The OpenClaw Security Crisis: 135,000 Exposed AI...

On February 3, 2026, security researchers disclosed CVE-2026-25253 in OpenClaw — the fastest-growing open-source AI agent, then sitting at 346,000 GitHub stars. The vulnerability was severe: CVSS 8.8, one-click remote code execution via a WebSocket origin validation gap that let an attacker hijack any running OpenClaw instance, even those configured to listen only on localhost, simply by getting the user to visit a malicious webpage. Within four days, nine more CVEs dropped. By early April, rese