If you're running OpenClaw, you probably got hacked in the last week

https://old.reddit.com/r/sysadmin/comments/1sbdw29/if_youre_running_openclaw_you_probably_got_hacked/

153•kykeonaut•2h ago

Comments

deadbabe•1h ago

I have a theory OpenClaw was built deliberately for malicious reasons under the guise of being something cool and useful.

EA-3167•1h ago

In this case I'd say that it was made not to enable that, but in total disregard of its realistic uses and risks. In a sense this is less... deliberate poisoning, and more doing a bad job cutting heroin with fentanyl for distribution. Yeah the result is the same, but the cause is negligence to the point of parody rather than outright malice.

throwatdem12311•1h ago

Some people are so stupid it is indistinguishable from evil.

cactusplant7374•1h ago

What reason would Steinberger have for doing that? It was his hobby project.

asdff•1h ago

He doesn't need a reason. He could have been captured by intelligence after the fact.

throwatdem12311•1h ago

You can’t think of a single reason?

Intelligence asset.

Useful idiot.

Plenty of reasons.

podgorniy•1h ago

lol

tgv•1h ago

Your comment is obviously against the rules, but I read it as: Why are people not more careful? This is some unknown, app, with unknown, unvetted depths, and you only like it because other people say it's shiny and AI. It made you giddy, and you forgot that giving a tool permissions is an invitation to hackers. Well, you went ahead and ignored all common sense, and here we are.

sva_•1h ago

> 4. System grants admin because it never checks if you are authorized to grant admin

Shipping at the speed of inference for real.

gos9•1h ago

Really? Posting AI generated Reddit post with no sources or anything?

tgv•1h ago

The CVE seems to be real.

hmokiguess•1h ago

The link mentions the CVE, here's the link https://nvd.nist.gov/vuln/detail/CVE-2026-33579

dijksterhuis•49m ago

if would be good if we could have the submission including this link at the top

earnesti•1h ago

I don't think enabling admin on open internet is a default behaviour by any means?

rvz•1h ago

OpenClaw has over 400+ security issues and vulnerabilities. [0]

Why on earth would you install something like that has access to your entire machine, even if it is a separate one which has the potential to scan local networks?

Who is even making money out of OpenClaw other than the people attempting to host it? I see little use out of it other than a way to get yourself hacked by anyone.

[0] https://github.com/openclaw/openclaw/security

nickthegreek•1h ago

It does not need access to your full machine. It can literally run in a vps.

fraywing•1h ago

How do you think the vibe-coding layman audience is using OpenClaw?

nickthegreek•1h ago

hostinger vps if youtube is any indication.

rob•16m ago

Most of the people using it probably don't even know what SSH is, let alone using a VPS to maintain a personal bot for them for years with no maintenance. They know Vercel and Supabase. They will run it on their local machine and just keep clicking yes to everything until they get the result they want.

throwatdem12311•1h ago

Think of all the people that are too ignorant to even understand the basics of any of this that are running OpenClaw. They will be completely unaware and attackers can easily hide their tracks by changing system prompts (among plenty of other things).

This is bad.

Simon321•1h ago

Only if your openclaw instance is publicly exposed on the internet... which is not the case for most people

causal•1h ago

Until recently, this was default configuration

Edit: Default binding was to 0.0.0.0, and if you were not aware of this and assumed your router was keeping you safe, you probably should not be using OpenClaw. In fact some services may still default to 0.0.0.0: https://github.com/openclaw/openclaw/issues/5263

charcircuit•1h ago

Since pretty much the beginning it wasn't and the documentation explicitly warned not to make it public, exposing it to the internet. It included information on how you can properly forward the gateway port to your machine without opening it up to the internet.

earnesti•1h ago

I have used openclaw pretty long but at no point it has proposed doing anything like that.

nickthegreek•1h ago

Not true. So many people love to come out of the woodwork on these openclaw posts who have no first hand knowledge of the software. It is stunning.

fraywing•1h ago

Could anyone have predicted that giving an agent free reign of your personal hardware could have resulted in bad things happening? not I /s

jstanley•1h ago

But this is nothing to do with the agent being tricked. This is ordinary old-fashioned code being tricked!

paulhebert•52m ago

But was the code written by an agent? It's agents all the way down

blharr•1h ago

Hackernews is now posting links to reddit AI slop posts that I came here to get away from...

throwatdem12311•1h ago

As if the non-Reddit links aren’t majority AI slop already.

dgellow•1h ago

Flag then move to the next one

niwtsol•1h ago

Title is a bit misleading, no? You have to have openclaw running on an open box. And the post even says "135k open instances" out of 500k running instances? so a bit clickbait-y

mey•1h ago

More than 25% of users seems like a pretty accurate "probably".

peacebeard•1h ago

Today I learned nobody agrees on what the word "probably" means.

