TLDR Tech / InfoSec
OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration (3 minute read)
China's CNCERT warned that OpenClaw, an open-source self-hosted AI agent, poses significant risks due to weak default settings and privileged system access. These vulnerabilities can enable indirect prompt injection attacks, where malicious instructions embedded in web content can force the agent to exfiltrate sensitive data via attacker-constructed URLs shown as link previews in Telegram or Discord — no user click needed. Other attack points include malicious skills uploaded to ClawHub that can execute arbitrary commands or install malware, instruction misinterpretation leading to irreversible data deletion, and threat actors distributing trojanized OpenClaw installers on GitHub that deliver malware such as Atomic Stealer, Vidar Stealer, and the Golang proxy GhostSocks via ClickFix-style lures. Recommended mitigation steps include blocking OpenClaw's default management port from internet exposure, isolating the service in a container, avoiding plaintext credential storage, and restricting skill installations to trusted channels only.
Read the full story