PANews March 2 News, GoPlus Chinese Community issued an alert: OpenClaw Gateway currently has a high-severity vulnerability. Please upgrade immediately to version 2026.2.25 or higher, audit and revoke unnecessary credentials, API keys, and node permissions granted to Agent instances. The analysis states that OpenClaw runs through a WebSocket Gateway bound to the localhost, which serves as the core coordination layer for the Agent and is an important component of OpenClaw. The attack targets the weakness in the Gateway layer, requiring only one condition: the user accesses a malicious website controlled by hackers in their browser.
The complete attack chain is as follows:
- The victim visits a malicious website controlled by the attacker in their browser;
- JavaScript on the page initiates a WebSocket connection to the OpenClaw Gateway on the localhost;
- Subsequently, the attack script attempts to brute-force the gateway password hundreds of times per second;
- After successfully cracking the password, the attack script silently registers as a trusted device;
- The attacker gains administrator-level control of the Agent.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Bitrefill Discloses Suspected North Korean Hacker Attack on March 1, With Approximately 18,500 Customer Purchase Records Leaked
Bitrefill suffered a cyberattack on March 1st that resulted in the leakage of approximately 18,500 customer records. The attack originated from a compromised employee laptop, using tactics similar to those of North Korean hacker groups. The company has isolated its systems and is working with experts to restore operations while strengthening cybersecurity measures.
GateNews13m ago
Slow Mist Yu Xian: MoreLogin Users Suspected of Bulk Coin Theft, Hacker Address Profited Approximately $85,000
Slowmist founder余弦 warned on X platform that multiple users have suffered theft incidents, with suspicions that private keys or seed phrases were collected by hackers. The hacker address has profited approximately $85,000, with some community members suspecting a connection to MoreLogin fingerprint browser, though no conclusive evidence has been found yet. Calling on victims to provide relevant information for investigation.
GateNews1h ago
A Chinese hacker group exposed itself due to an internal dispute over the division of stolen funds, having stolen approximately 7 million USD in cryptocurrency assets.
A hacker group has engaged in internal conflict over profit-sharing disputes, publicly exposing that they stole approximately $7 million in cryptocurrency assets through supply chain attacks. The group impersonated a network security company and used automated tools to obtain seed phrases and steal multi-chain wallet data, involving 37 types of tokens. The whistleblower plans to surrender to law enforcement, and details of the incident are pending investigation.
GateNews3h ago
CertiK Warns Security Risks in AI Agent Marketplaces Despite Next-Gen Skill Scanning
CertiK has revealed significant security vulnerabilities in AI agent marketplaces, emphasizing that current detection methods are inadequate. The research advocates for enhanced runtime security and skill isolation to prevent potential compromises from undetected malicious code.
BlockChainReporter4h ago
National Security Department Releases "Lobster" (OpenClaw) Secure Farming Manual, Proposing Four Major Risk Hazards and Countermeasures
On March 17, the National Security Department released the "Lobster" Security Hardening Guide, which identified breeding risks including host takeover and data theft. It recommends checking control interfaces, permission configurations, credential security, and plugin sources, emphasizing the principle of least privilege and implementation of isolation measures.
GateNews5h ago
UK Man Claims $172M Bitcoin Stolen, Funds Split Across 71 Wallets
A High Court case reveals the alleged theft of over $170 million in Bitcoin from a hardware wallet, raising concerns about self-custody risks. The funds, claimed by Ping Fai Yuen, were transferred without his knowledge and divided among multiple wallets. Allegations suggest involvement from the claimant's spouse, though these remain unproven. The case exemplifies challenges in cryptocurrency disputes, particularly regarding custody and personal relationships.
TodayqNews6h ago