SequoiaHope•1h ago

Ya I thought it meant “more probable than not” ie 50+%.

Otherwise I would say “you may have been hacked” not “you probably have been hacked”.

lwansbrough•1h ago

That is what it means. Unless you're losing an argument on the internet and you need a word to hide behind. ;)

zephen•59m ago

You're probably right.

furyofantares•1h ago

Here's a statement that's about 3x as true then:

If you're running OpenClaw, you probably didn't get hacked in the last week.

DrewADesign•53m ago

You know you’re getting into zealot territory when people are arguing semantics over the headline pointing to a zero authentication admin access vulnerability CVE that affects a double-digit percentage of users.

earnesti•52m ago

Does it really? Digging up the data from example the 135k instances in the open reeks like bullshit, I would suspect several other claims are exaggerated as well.

DrewADesign•47m ago

> Digging up the data from example the 135k instances in the open reeks like bullshit, I would suspect several other claims are exaggerated as well.

Do you so stringently examine most CVEs? I’ll bet you don’t. Are you a big fan of this project? I’ll bet you are. Do you have any actual data to counter what they said or do you just sort of generally not vibe with it? If so, now would be a great time to break it out while this is still fresh. If not…

nickthegreek•22m ago

They are pointing out the data provided does not appear to be real. There is no credible link to this 135k number. They do not need to provide a number, as one does not appear to exist.

0cf8612b2e1e•1h ago

1/5 rounds to “probably” when discussing security.

nickthegreek•1h ago

The 135k number appears to be pulled out of thin air? No idea where the 65% comes from. The command the post gives to list paired devices isn't correct. These are red flags.

earnesti•1h ago

The 135k instances is likely not true at all.

DrewADesign•1h ago

It’s also only 65% of those that have zero authentication configured, according to that post (which I have done nothing to confirm or challenge at all… Frankly I wouldn’t touch OpenClaw with a ten foot… cable?) That said, I think it’s far more important to get people’s attention who might otherwise not realize how closely they need to pay attention to CVEs than it is to avoid hyperbole in headlines.

codechicago277•1h ago

Not if this is crying wolf and causing those same people to ignore the very real security risks with using OpenClaw.

DrewADesign•1h ago

How is 20% of users getting pwned ”crying wolf” by any reasonable measure? This is a zero authentication admin access vulnerability.

petcat•1h ago

I don't use OpenClaw, but I still run my Claude Code and Codex as limited macOS user accounts and just have a script `become-agent <name> [cmd ...]` that does some sudo stuff to run as the limited user so they don't have any of my environment or directory access, or really any system-level admin access at all. They can use and write to their home directories as usual, which makes things easier to configure since those CLI harnesses really like when $HOME is configured and works as expected.

It's a good compromise between running as me and full sandbox-exec. Multi-user Unix-y systems were designed for this kind of stuff since decades ago.

Leomuck•1h ago

Well, such things were to be expected. It's easy to bash on all the people who haven't gotten the necessary IT understanding of securing such things. Of course, it's uber-dumb to run an unprotected instance. But at the same time, it's also quite cool that so many people can do interesting IT stuff now. I'm thinking basically it's a trade-off. Be able to do great stuff, live with the consequences of doing that without proper training. Like repairing your car yourself. You might have fun doing it, it might get you somewhere, but you have to accept that if you have no idea about cars, you just introduced a pretty big risk into your life (say if you replaced the brakes or something). But yea, security, privacy, fighting climate change, all very much on the decline - humans doing cool things, ignoring important things - we'll have to live with the consequences.

paulhebert•52m ago

Gonna be honest. I'd rather fight climate change than have people run LLMs unsecured

