Critical Zero-Day: Impersonation Vulnerabilities in OpenClaw & Hermes on Slack, Teams, Discord
Key Questions
What vulnerabilities were found in OpenClaw and Hermes?
Five vulnerabilities enable impersonation via DMs on Slack, Teams, and Discord. Users are advised to treat every DM as untrusted while patches remain pending.
What new guides address OpenClaw security?
New practical guides cover onboarding OpenClaw agents with IdentyClaw Passport and MCP Security, including three trust zones and a 30-minute audit template. OpenClaw v2026.7.2 Beta 3 adds channel boundary hardening.
Who should follow the urgent security advisory?
The advisory targets self-hosters and enterprise users of OpenClaw on messaging platforms, with updates from the OpenClaw News and Operator Intelligence feed.
Five vulnerabilities enabling impersonation via DMs. Treat every DM as untrusted. Patches pending. New practical guides: IdentyClaw Passport and MCP Security. v2026.7.2 Beta 3 introduces channel boundary hardening. New analysis reinforces architecture-level risks; DSH dashboard hole and Claude Code steganography highlighted. MCP server risks article underscores need for centralized secrets. A new guardrailed incident assistant pattern (OCI) demonstrates safe production use with read-only ServiceAccount, redaction, and human-in-the-loop, directly addressing ambient authority risks.