Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws

Original Source

The Hacker News

// Analysis

Security researcher Chinmohan Nayak has disclosed details of three now-patched, high-severity vulnerabilities in the OpenClaw personal artificial intelligence assistant that, when chained, allowed for remote code execution on the host system via an external WhatsApp message. These flaws, identified as GHSA-hjr6-g723-hmfm (CVSS 8.8), GHSA-9969-8g9h-rxwm (CVSS 8.8), and GHSA-575v-8hfq-m3mc (CVSS 8.4), collectively enabled credential theft, privilege escalation, and arbitrary code execution. All three issues have been addressed in OpenClaw version 2026.6.6.

// Why It Matters

Signal Intelligence Assessment

The demonstrated "WhatsApp-to-host" attack chain highlights a critical risk: OpenClaw agents integrated with external messaging platforms can be directly vulnerable to remote code execution without prior system access, demanding more rigorous input sanitization and sandboxing for public-facing deployments.
The vulnerabilities (OS command injection, path traversal in bind mounts) underscore that traditional security flaws persist and are exploitable within agentic AI systems, necessitating that OpenClaw developers approach agent design with a strong focus on secure coding practices, not just AI-specific security.
The effectiveness of bypassing denylist checks via parent directory traversal (e.g., mounting `/home` to circumvent `~/.ssh` blocks) indicates a limitation in common sandboxing strategies, requiring practitioners to re-evaluate their current containment policies for OpenClaw agents and consider more robust, allow-list based security models.
The swift patching in OpenClaw version 2026.6.6, coupled with responsible disclosure, signals an active and responsive security posture from the OpenClaw project, which helps maintain trust and provides a clear upgrade path for developers to secure their agent deployments against these specific threats.

Analyzed 17:00 PT · Trace No. 006 · July 2026

Back to Trace No. 006 · July 2026