OpenClaw WebSocket vulnerability allows malicious websites to hijack local AI agents
OpenClaw, a popular AI agent framework for developers, contained a critical vulnerability (CVE-2026-25253) that allowed malicious websites to silently hijack locally running AI agents through WebSocket connections. The gateway's trust of localhost connections combined with browsers allowing cross-origin WebSocket access enabled attackers to register devices, access agents, and trigger actions across integrated systems. The vulnerability was patched in version 2026.2.25 released on 26 February 2026.
What happened
OpenClaw, a popular AI agent framework for developers, contained a critical vulnerability in its gateway that allowed malicious websites to hijack locally running AI agents.
The vulnerability, designated CVE-2026-25253 and codenamed ClawJacked, exploited how the OpenClaw gateway trusts WebSocket connections from localhost. A malicious website could silently open a WebSocket connection to the local OpenClaw gateway, and the gateway would auto-approve device registration without user awareness or consent.
Once connected, an attacker could register a device as trusted, access AI agents, enumerate connected services, read logs and configuration data, and trigger automated actions across the victim's integrated tools and services.
Reported impact
The vulnerability posed a critical risk to developers running OpenClaw, potentially exposing their AI agents and any integrated SaaS applications, cloud services, and internal systems to unauthorized control by attackers.
In enterprise environments where AI agents trigger actions across multiple integrated systems, a successful attack could translate into organization-wide impact.
Index analysis
The attack exploited a trust assumption in OpenClaw's design: the gateway granted automatic approval to device registration for localhost-originating connections, and modern browsers allow JavaScript on any website to open WebSocket connections to local services despite blocking cross-origin HTTP requests.
The vulnerability combined two factors: the gateway's assumption that localhost connections are safe and the browser's exception for WebSocket connections, which are designed to remain always-on for simultaneous data transmission.
Governance controls
OpenClaw patched the vulnerability in version 2026.2.25 released on 26 February 2026 following responsible disclosure by Oasis Security. The patch tightened trust assumptions for WebSocket connections and modified device registration logic so localhost-originating connections no longer receive automatic approval.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.