What began as one of the fastest-growing open-source projects in GitHub history — amassing over 135,000 stars within weeks — has become the focal point of the first major AI agent security crisis of 2026. OpenClaw, the autonomous personal AI assistant formerly known as Clawdbot and Moltbot, has been hit by a cascading series of vulnerabilities, supply chain attacks, and mass exposure incidents that together illustrate why autonomous AI agents represent a fundamentally new risk category.
CVE-2026-25253: One Click to Full Compromise
The crisis began with the disclosure of CVE-2026-25253 (CVSS 8.8), a token exfiltration vulnerability discovered by Mav Levin of depthfirst research. The flaw allows an attacker to craft a malicious URL that, when visited by an OpenClaw user, triggers a cross-site WebSocket hijacking attack. The exploit chain takes milliseconds: the victim's browser connects to the local OpenClaw gateway, steals the authentication token, and grants the attacker operator-level access — including the ability to disable sandbox protections, modify security configurations, and achieve full remote code execution.
The vulnerability affects even instances configured to listen only on localhost, since the victim's own browser initiates the outbound connection. OpenClaw patched the flaw in version 2026.1.29, though researchers from Snyk and depthfirst quickly confirmed the Docker sandbox could still be bypassed (CVE-2026-24763), prompting a second fix in version 2026.1.30.
ClawHavoc: Supply Chain Poisoning at Scale
Running in parallel was the ClawHavoc campaign. As documented by Conscia, Koi Security researcher Oren Yomtov audited all 2,857 skills on ClawHub and identified 341 malicious entries, with 335 traced to a single coordinated operation. By February 16, the count had grown to over 824 confirmed malicious skills across an expanded registry of 10,700+ skills. Bitdefender's independent analysis places the figure at approximately 900 — representing roughly 20% of the total ecosystem.
Microsoft and Cisco Sound the Alarm
Microsoft's security team published detailed guidance on February 19, explicitly recommending that OpenClaw be treated as "untrusted code execution with persistent credentials" and deployed only in fully isolated environments. Cisco Talos described OpenClaw as "an absolute nightmare" from a security perspective, with their open-source Skill Scanner tool flagging nine security findings including two critical and five high-severity issues in a single tested skill.
On February 14, OpenClaw creator Peter Steinberger announced he is joining OpenAI, with the project transitioning to an OpenAI-sponsored foundation. Whether institutional backing will address the fundamental architectural challenges — particularly the collapse of trust boundaries between untrusted input and privileged execution — remains the central question for the AI agent security community.