TLDR Tech / InfoSec
OpenClaw Allowed Hijacking of Local AI Agents
A vulnerability in OpenClaw's gateway allowed malicious websites to open a WebSocket connection to localhost, brute-force passwords, and take control of the locally running AI agent. The flaw required no plugins or extensions, just the bare OpenClaw gateway running as documented. The vulnerability was patched by the vendor, but it's a preview of the attack surface that local AI agent platforms introduce when they bind to localhost.
Read the full story