Xunjin•34m ago

Yeah... The bill is already being paid. I wonder how the life quality of my nephew (and other children) of 5 years old today will be in the near future..

neya•1h ago

Someone has to say this, but - If you still continued to use OpenClaw despite multiple top news sites explaining the scope of the previous hacks and why you shouldn't use it, you probably deserved to get hacked

pezo1919•4m ago

“It’s OK to be hacked until everyone is getting hacked.”

sunaookami•54m ago

Honest question: What do people actually USE OpenClaw for? The most common usage seems to be "it reads your emails!", that's the exact opposite of "exciting"...

browningstreet•47m ago

This question gets asked a lot, and then answered a lot, and then asked again.. why fill the cup if the cup has a hole?

EDIT:

Y'all can downvote me if you want, but parent poster couldn't find clawhub.ai with 45K skills for OpenClaw.

Kinda belies the "No one uses OpenClaw for anything" line.

https://clawhub.ai/skills?sort=downloads&nonSuspicious=true

freedomben•42m ago

yeah I don't normally say "read previous HN articles" but it has been asked at least once in every article here.

sunaookami•34m ago

Obviously I already searched the web (not specifically HN I must admit) and there were always incredibly generic non-answers that ultimately say nothing (and they assume you have 3000$ per month or 2000 Mac Minis on your desk (hyperbole)).

ziml77•25m ago

Incredibly, one of the responses you got already is exactly one of those replies that says nothing. There's a whole bunch of words that don't actually answer the question.

emp17344•23m ago

I think you’ve got your answer, then. If nobody can tell you what it’s really used for, it likely doesn’t have any real use cases.

_doctor_love•44m ago

Assuming you're asking in good faith, IMHO the deeper story around OpenClaw is that it's the core piece of a larger pattern.

The way I'm seeing folks responsibly use OpenClaw is to install it as a well-regulated governor driving other agents and other tools. It is effectively the big brain orchestrating a larger system.

So for instance, you could have an OpenClaw jail where you-the-human talk to OpenClaw via some channel, and then that directs OpenClaw to put lower-level agents to work.

In some sense it's a bit like Dwarf Fortress or the old Dungeon Keeper game. You declare what you want to have happen and then the imps run off and do it.

[EDIT: I truly down understand sometimes why people downvote things. If you don't like what I'm saying, at least reply with some kind of argument.]

j-bos•22m ago

So I neither downvoted nor upvoted you, but I think people may be downvoting, in addition to the fact that they just don't like the thing, based on the fact that you didn't directly answer the question. Specifically, what are you using it for, not what hypothetically it would be used for.

PKop•21m ago

First words out of your mouth are to accuse OP of not seriously asking the question. Then you write paragraphs saying nothing much at all. You could have simply answered the question in a simple straightforward manner.

mvdtnz•21m ago

You're probably being downvoted because you didn't answer the question. The questioner specifically asked what people are using it for and you answered by describing your technical setup. What we want to know is, what are you actually achieving with this tool?

sgillen•34m ago

I've only been playing with it recently ... I have mine scraping for SF city meetings that I can attend and public comment to advocate for more housing etc (https://github.com/sgillen/sf-civic-digest).

It also have mine automatically grabs a spot at my gym when spots are released because I always forget.

I'm just playing with it, it's been fun! It's all on a VM in the cloud and I assume it could get pwned at any time but the blast radius would be small.

mvdtnz•23m ago

Am I understanding right that you're leaving AI slop comments on public city meetings? Proudly doing so?

gruez•21m ago

No? The comment was admittedly ambiguous but if you go to repo it's far clearer:

>I use it to give me a weekly digest of what happened in my neighborhood and if there are any public hearings or trash pickups I might want to attend.

WhrRTheBaboons•16m ago

that does not seem like something you need an 'autonomous' agent for.

Sohcahtoa82•11m ago

What would you propose as an alternative?

Anything not relying on an LLM likely means having to write bespoke scripts. That's not really worth the time, especially when you want summaries and not having to skim things yourself.

