Preliminary research

1-Click RCE To Steal Your OpenClaw Data and Keys

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Chains an OpenClaw gateway-URL configuration flaw with token leakage and missing WebSocket origin validation so a malicious page can connect to a local agent. The resulting one-click path exposes credentials and can reach command execution on the victim host.

Record

Date

1 February 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Browser-relay credential theft

Tags

• ai-agent
• websocket
• origin-validation
• credential-theft
• attack-chain
• rce

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.