Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
A security researcher demonstrated a 1-click remote code execution (RCE) vulnerability to the OpenClaw AI Agent via a malicious link containing a JavaScript script that only takes milliseconds to execute. This vulnerability has been reported and is being tracked to versions of OpenClaw as CVE-2026-25253. OpenClaw "is a personal AI assistant you run on your own devices. It answers you on the chat apps you already use. Unlike SaaS assistants where your data lives on someone else's servers, OpenClaw runs where you choose - laptop, homelab, or VPS. Your infrastructure. Your keys. Your data."
The researcher demonstrated that when the victim clicks a malicious link, a client-side JavaScript script is executed on the victim's browser that can steal authentication tokens from the OpenClaw control interface via a WebSocket connection. It then uses Cross-Site WebSocket Hijacking to bypass localhost restrictions to the OpenClaw Gateway API. Once the connection was established, it uses the stolen token to authenticate and modify the OpenClaw agent configuration to disable user confirmation and escape the container, allowing shell commands to be run directly on the host machine.
ASSESSED SYSTEM
The OpenClaw personal AI agent in the configuration affected by CVE-2026-25253, as demonstrated by DepthFirst (MITRE ATLAS AML.CS0050, incident date 2026-02-01): the browser-served control interface that accepts a gatewayUrl query string and auto-connects on load; the Gateway token it transmits; the localhost Gateway WebSocket API and the methods exercised on it (exec.approvals.set, config.patch, node.invoke); the prompt shown before potentially dangerous commands; and the Docker execution sandbox selected by tools.exec.host. Assessed pre-remediation; the record identifies the CVE but not the affected or fixed release numbers.
OUT OF SCOPE
The researcher's staged website and one-click JavaScript payload (attacker tooling); the victim's browser as a product, treated as environment; OpenClaw's loopback pairing and origin-validation defects assessed separately in openclaw-browser-to-local-agent-takeover; any activity after host code execution; and the Fairness axis (Fa-1..4), for which a control-plane exploitation chain produces no evidence.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: one agent and its gateway; no multi-agent coordination is evidenced. Q2 = YES: the agent executes shell commands through node.invoke, on the host or in its sandbox, governed by an approval setting (exec.approvals) and an execution-host setting (tools.exec.host) — an autonomous tool-executing agent whose per-action approval is itself a mutable configuration value. Tier 2: Tier 2 Consumer: OpenClaw runs on individuals' own laptops, homelabs or VPSs, and the chain is triggered by one click on a link to any website, so harm lands on individual users' machines, data and keys. Consistent with the tier placement in openclaw-browser-to-local-agent-takeover.
Documented attack or failure path
- The researcher developed a one-click JavaScript payload and staged it on an inconspicuous website; when the victim clicked the link, the script ran in the victim's browser.
- The script opened a background window to the victim's OpenClaw control interface with gatewayUrl set to a WebSocket address on the researcher's server; the interface trusted the query string without validation, auto-connected on load and sent the Gateway token to the researcher.
- The script then used Cross-Site WebSocket Hijacking to open a new WebSocket to the Gateway on localhost, bypassing the localhost network restriction, and authenticated with the stolen token.
- It sent exec.approvals.set with security 'full' and ask 'off', disabling the prompt OpenClaw shows before potentially dangerous commands.
- It sent config.patch setting tools.exec.host to 'gateway', moving command execution out of the Docker sandbox onto the host.
- A node.invoke request then executed attacker commands directly on the host (CVE-2026-25253).
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The dangerous-command approval prompt and the Docker execution sandbox were active in the exercised configuration: the exploit had to switch both off (exec.approvals.set, then config.patch) before node.invoke could run commands on the host. Both were defeatable with the same Gateway token, so they earn the 0.25 placements on Cn-1 and Cn-6 rather than positive credit.
