Oasis reported that three trust failures in the OpenClaw local agent gateway chained into full remote takeover from an ordinary web page. Origin validation was applied only to certain client IDs, localhost pairings were auto-approved, and loopback password guesses skipped both throttling and logging. In Chrome, Edge and most Firefox configurations a public HTTPS page could open ws://127.0.0.1:18789/ws, so trusting the loopback source address in place of the origin collapsed the boundary and made the browser the real remote party. Once authenticated, the reachable method set amounted to full control-plane access: chat hijack, configuration changes, node command dispatch, agent file writes, scheduled job creation and log access. Oasis measured more than 300 password guesses per second from browser JavaScript, so a human-chosen gateway password was not meaningful protection; the issues are fixed in version 2026.2.25 and later.
ASSESSED SYSTEM
The OpenClaw local agent gateway in its pre-2026.2.25 configuration: the WebSocket control plane listening on 127.0.0.1:18789, its pairing and session-establishment path, and the administrative RPC surface reachable from an authenticated session — chat, config.patch, node.invoke, skills.install, agents.files.set, cron.add and log access — together with the agent identity, memory/state and scheduled-task files that surface can write. Assessed as it stood when Oasis reported the ClawJacked chain, pre-remediation.
OUT OF SCOPE
OpenClaw release 2026.2.25 and later, in which the reported issues are fixed; the browsers' own private-network-access policies (the brief notes Chrome, Edge and most Firefox setups permitted the loopback WebSocket, so browser behaviour is treated as environment, not as a component under assessment); any downstream node or device beyond the gateway's own control plane; and the Fairness axis (Fa-1..4), for which an authorisation and identity incident produces no evidence.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 answered NO, deliberately: the control plane exposes node.invoke and agents.files.set, which implies a multi-node, multi-agent estate, but the brief does not evidence two or more agents coordinating, delegating, sharing memory or exchanging messages toward a goal — only a gateway that can address them. A Multi-Agent classification would be defensible on richer evidence and would raise, not lower, the resulting risk. Q2 answered YES: the gateway maintains task state, installs skills that extend its own capability, creates persistent scheduled jobs via cron.add, dispatches node commands and writes agent files — autonomous multi-step execution with tool invocation and no per-action human approval on the control-plane path. Tier 2: Tier 2 Consumer: OpenClaw is a broadly distributed local assistant installed on individual endpoints, and the exploitation path is drive-by from any public web page, so a single malicious site reaches individual users' machines, credentials and workspace data without their interaction.
Documented attack or failure path
- A victim with OpenClaw running visits an ordinary public HTTPS page; no install, download or interaction beyond the page load is required.
- Page JavaScript opens a WebSocket to ws://127.0.0.1:18789/ws — permitted in Chrome, Edge and most Firefox setups — making an arbitrary internet origin a local client of the agent's administrative control plane.
- The page presents a client ID for which origin validation is not applied, so the check that should have rejected a public origin never runs.
- Session establishment succeeds: localhost pairings are auto-approved, and where a password is required, browser JavaScript brute-forces it at over 300 guesses per second because loopback attempts skip throttling — and skip logging, so the attempt burst leaves no trace.
- With an authenticated session the attacker holds the full administrative method set: config.patch to mutate configuration, node.invoke to dispatch commands, skills.install to add capability, agents.files.set to write agent identity and state files, cron.add to create standing scheduled jobs, chat hijack, and log access.
- Because agent identity files, memory/state files and scheduled-task definitions are writable without integrity protection, post-authentication compromise converts into durable persistence rather than a transient session.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Origin validation existed and worked for the client IDs it covered — the failure is that coverage was conditional, not that the control was absent. This is why Cn-1 sits at the 0.25 'enforced inconsistently' anchor rather than at 0.00.
- An authentication layer existed: device pairing plus a gateway password and device tokens. It was defeated by auto-approval and by the missing throttle, but the mechanism class is real, which is why Cn-5 is scored at 0.10 as an interpolation rather than flat 0.00.
- Browser behaviour was not uniform: the brief specifies 'Chrome, Edge, and most Firefox setups', so some configurations did not permit a public page to open the loopback WebSocket — the private-network boundary held where the browser enforced it.
