OpenClaw AI security flaws expose systems to data theft
China’s National Computer Network Emergency Response Technical Team warned that the open-source AI agent OpenClaw has weak default security settings that attackers could exploit to gain system control.
Attackers can use prompt injection, embedding malicious instructions in web pages to trick the AI into leaking sensitive data. Researchers showed that features like link previews in apps such as Telegram or Discord could automatically exfiltrate confidential data without users clicking a link.
Additional risks include accidental deletion of critical files, malicious third-party “skills” that run malware, and vulnerabilities enabling system compromise.
Authorities warn breaches could expose trade secrets or disrupt critical sectors, urging stricter controls, secure deployment, and trusted sources for AI extensions.
Read The Hacker News article for more information.