSS scale, which corresponds to a high level of severity. It is tied to activity at the operating-system level.

The full set of three flaws together formed an end-to-end attack: starting with an interaction over the WhatsApp messenger, it progressed through the assistant's components and ended with the compromise of the host on which OpenClaw runs.

The developers' response

At the time the research was published, all three vulnerabilities had already been closed with patches. OpenClaw users are advised to make sure they are running the current version of the assistant, which includes the security fixes.

The incident underscores the risks that come with integrating personal AI assistants with external communication channels such as messengers: pairings like this expand the attack surface and can turn a seemingly harmless interaction channel into the starting point for a full system compromise.

Source: The Hacker News