The OpenClaw RCE That An AI Found in 2 Hours — And How to Close It

Most people running OpenClaw are thinking about use cases — what tasks to automate, which models to connect, how to wire up their channels. Security is an afterthought, if it's a thought at all.

Then January 2026 happened.

Security research firm Ethiack deployed Hackian, their autonomous AI pentester, against a live OpenClaw Gateway instance. No human guidance. No pre-existing knowledge of the target. Two hours later, they had a working 1-click Remote Code Execution chain that could compromise any user who clicked a single link.

The vulnerability was reported January 26, patched in main January 28. But the threat model it exposed didn't go away with the patch.

The Four Ways OpenClaw Deployments Get Compromised

The Ethiack research, combined with the 82 CNNVD-cataloged vulnerabilities from early 2026, reveals a consistent pattern. Incidents cluster into four categories:

1. Identity & Access Failures

• Shared operator accounts with no separation
• Long-lived API tokens reused across dev and production
• No distinction between admin-level and operator-level actions
• Gateway exposed to the public internet without authentication

2. Prompt & Tool Execution Abuse

• Prompt injection from external sources hijacking agent behavior
• Overly broad tool permissions (exec enabled with no allowlist)
• Browser automation running against authenticated sessions with no guard rails
• Webhook handlers accepting payloads without validation

3. Secret & Data Leakage

• API keys visible in logs or shell history
• PII passed into agent context without masking
• Secrets stored in plaintext config files tracked by git

4. Weak Monitoring

• No audit log for high-risk actions (exec, config changes, message sends)
• No anomaly alerts — attacker has unlimited dwell time
• No tested incident response playbook

The Hardening Checklist (Operational Baseline)

The Config That Closes Most of It

This isn't a complete hardened config — every deployment is different. But this covers the highest-leverage settings:

{
  "tools": {
    "elevated": {
      "enabled": true,
      "requireApproval": true,
      "allowFrom": ["your-discord-user-id-here"]
    },
    "webFetch": {
      "allowlist": [
        "docs.openclaw.ai",
        "github.com/openclaw"
      ]
    },
    "message": {
      "allowChannels": ["discord"]
    }
  },
  "channels": {
    "discord": {
      "dmPolicy": "pairing",
      "groupPolicy": "allowlist"
    }
  }
}

What the Ethiack CVE Tells Us About AI Agents Generally

The most unsettling part of the Ethiack finding wasn't the vulnerability itself — it was the speed. An AI pentester found and validated a critical RCE chain in under 2 hours against a live production target.

That's the new baseline. Attackers don't need to be experts anymore. They can point AI tools at exposed services and let them probe autonomously. The bar for "secure enough" just got significantly higher.

For OpenClaw operators, this means the era of "it's probably fine, I'm not a big target" is over. AI agents running with production access are, by definition, high-value targets. Treat them like it.

When to Get a Professional Audit

The checklist above handles the obvious gaps. But there are deployment-specific risks that need eyes on your actual config: How are your skills structured? What does your SOUL.md reveal about your business operations? Are your webhook endpoints authenticated? What tools does your agent have that you've forgotten about?

That's what a ClawReady security audit covers. We review your full deployment — config, skills, channels, exec permissions, secrets hygiene — and give you a prioritized fix list. $49 flat, about an hour.