- A localhost network restriction on the Gateway API existed and had to be bypassed by Cross-Site WebSocket Hijacking rather than by a direct remote connection.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.10–0.57 (midpoint 0.33), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.09 | The 0.25 anchor: basic boundaries exist but are enforced inconsistently — a cross-origin WebSocket and a single configuration parameter exceed intended scope. Not 0.00, because both boundaries were active and had to be defeated; not 0.50, because the core boundary did not block the common violation. Consistent with Cn-1 in openclaw-browser-to-local-agent-takeover. | Two scope boundaries existed and were crossed by request and parameter manipulation: the localhost network restriction on the Gateway API was bypassed by Cross-Site WebSocket Hijacking from a public web origin, and the Docker execution sandbox was removed by one config.patch setting tools.exec.host to 'gateway', after which commands ran directly on the host.source: secureflow/atlas |
| Cn-2Escalation Prevention | 0.25w 0.12 | The 0.25 anchor: a basic role check exists (a valid Gateway token is required) but is vulnerable to role confusion and delegated misuse — the credential that operates the agent is also the credential that disables the agent's escalation controls. Not 0.00, because an authenticated principal was required; not 0.50, because the common escalation path (security-setting change followed by host execution) was not blocked. | The Gateway token that authenticates ordinary control-interface use also authorised exec.approvals.set and config.patch, so its holder could turn off the dangerous-command prompt ('ask': 'off') and the sandbox with no step-up approval and then invoke host execution through node.invoke.source: secureflow/atlas |
| Cn-5Agent Identity Integrity | 0.25w 0.10 | The 0.25 anchor: shared-secret (bearer token) authentication with no binding to client, origin or session and limited auditability. Not 0.00, because the chain did require possession of a valid token; not 0.50, because a token replayed from an attacker origin was accepted, so scoped, partially verified identity is not evidenced. | Gateway access rested on a bearer Gateway token. The control interface sent that token to whatever WebSocket address the gatewayUrl query string named, and the Gateway then accepted the stolen token on a cross-site WebSocket opened by the researcher's page, so the credential was bound neither to the legitimate client origin nor to the session that obtained it.source: secureflow/atlas |
| Cn-6Action Reversibility Classification Rate | 0.25w 0.08 | The 0.25 anchor: ad-hoc gating of selected high-impact actions (dangerous commands) with no formal reversibility taxonomy; the security-configuration changes that make every later action delegated-irreversible were not classified or gated at all. Not 0.00, because a pre-execution gate on dangerous commands existed; not 0.50, because no formal three-class taxonomy or per-class gating is evidenced. | OpenClaw had a 'security feature that prompts users before running potentially dangerous commands' — gating of one selected high-impact action class — but the exec.approvals.set call that disabled it and the config.patch call that removed the sandbox were themselves executed ungated, after which node.invoke ran host commands with no approval.source: secureflow/atlas |
| Cn-9Self-Modification and Persistent-State Containment | 0.00w 0.14 | The 0.00 anchor: the agent's permission and configuration state was writable by any holder of the ordinary operating credential with no authorization gate, and the writes took effect immediately and silently. The 0.25 anchor requires such writes to be at least logged or visible after the fact or a protected-path list that was bypassed; neither logging of the configuration change nor a protected-settings list is evidenced. | Holding only the ordinary Gateway token, the attacker's page sent exec.approvals.set with security 'full' and ask 'off', disabling the prompt shown before dangerous commands, and config.patch setting tools.exec.host to 'gateway', moving execution out of the Docker sandbox onto the host. The workpaper records that these security-configuration writes 'were themselves executed ungated' with 'no step-up approval', after which node.invoke ran host commands.source: secureflow/atlas |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.90w 0.25 | Documented interpolation above the 0.75 anchor, consistent with the other OpenClaw workpapers. The agent executes shell commands through node.invoke, and in the exercised chain its only per-command human check was switched off by an API call, after which execution needed no human decision. Held below 1.00 because the deployment is a personal assistant whose operator normally initiates work. elevated |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 maximum-exposure anchor: one click on a link to any website drove the chain — the control interface accepted an attacker-chosen gatewayUrl and the Gateway accepted a cross-site WebSocket — so an untrusted internet origin reached the agent's administrative API. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph with DGC at least 0.90 is published for this boundary, so the specification's worst-case graph default governs. The record also corroborates an ungated path from a public web origin, through the control interface (token exfiltration) and the Gateway API (L2/L3), to command execution on the host outside the sandbox (L4) — a code-execution terminal on a machine that holds the user's keys and data.