Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenClaw privilege escalation vulnerability

nvd.nist.gov

Post reply on HN
Print view View original

231–240 of 306 posts

Re: OpenClaw privilege escalation vulnerability

#231

Post by veganmosfet »

sunaookami wrote: post #166
veganmosfet wrote: post #156

Earlier quoted context omitted.

I am experimenting prompt injection on OpenClaw [0][1], quite exciting. [0] https://itmeetsot.eu/posts/2026-03-27-openclaw_webfetch/ [1] https://itmeetsot.eu/posts/2026-03-03-openclaw3/

Awesome and very interesting posts, thanks for sharing! Always reminds me of the "lethal trifecta": https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

You're welcome!

My main takeaway message is: models (even opus4.6) do not follow security "instructions" reliably. In OpenClaw, they added security warnings, tags, random IDs... None of these countermeasures work reliably. Even sandboxing can be escaped (not in the classical sense using vulnerabilities, but using multi-layered prompt injection payload with natural language only)[0]. As soon as untrusted content is injected in the context, do not trust any actions downstream.

[0] https://itmeetsot.eu/posts/2026-02-15-openclaw_sandbox/

Re: OpenClaw privilege escalation vulnerability

#232

Post by victorbjorklund »

j16sdiz wrote: post #215
marscopter wrote: post #190

Earlier quoted context omitted.

If I am not mistaken steipete works for OpenAI now as part of OpenClaw being acquired by them back in February. NVIDIA is contributing to the security of OpenClaw via NemoClaw.[0] Not sure about ByteDance and Tencent. 0. https://www.nvidia.com/en-us/ai/nemoclaw/

[flagged]

And all American companies plant American malware in all software they work on.

Re: OpenClaw privilege escalation vulnerability

#234

Post by nkzd »

awestroke wrote: post #233
chatmasta wrote: post #211

I’m surprised people are still using OpenClaw. I assumed they’d have switched to Nanoclaw or Nemoclaw. Is OpenClaw just that much better, or is it all inertia? (I’ve never used any of them.)

It's shit, but most people don't know better

Which "claw" so you recommended?

Re: OpenClaw privilege escalation vulnerability

#235

Post by [deleted] »

rolisz wrote: post #213
vasco wrote: post #210

> We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI. But coding is solved? Why do you need those guys if all they do is use claude code? Just have it solve it overnight. You forgot to prompt "make it secure pls"?

Coding is solved, but problems with code is not yet solved.

[deleted]

Re: OpenClaw privilege escalation vulnerability

#236

Post by tdeck »

vasco wrote: post #210

> We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI. But coding is solved? Why do you need those guys if all they do is use claude code? Just have it solve it overnight. You forgot to prompt "make it secure pls"?

They didn't say the "folks" from those companies were engineers! Maybe it's a group of PMs from Nvidia, ByteDance, Tencent and OpenAI that are working to harden the codebase.

Re: OpenClaw privilege escalation vulnerability

#237

Post by tdeck »

rolisz wrote: post #213
vasco wrote: post #210

> We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI. But coding is solved? Why do you need those guys if all they do is use claude code? Just have it solve it overnight. You forgot to prompt "make it secure pls"?

Coding is solved, but problems with code is not yet solved.

I think I'm pretty good at cooking, but still working on the part where it tastes like food and doesn't make you violently ill.

Re: OpenClaw privilege escalation vulnerability

#238

Post by jeremie_strand »

nightpool wrote: post #70
steipete wrote: post #55

OpenClaw creator here. This was a privilege-escalation bug, but not "any random Telegram/Discord message can instantly own every OpenClaw instance." The root issue was an incomplete fix. The earlier advisory hardened the gateway RPC path for device approvals by passing the caller's scopes into the core approval check. But the `/pair approve` plugin command path still called the same approval function without `callerS…

Can you speak a little bit more to the stats in the OP? * 135k+ OpenClaw instances are publicly exposed * 63% of those run zero authentication. Meaning the "low privilege required" in the CVE = literally anyone on the internet can request pairing access and start the exploit chain Is this accurate? This is definitely a very different picture then the one you paint

[dead]

Re: OpenClaw privilege escalation vulnerability

#239

Post by greenchair »

tdeck wrote: post #236
vasco wrote: post #210

> We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI. But coding is solved? Why do you need those guys if all they do is use claude code? Just have it solve it overnight. You forgot to prompt "make it secure pls"?

They didn't say the "folks" from those companies were engineers! Maybe it's a group of PMs from Nvidia, ByteDance, Tencent and OpenAI that are working to harden the codebase.

nearly spit out my coffee, thank you!

Re: OpenClaw privilege escalation vulnerability

#240

Post by throwatdem12311 »

Steinberger has a vested interest in protecting his, and OpenAIs reputation from the ramifications of serious in-the-wild exploits like this.

Or inviting any legal or regulatory scrutiny.

They don’t even read the code in any serious capacity so excuse me for not taking any assessment of the situation from him too seriously. Might as well just ask Claude Code to assess it yourself.

Welcome to the world vibe coding created. The fun is only just beginning.

Post reply on HN