Going from doing it manually on a regular basis to an autonomous agent turns a frequent 5-15 minute task into a 30 second one.

butlike•6m ago

They've created a public bulletin board for themselves, like a café's blackboard, or a city telephone pole.

gruez•23m ago

>It also have mine automatically grabs a spot at my gym when spots are released because I always forget.

seems far more efficient/reliable to get codex/claude code to write and set up a bot that does this.

dyauspitr•14m ago

Agent based chron jobs mostly that work with other agents. It’s really nice if you want to tell your computer to do something repeatedly or in confluence with many other agents in a very simple way. Like check my email for messages from Nadia and send me a notification and turn on all the lights in my driveway when she gets there without having to actually get into the nuts and bolts of implementing it. It’s actually really powerful and probably what Siri should be.

earnesti•10m ago

I use it for a side project. I just put it on VPS, and then it edits the code and tests it. The nice thing is that I can use it on the go whenever I have spare moment. It is addictive, but way better addiction than social media IMO.

The thing where you give it access to all your personal data and whatever I haven't done and wouldn't do.

franze•5m ago

my claw controls my old M2 mac, mostly my claw uses Claude code to code

steipete•51m ago

OpenClaw creator here.

This was a privilege-escalation bug, but not "any random Telegram/Discord message can instantly own every OpenClaw instance."

The root issue was an incomplete fix. The earlier advisory hardened the gateway RPC path for device approvals by passing the caller's scopes into the core approval check. But the `/pair approve` plugin command path still called the same approval function without `callerScopes`, and the core logic failed open when that parameter was missing.

So the strongest confirmed exploit path was: a client that ALREADY HAD GATEWAY ACCESS and enough permission to send commands could use `chat.send` with `/pair approve latest` to approve a pending device request asking for broader scopes, including `operator.admin`. In other words: a scope-ceiling bypass from pairing/write-level access to admin.

This was not primarily a Telegram-specific or message-provider-specific bug. The bug lived in the shared plugin command handler, so any already-authorized command sender that could reach `/pair approve` could hit it. For Telegram specifically, the default DM policy blocks unknown outsiders before command execution, so this was not "message the bot once and get admin." But an already-authorized Telegram sender could still reach the vulnerable path.

The practical risk for this was very low, especially if OpenClaw is used as single-user personal assistant. We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI.

plestik•31m ago

There used to be a time where people who shipped CVEs took accountability.

lp0_on_fire•25m ago

Have you met these AI companies yet?

inetknght•11m ago

> There used to be a time where people who shipped CVEs took accountability.

I see you haven't heard of Microsoft...

mvdtnz•27m ago

What does Telegram/Discord have to do with anything? The OP never mentioned either of these software suites. In fact the only mention of Telegram anywhere in the entire thread is you copy-pasting this exact message.

nightpool•24m ago

Can you speak a little bit more to the stats in the OP?

* 135k+ OpenClaw instances are publicly exposed * 63% of those run zero authentication. Meaning the "low privilege required" in the CVE = literally anyone on the internet can request pairing access and start the exploit chain

Is this accurate? This is definitely a very different picture then the one you paint

machinecontrol•23m ago

The root issue is that OpenClaw is 500K+ lines of vibe coded bloat that's impossible to reason about or understand.

Too much focus on shipping features, not enough attention to stability and security.

As the code base grows exponentially, so does the security vulnerability surface.

dyauspitr•16m ago

This is a vibe based comment. It’s a generic attack with no meat.

Retr0id•14m ago

Aside from "exponentially" being hyperbolic, which part is unsubstantiated?

pezo1919•11m ago

This is a vibe based comment. It’s a generic attack with no meat.

williamstein•5m ago

The current OpenClaw GitHub repo [1] contains 2.1 million lines of code, according to cloc, with 1.6M being typescript. It also has almost 26K commits.

[1] https://github.com/openclaw/openclaw

rob•20m ago

Is this you?

https://x.com/steipete/status/2005451576971043097

> Confession: I ship code I never read. Here's my 2025 workflow.

Might want to start reading it I'd say.

popalchemist•14m ago

The level of seriousness of your attitude here is not commensurate to the blatant security problem you are creating in the world.

pym4n•13m ago

Guys, OpenClaw is a toy, that's it!

kube-system•12m ago

If someone could forward the SSH port from my VPS to access my instance, I already had bigger problems.