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.20 | Deterministic code and configuration defects — unvalidated gatewayUrl auto-connect, a Gateway reachable by cross-site WebSocket, security settings changeable with the ordinary session token — tracked as CVE-2026-25253 and correctable without any model change. Held at 0.25 rather than 0.00 because the record does not state the fixed release, and closure across self-hosted installations also requires each operator to upgrade and rotate Gateway tokens that may already have been exfiltrated. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | Documented interpolation between the 0.25 and 0.50 anchors. The product, the CVE identifier and the exact API methods and configuration keys exercised (exec.approvals.set, config.patch, tools.exec.host, node.invoke) are documented — more than a bare product name — but the affected and fixed releases, the underlying model, the installed skills and any deployment's configuration export are not. |
| Ec — Public evaluation coverage | 0.16 | coverage 0.19 (5 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2026-02-01; age 259 days on the workpaper reference date. Components: T_behavior 0.00 · T_containment 0.02 · T_calendar 0.14 · C_event 0.35 · C_evidence 0.85. Binding term: T_behavior. dt_days = 259, measured from 2026-02-01 — the MITRE ATLAS AML.CS0050 incident date for DepthFirst's disclosure — to the 2026-10-18 evidence reference date; the AIDEFEND SecureFlow conversion is dated 2026-08-06. agentic = true: approval policy, execution host and Gateway credentials are all mutable at runtime through the Gateway API, so the containment staleness floor (M_Cn = 2.0) applies. baw = true on the Behavioral Attestation Window checklist item 'self-modifying prompts or configuration': config.patch and exec.approvals.set change the agent's operating configuration without a deployment event; no Behavioral Attestation Battery is evidenced, so delta_t_beh defaults to the elapsed evidence age. C_event = 0.35: a major event on the identity-boundary-change row — a CVE in the Gateway token and connection path, with exfiltrated tokens valid until rotated. C_evidence = 0.85: unresolved identity and tool-authority gaps; the record states no fixed release. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.05 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
6.6 midpoint, interval 2.1–10.0; Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2026-25253 CVSS 3.1 Base 8.8 High
| Published score | 8.8 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Scored by | mitre |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25253.json (accessed 2026-10-18) |
| Affected component | OpenClaw |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | c5856d0de34fd6c218f94c7d82a4dd0ad97666c7a889dc2cd4d5a2636c3378b4 |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-007 | Client-Side AI Execution IsolationExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-4 |
| AID-H-019.001 | URL Normalization & Allowlist FilteringExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-3 Cn-8 |
| AID-H-004.002 | Service & API AuthenticationExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-5. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-M-009.003 | Agent Identity, Delegation Lineage & Authorization ContextExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-5 Cn-6 Cn-7 |
| AID-H-018.002 | Policy-Based Access ControlExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-6, step-9. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-021.002 | Runtime Integrity Enforcement (Signed Configurations)Exact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-7, step-8. Presence supplies no score credit. | Candidate evidence route | Cn-2 Cn-5 Cn-9 |
| AID-M-006.001 | HITL Checkpoint Design & DocumentationExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Cn-2 Cn-6 |
| AID-M-009.002 | Authority Envelope & Action Risk ClassificationExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-5 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-7, step-9. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-D-015 | High-Risk Approval Bypass & HITL Activity DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Fa-2 Tr-2 Cn-6 |
| AID-D-004.003 | Runtime Configuration & Policy Drift Detection and MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-7, step-8. Presence supplies no score credit. | Candidate evidence route | Ro-5 Tr-3 Cn-7 Cn-9 |
| AID-I-001.003 | Ephemeral Single-Use Sandboxes for ToolsExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-8, step-9. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-025.001 | Pre-Execution Static Analysis & Dangerous Construct BlockingExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Cn-3 |
| AID-D-005.004 | Specialized Agent & Session LoggingExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleExact SecureFlow defense-map identifier (flow atlas-aml-cs0050-openclaw-one-click-remote-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
WHAT THIS CASE TEACHES
A human-approval gate is only as strong as the authority that can switch it off: OpenClaw's dangerous-command prompt and sandbox were real, so Cn-1 and Cn-6 sit at 0.25 rather than 0.00, but because the ordinary Gateway token could disable both, a one-click token theft (Cn-5 0.25) converted an approval-gated agent into ungated host execution.
