TLDR Tech / InfoSec
Dangerous by Default: What OpenClaw CVE Record Tells Us About Agentic AI
OpenClaw, an autonomous local AI agent with default shell execution, file system access, and runtime code generation, accumulated 104 CVEs in 18 days spanning CWE-78 OS command injection, CWE-22 path traversal, CWE-918 SSRF, prompt injection, and auth bypass, a rate 200x higher than LangChain or Ollama across their entire lifetimes. CVE-2026-27001 illustrates the root cause: the working directory path was embedded as a plain string in the LLM system prompt, enabling prompt injection via Unicode bidirectional markers and newlines. The patch strips control characters but leaves untrusted data in the instruction context. Defenders building agentic systems should enforce least-privilege capability scoping, treat all untrusted inputs as structured data kept outside the prompt context, and sandbox runtime-generated code with no host-credential or network-egress access by default.
Read the full story