Cyera researchers disclose OpenClaw vulnerability chain that enables full host takeover

Cyera researchers have disclosed four interrelated vulnerabilities in OpenClaw. Chained together, a combination the researchers named Claw Chain, they allow an attacker to steal data, escalate privileges and install a backdoor for persistent, covert access to a compromised host. The vulnerabilities have already been patched in current versions of the product.

How the vulnerability chain works

The four defects affect the OpenShell managed sandbox backend and the MCP loopback runtime. These are critical components that are supposed to restrict an AI agent's access to system resources and protect the host operating system from unauthorized interference.

OpenClaw is positioned as a secure, isolated environment where an agent can perform tasks without risk to the main system. Cyera researchers demonstrated that, with the right sequence of attacks, an attacker can break out of the sandbox and gain full control of the host.

The vulnerabilities work as a chain: the first bypasses one restriction at the sandbox level, the second opens access to privileged operations, the third expands access rights, and the fourth allows a persistent backdoor to be installed. Individually, each vulnerability is less critical, but combined they form a complete scenario for total system compromise. This shows why it matters to analyze not only individual defects but also how they interact.

What an attacker can do

Successful exploitation of the Claw Chain gives an attacker many ways to cause harm:

• Stealing sensitive data from the isolated sandbox environment and from the host's main operating system
• Escalating privileges from a restricted agent to full system administrator
• Installing a persistent backdoor for covert access without any user involvement
• Moving laterally across the corporate network through the compromised host to attack neighboring systems

A cybercriminal can use these capabilities not just for short-term data theft but for long-term infiltration and monitoring of the target organization. A persistent backdoor is especially dangerous because it lets the attacker return to the host at any time and cover the traces of the attack. In such a scenario, companies may remain unaware of unauthorized access to their infrastructure for a long time.

How it was fixed

Cyera responsibly disclosed the vulnerabilities to the OpenClaw developers before making them public, giving them enough time to develop and test patches. This is standard industry practice, known as responsible disclosure.

All four defects have been patched, and the fixes are available in current versions of the product. If you run OpenClaw in a production environment, you should update to the latest version immediately. The fixes have been tested and are ready for deployment.

In parallel, check your logs for suspicious activity during the period when the system was vulnerable, especially attempts to break out of the sandbox or unexpected privilege escalation operations.

What this means

OpenClaw is positioned as a secure, isolated environment for running AI agents, yet even carefully designed systems contain vulnerabilities. It is a reminder of a basic principle of cybersecurity: isolation is not a panacea, only one layer of defense. Integrating agents into production requires layered protection: access control, real-time activity monitoring, rapid response to patches and regular security audits of the code.