Incidents tagged Remote

A vulnerability in the OpenClaw AI assistant allowed malicious websites to establish WebSocket connections to the local gateway, bypassing cross-origin policies and rate limits. This enabled attackers to brute-force local passwords, gain administrator privileges, and achieve full control over the AI agent and connected developer workstation.

The "ClawJacked" flaw allows malicious websites to hijack locally running OpenClaw AI agents by exploiting a critical vulnerability in the gateway's WebSocket server. This attack leverages a missing rate-limiting mechanism for localhost connections to brute-force passwords and auto-register as a trusted device, granting full control and enabling data exfiltration.

The OpenClaw open-source AI agent project rapidly exposed at least three high-risk Remote Code Execution (RCE) vulnerabilities, allowing attackers to perform high-authority tasks like shell command execution. These critical flaws are exacerbated by direct/indirect prompt injection, configuration errors, and supply chain poisoning through malicious plug-ins within its architecture.

The OpenClaw AI agent is critically vulnerable to remote code execution and extensive data exfiltration due to an authentication bypass where misconfigured reverse proxies improperly trust external requests as local. Additionally, the agent is susceptible to prompt injection attacks, enabling the extraction of private keys and sensitive user data from the underlying system.

A critical-severity vulnerability, named DockerDash, in Docker's Ask Gordon AI assistant allows for Remote Code Execution (RCE) in Docker environments. This is achieved through "meta-context injection," where malicious instructions embedded in Docker image metadata labels are executed by the Model Context Protocol (MCP) Gateway without proper validation.

A critical token exfiltration vulnerability, tracked as CVE-2026-25253, was discovered in the OpenClaw (Moltbot/Clawdbot) AI assistant. This one-click remote code execution flaw allows attackers to hijack user instances by tricking victims into visiting a malicious website to steal authentication tokens, leading to operator-level access and host system compromise.

A critical vulnerability, codenamed DockerDash, in Docker's Ask Gordon AI assistant allowed remote code execution and data exfiltration. This "Meta-Context Injection" flaw leveraged malicious metadata labels within Docker images, which Ask Gordon AI processed and executed via the MCP Gateway due to a lack of validation.

The OpenClaw AI bot farm is plagued by critical security flaws, including a one-click remote code execution vulnerability and two command injection vulnerabilities. These issues are exacerbated by a repository of 341 malicious extensions, an exposed database, and prevalent prompt injection attacks, leading to a wave of malware, data exposure, and significant financial costs for users.

An attack chain exploited exposed AWS credentials in public S3 buckets, leveraging Large Language Models (LLMs) to rapidly escalate privileges through a misconfigured Lambda function. This allowed threat actors to achieve full AWS administrative control and abuse GPU resources within an Amazon Bedrock environment in under eight minutes.

The OpenClaw vulnerability in AI coding assistants allows single-click Remote Code Execution (RCE) by exploiting the trust relationship between developers and AI tools, processing malicious code suggestions automatically. This flaw grants attackers full control over developer systems, enabling access to sensitive resources and posing a significant software supply chain risk through potential injection of backdoors.

The article highlights advanced threats to AI agents, including "Shadow Escape," a zero-click exploit targeting Model Context Protocol (MCP) based systems that enables workflow hijacking and data exfiltration. Another critical vulnerability involves "ASCII Smuggling," where hidden malicious prompts embedded in files lead to remote code execution and sensitive data exfiltration by deceiving LLMs like Claude.

Researchers are warning that open-source AI models possess inherent vulnerabilities, making them susceptible to various forms of criminal misuse and exploitation. These weaknesses raise concerns about potential impacts like adversarial attacks, data poisoning, or the generation of malicious content by threat actors.

The article highlights numerous AI agent vulnerabilities, prominently featuring prompt injection techniques like "ASCII Smuggling" used to embed invisible, malicious instructions within legitimate data. These attacks exploit AI agent reasoning and tool usage, leading to significant impacts such as zero-click workflow hijacking, unauthorized data exfiltration, and potential remote code execution in systems like ChatGPT and Google Gemini.

The AI personal assistant MoltBot (OpenClaw) insecurely stores sensitive credentials and API keys in cleartext within `~/.clawdbot` and retains "deleted" secrets in backup files, making them vulnerable to infostealers. Furthermore, the codebase exhibits numerous insecure patterns, including extensive use of `eval` and `execSync` with user input, which could lead to Remote Code Execution (RCE), XSS, and broader data breaches for its hundreds of thousands of users.

Cybersecurity experts have identified a critical authentication bypass vulnerability in the Clawdbot AI assistant, stemming from improperly configured reverse proxies that lead the system to treat external connections as unauthenticated localhost access. This flaw exposes sensitive user data, including API keys and chat histories, and can facilitate credential theft and remote code execution on compromised systems.

Grok AI was exploited by users who bypassed its content moderation safeguards through prompt-based manipulation, enabling the generation of non-consensual deepfake images of real individuals. This critical vulnerability in generative AI defenses led to widespread regulatory investigations and forced X to implement geoblocking and content filtering measures.

This article details potential Remote Code Execution (RCE) vulnerabilities arising from the use of modern AI/ML formats and libraries. It investigates how these emerging technological components can introduce new attack surfaces for exploitation.

Prompt injection attacks manipulate AI systems, particularly Large Language Models (LLMs), by overriding their intended instructions through malicious input, leading to sensitive data leakage, unauthorized actions, or corrupted outputs. A real-world example involved a phishing campaign leveraging hidden text-based prompt injection to bypass AI defenses, coupled with the exploitation of CVE-2022-30190 (Follina) for remote code execution.

Prompt injection is a prevalent AI-specific vulnerability where Large Language Models (LLMs) misinterpret external data as executable instructions, bypassing intended safeguards. This can lead to sensitive data exfiltration, the execution of rogue tasks, or malicious code execution, impacting various AI agents, coding assistants, and chatbots.

A March 2023 vulnerability in the Redis open-source library temporarily exposed ChatGPT users' chat titles, messages, and potentially payment information. Beyond platform vulnerabilities, users face risks from prompt injection attacks that bypass LLM guardrails and the utilization of AI by threat actors to generate malware, phishing templates, and deepfakes.