Active exploitable vulnerabilities & trojanized skills
Key Questions
What new CVEs were identified in OpenClaw and related AI agent tools?
Recent disclosures include CVE-2026-62200 (Git ext transport authentication bypass, CVSS 8.8), CVE-2026-62209 (authorization bypass in ClickClack, CVSS 8.1), and CVE-2026-62226 (authorization bypass in browser act route, CVSS 8.5). Additional flaws in OpenClaw enable WhatsApp-to-host attack chains with CVSS scores of 8.4-8.8. These affect versions prior to 2026.6.6 and allow path traversal and command injection.
What is the first documented fully autonomous AI ransomware attack mentioned?
JadePuffer used an LLM agent to exploit Langflow CVE-2025-3248, steal credentials, move laterally, and encrypt Nacos configs with no human involvement. This follows an earlier case of an LLM agent performing post-exploitation after the Marimo CVE-2026-39987 exploit. Five Eyes warns that such autonomous AI cyberattacks could emerge within months.
How do trojanized skills and prompt injections impact AI agent security?
ClawHub scanning bypasses allow malicious plugins to evade detection, while indirect prompt injection via GitHub and self-attack command injection enable skill compromise. Agent Threat Rules (ATR) provide over 400 rules for detecting these issues, and practical screening identified threats in 341 malicious plugins. Skill engineering is framed as a new attack surface for frameworks like OpenClaw.
Claude scripts for CVE-2025-55182; 360 WebSocket 0Day, DeepSeek-Claw/NemoClaw PoCs. Indirect prompt injection via GitHub; Claw Chain CVEs (CVE-2026-44112 TOCTOU, CVE-2026-44115). Practical screening from 341 malicious ClawHub plugins. Self-attack command injection; Agent 'blackening' case study. Real-world case of LLM agent used for post-exploitation after Marimo CVE-2026-39987 exploit — first documented autonomous AI cyberattack. AI-assisted reverse engineering with OpenClaw + MCP provides practical technique for automating vulnerability research. Agent Threat Rules (ATR) offer 400+ rules for detecting prompt injection and skill compromise. ClawHub scanning bypass techniques enable trojanized skills to evade detection. AgentGG found 5 zero-days in OpenClaw using AI agent reasoning. Skill engineering article frames skills as new attack surface. Sophos X-Ops demo of OpenClaw hacking internal network in 3 hours. Hermes hack demo shows cross-framework attack triggering zero-trust defense. New: VulnClaw — AI Agent + MCP penetration testing tool, adds practical exploitation capability for labs. New: First documented fully autonomous AI ransomware attack (JadePuffer) using LLM agent to exploit Langflow CVE-2025-3248, steal creds, move laterally, encrypt Nacos configs — no human in loop. Five Eyes warns timeline is months, not years. New: WhatsApp-to-Host attack chain using three OpenClaw flaws (command injection, path traversal) — CVSS 8.4-8.8, fixed in v2026.6.6, enables full host compromise from WhatsApp without initial foothold. Path traversal bypasses sandbox bind mounts to read SSH keys, AWS creds, Docker socket. New: CVE-2026-62200 — Git ext transport authentication bypass in OpenClaw <2026.6.1, CVSS 8.8, low-privilege to root, expands lateral movement surface. New: CVE-2026-62209 — authorization bypass in ClickClack agent-mode dispatch, CVSS 8.1, affects v2026.5.10-beta.1 to before 2026.6.5. New: CVE-2026-62226 — authorization bypass in browser act route, CVSS 8.5, affects v2026.3.28–2026.5.19.