Three Patched OpenClaw Flaws Enable Host Takeover via WhatsApp Message

Three now-patched vulnerabilities in the OpenClaw personal AI assistant, when chained, allow an attacker to execute arbitrary code on the host machine from a single WhatsApp message, researcher Chinmohan Nayak disclosed last week. The bugs affect OpenClaw versions prior to 2026.6.6, released on July 10.

Two of the flaws carry a CVSS score of 8.8 and involve OS command injection in the host execution environment filtering mechanism. A third, scored 8.4, is a path traversal in bind mount handling. Nayak reported all three to the project maintainers, who issued coordinated advisories under identifiers GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc.

Bind mount bypass exposes SSH keys, Docker socket

The most critical of the three, GHSA-575v-8hfq-m3mc, bypasses OpenClaw's sandbox denylist for directories such as ~/.ssh, ~/.aws, and ~/.gnupg. The researcher explained that the function getBlockedReasonForSourcePath() checks whether a source path is under a blocked path, but never checks the reverse. An attacker can mount the parent directory /home to read every user's SSH keys and AWS credentials, or mount /var to access the Docker socket and escape the container entirely.

Unlike the earlier Claw Chain vulnerabilities disclosed by Cyera in May, which required an attacker to already have a foothold, these bugs can be triggered from an untrusted external message. Nayak's proof of concept demonstrated host code execution originating from a WhatsApp message delivered to an OpenClaw instance.

• GHSA-hjr6-g723-hmfm: command injection and incomplete input filtering, CVSS 8.8
• GHSA-9969-8g9h-rxwm: command injection and incomplete input filtering, CVSS 8.8
• GHSA-575v-8hfq-m3mc: path traversal in bind mount denylist, CVSS 8.4

Hardening advice and what comes next

The OpenClaw maintainers noted in their advisory that "practical impact depends on the operator's configuration and whether lower-trust input can reach that path." Until operators upgrade to version 2026.6.6, they recommend enabling sandbox mode for all non-main sessions, removing the exec command from the tool allowlist for channel-facing agents, and monitoring for git clone commands that abuse the ext:: external protocol helper to run arbitrary commands.

Broader context from the same week includes the emergence of the MODBEACON RAT, a Rust-based trojan attributed to the Chinese cybercrime group Silver Fox that uses gRPC streaming for encrypted C2 traffic, and the GigaWiper RAT that can permanently wipe Windows systems via three methods. The OpenClaw chain stands apart because it targets the growing category of personal AI assistants, which increasingly have access to the same host resources as a full user. Nayak emphasized that the sandbox bypass undermined all file-level protections, concluding: "Mount /home into your container, and you can read every user's SSH keys, AWS credentials, and GPG secrets."