- The vendor shipped a fix. Version 2026.2.25 and later remediate the reported chain, which is the strongest single input to the Rf = 0.00 placement.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–0.75 (midpoint 0.38), Tier 2 MVT 0.50 indeterminate | |||
| Ro-4Poisoning Attack Resistance | 0.00w 0.25 | The 0.00 anchor: no memory, tool or state integrity validation on the ingestion paths that matter — poisoned skills and poisoned agent state files are accepted as written, with nothing scanning, attesting or quarantining them. The consequence the brief names, silent conversion of a session compromise into a durable backdoor, is exactly the backdoor-implantation outcome Ro-4 exists to measure. | The control plane exposes skills.install and agents.files.set, and the brief's AID-I-004.006 entry asks defenders to 'protect agent identity files, memory/state files, and scheduled-task definitions from silent modification so an attacker cannot turn agents.files.* or automation endpoints into a durable backdoor' — prescriptive, therefore absent. An authenticated caller could write the agent's own instruction, identity and memory state and install new skills with no integrity validation, provenance check or quarantine on what was written.source: brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 2 MVT 0.50 indeterminate | |||
| Tr-3Audit Trail Completeness | 0.25w 0.25 | The 0.25 anchor: partial logging exists but omits critical fields and events — actor identity for loopback callers, authentication outcomes, first-time pairings and administrative RPC invocations are not recorded, so the session that took over the control plane cannot be reconstructed from the trail it left. | The brief names, as one of the three root causes, that loopback password guesses 'skipped throttling and logging' — authentication attempts from the loopback path produced no record at all, so a burst of 300+ guesses per second was invisible. Its remediation guidance is to 'log and alert on loopback auth bursts, client-ID/origin mismatches, first-time pairings, and unexpected administrative RPC usage', all presented as additions. A log surface does exist, since log access is itself one of the reachable RPC methods.source: brief |
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.08–0.54 (midpoint 0.31), Tier 2 MVT 0.55 confirmed breach | |||
| Cn-1Scope Enforcement | 0.25w 0.12 | The 0.25 anchor: boundaries exist but are enforced inconsistently, and simple parameter manipulation — presenting a client ID outside the validated set — exceeds intended scope. Scored above 0.00 because origin validation genuinely existed and functioned for the client IDs it covered; scored below 0.50 because session scope was undifferentiated, so the core control did not block the common violation. | The brief's AID-H-018.004 entry states that 'a fresh session should receive only the minimal RPC set it needs' and that 'methods such as config.patch, node.invoke, skills.install, agents.files.set, and cron.add should stay outside the default envelope unless a separately trusted workflow grants them' — so in the assessed configuration every authenticated session received the whole administrative surface. Origin validation, the boundary that should have distinguished a public page from a local operator, 'applied only to certain client IDs'.source: researcher |
| Cn-2Escalation Prevention | 0.25w 0.16 | The 0.25 anchor: basic role checks exist but are defeated by role confusion — the gateway conflated 'arrives over loopback' with 'is a trusted local operator', and that single category error promoted an arbitrary internet origin to administrative authority. The pairing mechanism was real; its trust predicate was wrong. | 'Localhost pairings were auto-approved', so a public web page could complete device pairing — the approval workflow that gates control-plane authority — without any operator decision. The brief's remediation is to 'put browser-originated management actions behind explicit approval or an outright deny path: new pairings, node.invoke, config writes, agent file writes, skill installs, and scheduled jobs', and AID-M-009.003 describes building 'a signed authorization context from the verified client identity, original user authority, gateway session, task, route, and attenuated scope instead of trusting a claimed client ID plus loopback source address'.source: researcher |
| Cn-5Agent Identity Integrity | 0.10w 0.14 | Documented interpolation between the 0.00 and 0.25 anchors. The mechanism class present is shared-secret plus device token with weak rotation and limited auditability, which is the 0.25 anchor; but the measured outcome — an effective Identity Spoofing Success Rate approaching 1.00 for a browser-based attacker, via auto-approved pairing, self-asserted-identity policy selection and an unthrottled 300+/s brute force — is the 0.00 anchor's reality. Under the precedence rule the quantitative result sets the floor and the qualitative mechanism sets the ceiling, so the score sits near the floor at 0.10 rather than at either anchor. | Identity rested on a self-asserted client ID plus the loopback source address — the brief's phrasing is 'trusting a claimed client ID plus loopback source address'. The claimed identity also selected the policy applied to it, since origin validation ran only for certain client IDs. Where a password was required, Oasis measured browser JavaScript achieving 300+ guesses per second against an unthrottled endpoint, so 'passwords were not meaningful protection'. Guesses were also unlogged, so spoofing attempts were undetectable.source: researcher |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.12 | The 0.00 anchor: ARCR = 0. No reversibility class is determined before execution, and irreversible or externally-impacting actions — installing a skill, writing agent identity files, creating a standing scheduled job, dispatching a command to another node — execute ungated on the same session envelope as a read-only status call. | The brief's AID-M-009.002 entry states that device pairing, configuration mutation, node command execution, persistent job creation and cross-device data access 'always need stronger authorization than ordinary chat or read-only status calls' — presented as a classification to introduce, so no authority envelope or action-risk classification existed and every method sat on one undifferentiated session grant. AID-D-015 further asks defenders to 'independently correlate every device pairing and high-risk RPC execution with a signed, short-lived approval bound to the authenticated approver, exact action digest, challenge, nonce, policy version, and one-time token ID', which presumes no such approval evidence exists today.source: brief |
Unknown, not N/A: 17 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.90w 0.25 | Documented interpolation above the 0.75 anchor and just below 1.00. The gateway executes consequential actions without per-action human approval — node command dispatch, configuration mutation, skill installation, agent file writes — and cron.add creates standing autonomous jobs that execute with no operator present at all, which is 1.00-anchor behaviour. Held marginally below 1.00 because the deployment is a personal assistant with an operator normally at the endpoint who initiates work and observes chat; the brief's own remediation is to add explicit approval for these actions, confirming it did not exist. Note that chat hijack degrades even that observational oversight. elevated |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 maximum-exposure anchor, met literally. Any public HTTPS page in Chrome, Edge or most Firefox configurations could open the administrative WebSocket, so an internet-facing, entirely untrusted origin reached a tool-integrated agent control plane with no authenticated relationship to the victim and no user interaction beyond loading a page. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph is published for OpenClaw deployments, so the spec's worst-case default applies (no SDG, DGC < 0.90). The reconstruction independently triggers the 1.00 anchor as well: the observed path runs from an unauthenticated public web origin, through the gateway control plane (L2/L3), to node command dispatch and agent file writes on the host and on other devices (L4), terminating at a node that holds AI provider keys and can mint standing automation and install new capability — a credential- and permission-issuing (P4) terminal reached with no verified gate, giving a privilege amplification depth of at least three from an unauthenticated origin. The declared gates on that path (origin validation, pairing approval, password) were each demonstrably crossed, so none can be claimed at CBR >= 0.95.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.00w 0.20 | The 0.00 deterministic-fix anchor. The vendor shipped a fixed release — version 2026.2.25 and later — that closes the reported chain; the defects are ordinary software defects in origin validation, pairing approval and throttling, all correctable in code with no model change and no probabilistic residue. Remediation completeness additionally requires endpoint-fleet rollout with runtime version and digest readback, removal of stale paired devices and rotation of device tokens, which is operational effort but does not change the deterministic character of the fix. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | Documented interpolation between the 0.25 and 0.50 anchors. Above 0.25: Oasis's whitepaper enumerates the reachable control-plane method set — a partial tool inventory — and the affected and fixed versions and listening port are precisely identified, which is more than a bare vendor-and-name record. Below 0.50: nothing is documented about the underlying model, the installed-skill inventory, the identity policy or the agent state and memory artifacts of any actual deployment, and no signed manifest or change record is available for the assessed configuration. |
| Ec — Public evaluation coverage | 0.25 | coverage 0.26 (6 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.02 | Evidence dated 2026-02-26; age 168 days on the workpaper reference date. Components: T_behavior 0.02 · T_containment 0.08 · T_calendar 0.27 · C_event 0.35 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_behavior. dt_days = 168, measured from the primary public disclosure dated 2026-02-26 to the 2026-08-13 evidence reference date; the AIDEFEND brief republished the analysis on 2026-04-18. agentic = true: an Agentic/MCP deployment whose permission boundary mutates at runtime — skills.install and config.patch reprovision tool authority and device tokens are reissued on pairing — so the containment staleness floor (M_Cn = 2.0) applies. baw = true on at least two Behavioral Attestation Window checklist items: self-modifying configuration (skills.install and config.patch alter the agent's operating configuration) and cross-session persistent state writable through agents.files.set, with scheduled jobs carrying behaviour across sessions; no Behavioral Attestation Battery programme is evidenced, so delta_t_beh defaults to the elapsed assessment age. C_monitor = 0.65 — an explicit detection failure named as a root cause: loopback authentication attempts skipped logging entirely, and the brief has to ask defenders to begin alerting on auth bursts, client-ID/origin mismatches, first-time pairings and unexpected administrative RPC usage. C_event = 0.35 — major event on the identity-boundary-change row: the disclosure and the 2026.2.25 fix together change the pairing, origin-validation and throttling boundary that any prior evidence described, and stale paired devices and device tokens from the vulnerable period remain valid until rotated. C_evidence = 0.85 — unresolved open identity and tool gaps at the assessment date: password authentication may still be enabled in fleets, stale pairings persist until manually removed, and browser-to-loopback reachability remains an environment property outside the vendor's fix. