Executive Summary
Three now-patched OpenClaw flaws, including an OS command injection (CVSS 8.8), could be chained from WhatsApp to steal credentials, escalate privileges and run code on the host.
What Happened
Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host. A brief description of the high-severity vulnerabilities is as follows - GHSA-hjr6-g723-hmfm (CVSS score: 8.8) - An operating system
Affected Products
- OpenClaw
Vulnerability / Attack Technique
Message-triggered command injection chain
Technical Mechanism
A message received via WhatsApp could reach vulnerable code paths in the assistant, leading to command execution on the host.
AI Security Category
LLM05:2025 Improper Output Handling
Relevant Frameworks
RealGround Analysis
Messaging channels connect strangers directly to the agent's host. RealGround analysis: restrict who can message a personal agent and patch promptly.
Recommended Controls
- Update OpenClaw
- Allow only trusted contacts to message the agent
- Run the agent with minimal host privileges
Related RealGround Service
AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.