Researcher Details WhatsApp-to-Host Attack Chain Using Three Open Claw Flaws
Summary: Three now-patched high-severity flaws in the OpenClaw personal AI assistant could enable credential theft, privilege escalation, and arbitrary code execution on the host, and researcher Chinmohan Nayak says they can be triggered by an external message sent via WhatsApp. The bugs, fixed in OpenClaw version 2026.6.6, include a parent-directory bypass in which the bind mount denylist blocks directories like ~/.ssh, ~/.aws, and ~/.gnupg but allows mounting /home or /var, letting an attacker read every user's SSH keys, AWS credentials, and GPG secrets or reach the Docker socket for a full host escape.
What's compelling: Unlike the earlier Claw Chain flaws, these require no prior foothold, so a single WhatsApp message is the entire attack path into the host. Mounting /home or /var inside the sandbox hands over every user's SSH keys, AWS credentials, and the Docker socket.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026