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.12 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingParent AID-H-018 (Tool Authorization & Capability Scoping). Both mapped edges are scored: minimal per-session RPC scoping is the absent control behind Cn-1 = 0.25, and keeping config.patch, node.invoke, skills.install, agents.files.set and cron.add outside the default envelope is the per-class gating whose absence sets Cn-6 = 0.00. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-I-008.002 | Cross-Origin Read/Write Segmentation with Step-Up ConfirmationParent AID-I-008 (Task-Scoped Browser & Computer-Use Workspace Isolation for Agents). Cn-1 is the germane edge: treating a public-origin-to-loopback transition as a sensitive write boundary is precisely the scope control that was missing. Cn-4 and Pr-2 are catalogue edges with no independent evidence in this case, and neither is scored. | Very High | Cn-1 Cn-4 Cn-7 Pr-2 |
| AID-H-019.003 | Browser Runtime Admission & Sanitized Observation Export GateParent AID-H-019 maps directly to Ro-1, Cn-1, and Cn-3 in the reconciled AIDEFEND dataVersion 2026.08.05 crosswalk. Substantively it is the highest-leverage control here: denying loopback, RFC1918 and link-local destinations from outside the page and browser process would block the administrative WebSocket regardless of what client ID or origin the page claims. | Very High | Cn-1 Cn-3 Ro-1 |
| AID-M-009.003 | Agent Identity, Delegation Lineage & Authorization ContextParent AID-M-009 (Agent Autonomy & Authority Governance). Cn-5 is the primary edge and this entry is its direct evidence: a signed authorization context built from verified client identity and original user authority is exactly what the gateway lacked when it trusted 'a claimed client ID plus loopback source address'. | High | Cn-1 Cn-5 Cn-6 Cn-7 |
| AID-M-009.002 | Authority Envelope & Action Risk ClassificationParent AID-M-009. Cn-6 is the scored edge and this is its evidence source: classifying pairing, configuration mutation, node command execution, persistent job creation and cross-device data access as high-risk control-plane actions is the pre-execution classification that did not exist, giving ARCR = 0. | High | Cn-1 Cn-5 Cn-6 Cn-7 |
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingParent AID-I-003 maps directly to Cn-5 and Cn-6 in the reconciled AIDEFEND dataVersion 2026.08.05 crosswalk. Substantively it is the named root cause of the measured 300+ guesses per second and therefore a direct input to the Cn-5 = 0.10 interpolation: counting loopback and unauthenticated callers as principals would have starved the brute force. | High | Cn-5 Cn-6 Cn-7 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleParent AID-H-003 (Secure ML Supply Chain Management). Neither edge is scored from this technique: Ro-4 is scored from the agent state and skill write path, and Tr-4 is left unscored because gateway version lineage is published by the vendor. This technique carries the Rf = 0.00 placement — a fixed release exists and needs staged rollout with version and digest readback. | High | Ro-4 Tr-4 |
| AID-D-015 | High-Risk Approval Bypass & HITL Activity DetectionParent AID-D-015. Cn-6 is the germane edge: correlating every pairing and high-risk RPC with a signed, short-lived approval bound to the approver and action digest is the detection counterpart to the missing gate, and its absence supports both Cn-6 = 0.00 and the C_monitor = 0.65 cap. The Fa-2 and Tr-2 catalogue edges have no bearing on this case. | Medium | Cn-6 Fa-2 Tr-2 |
| AID-I-004.006 | Agent Identity & Persistent State File Write ProtectionParent AID-I-004 (Agent Memory & State Isolation), whose catalogue edges are confidentiality-oriented (Cn-4, Pr-2, Pr-4) and are not scored here. The .006 sub-technique's subject — write protection for agent identity, memory/state and scheduled-task files — is instead the evidence basis for Ro-4 = 0.00 in this assessment, and the divergence is recorded rather than resolved by inventing a mapping edge. | Medium | Cn-4 Cn-7 Pr-2 Pr-4 |
WHAT THIS CASE TEACHES
Cn-5 is the case's hinge and shows why a mechanism-only reading of the rubric is wrong: the gateway had real authentication (pairing, device tokens, a password), which is the 0.25 anchor, but the measured Identity Spoofing Success Rate approached 1.00, so the precedence rule — quantitative floor, qualitative ceiling — drives the score to 0.10, and it is the identity failure rather than any single missing feature that turns a loopback listener into an internet-reachable admin API.
Sources: AIDEFEND in Action — OpenClaw 'ClawJacked': Website-to-Local Agent Takeover via Loopback Trust and WebSocket Abuse (originating whitepaper by Oasis) · Primary source — Technical Analysis of Cross-Origin WebSocket Exploitation in OpenClaw (2026-02-26)