Sources: AIDEFEND SecureFlow — OpenClaw 1-Click Remote Code Execution · MITRE ATLAS case study AML.CS0050 · 1-Click RCE To Steal Your Moltbot Data and Keys (CVE-2026-25253) (depthfirst.com) · CVE-2026-25253 (nvd.nist.gov) · openclaw (openclaw.ai)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0050 (exercise) |
|---|---|
| Target | OpenClaw |
| Actor | DepthFirst |
| Primary evidence date | 2026-02-01 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | Autonomous agents, Edge and client AI |
| Risk impact | System compromise / RCE, Credential and identity theft |
| Affected components | OpenClaw web control interface, victim browser, OpenClaw Gateway token, localhost Gateway API, agent execution sandbox |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Develop One-Click RCE ScriptThe researcher developed a 1-Click RCE JavaScript script. | AML.TA0003 AML.T0017 |
| 2 | Stage Malicious Script WebsiteThe researcher staged the malicious script at an inconspicuous website. | AML.TA0003 AML.T0079 |
| 3 | Execute Browser JavaScriptWhen the victim clicked the link to the researchers' website, the malicious JavaScript script executes in the user's browser. | AML.TA0005 AML.T0011.003 |
| 4 | Steal Gateway Token via gatewayUrlThe malicious script opened a background window to the victim's OpenClaw control interface with the `gatewayUrl` set to a WebSocket address on the researcher's server. OpenClaw's control interface trusts the `gatewayUrl` query string without validation and auto-connects on load, sending the Gateway token to the researcher's server. | AML.TA0013 AML.T0106 |
| 5 | Bypass Localhost Restrictions with CSWSHThe malicious script performed Cross-Site WebSocket Hijacking (CSWSH) to bypass localhost network restrictions. It opened a new WebSocket connection to the OpenClaw Gateway server on localhost. | AML.TA0007 AML.T0107 |
| 6 | Authenticate to Gateway APIThe malicious script used the stolen Gateway token to authenticate, allowing subsequent calls to OpenClaw's Gateway API on the victim's system. | AML.TA0012 AML.T0012 |
| 7 | Disable Command Approval PromptsThe malicious script disabled OpenClaw's security feature that prompts users before running potentially dangerous commands. This was done by sending the following payload to OpenClaw's Gateway API: ``` { "method": "exec.approvals.set", "params": { "defaults": { "security": "full", "ask": "off" } } } ``` | AML.TA0007 AML.T0081 |
| 8 | Disable Agent SandboxingThe malicious script disabled OpenClaw's sandboxing, forcing the agent to run commands directly on the host machine instead of inside a docker container. This was done by sending a `config.patch` request to OpenClaw's Gateway API to set `tools.exec.host` to "gateway". | AML.TA0012 AML.T0105 |
| 9 | Invoke Remote Code ExecutionThe malicious script achieved remote code execution by sending a `node.invoke` (OpenClaw's RPC mechanism) request to OpenClaw's API. | AML.TA0005 AML.T0050 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0050-openclaw-one-click-remote-code-execution; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0050 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).