AIDEFEND in Action AIA-0006 Validated Research Published: Apr 18, 2026

OpenClaw 'ClawJacked': Website-to-Local Agent Takeover via Loopback Trust and WebSocket Abuse

Oasis Security showed in its early-2026 tests that a malicious website could open a WebSocket to OpenClaw's localhost gateway (the local management entry point for an agent platform), skip origin checks by claiming a CLI client, then brute-force password auth because loopback attempts were exempt from rate limits. The fix is already out; the lesson is to stop treating localhost as identity and to scope every agent session and RPC method as privileged.

Local Agent TakeoverAuthentication BypassIdentity & AccessAgentic AIWebSocket Security
7 applicable AIDEFEND defenses
Source: Technical Analysis of Cross-Origin WebSocket Exploitation in OpenClaw 
Author: Elad Luz
Original article: Feb 26, 2026

Threat Analysis

  • Three trust failures chained together. Origin validation applied only to certain client IDs, localhost pairings were auto-approved, and loopback password guesses skipped throttling and logging.
  • The browser was the real remote party. In Oasis's early-2026 browser tests, Chrome, Edge and most Firefox configurations allowed a public HTTPS page to reach loopback, while Safari blocked the insecure WebSocket. In those tested configurations, a public HTTPS page could open ws://127.0.0.1:18789/ws; trusting loopback over origin collapsed the boundary.
  • Authenticated impact was full control-plane access. The whitepaper shows reachable methods for chat hijack, config changes, node command dispatch, agent file writes, scheduled jobs, and log access.
  • Passwords were not meaningful protection. Oasis measured 300+ guesses per second from browser JavaScript, so a human-chosen gateway password was effectively bypassable.
  • Local agent gateways are admin APIs. Pairing, session creation, and high-impact RPC methods need the same hardening you would apply to any internet-facing control plane.

Applicable AIDEFEND Defenses (7)

AID-H-018.004
Intent-Based Dynamic Capability Scoping
High
With a verified Gateway dispatcher integration, derive a signed RPC-name grant from an independently authenticated subject and trusted task. Exclude unnecessary administrative methods and verify expiry and the atomic action budget on each dispatch. The method limits names, not arguments or destinations inside an allowed RPC. The claimed CLI ID and loopback source cannot supply the trusted subject or authorize a wider grant.
AID-M-009.003
Agent Identity, Delegation Lineage & Authorization Context
High
Build a signed authorization context from the verified client identity, original user authority, gateway session, task, route, and attenuated scope instead of trusting a claimed client ID plus loopback source address. This control supplies accountable identity and delegation facts; AID-H-018.004 consumes them and owns the decision that a browser-opened WebSocket cannot receive CLI- or node-grade capabilities.
AID-M-009.002
Authority Envelope & Action Risk Classification
High
Treat device pairing, configuration mutation, node command execution, persistent job creation, and cross-device data access as high-risk control-plane actions that always need stronger authorization than ordinary chat or read-only status calls.
AID-I-003.002
Identity, Session & API Rate-Limit Throttling
High
The Gateway must apply atomic attempt limits to loopback and unauthenticated password guesses as well as other callers. This addresses the source's measured hundreds of guesses per second and constrains brute force; it does not guarantee that a weak password cannot be guessed before the limit. High-entropy tokens, Origin checks and pairing authorization remain necessary.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Inventory every deployed OpenClaw gateway version affected by ClawJacked, roll out the fixed release through staged endpoint rings, and verify by runtime version and digest readback that no vulnerable build remains in the incident-scoped fleet. This owns software remediation and rollout completion; independent replay of the loopback exploit path belongs to AID-E-004.
AID-D-015
High-Risk Approval Bypass & HITL Activity Detection
Medium
Independently correlate every device pairing and high-risk RPC execution with a signed, short-lived approval bound to the authenticated approver, exact action digest, challenge, nonce, policy version, and one-time token ID. Alert when the execution is missing approval evidence or uses expired, mismatched, replayed, or silently bypassed confirmation state.
AID-I-004.006
Agent Identity & Persistent State File Write Protection
Medium
Post-auth compromise should not automatically become persistent compromise. Protect agent identity files, memory/state files, and scheduled-task definitions from silent modification so an attacker cannot turn agents.files.* or automation endpoints into a durable backdoor.

What Defenders Should Do Now

  • Inventory OpenClaw or similar local agent gateways across endpoints, especially anything listening on port 18789, and upgrade all instances to version 2026.2.25 or later.
  • If password authentication is still enabled, prefer high-entropy tokens, remove stale paired devices, and rotate device tokens after any suspected exposure.
  • Put browser-originated management actions behind explicit approval or an outright deny path: new pairings, node.invoke, config writes, agent file writes, skill installs, and scheduled jobs.
  • Log and alert on loopback auth bursts, client-ID/origin mismatches, first-time pairings, and unexpected administrative RPC usage.
  • Audit what each OpenClaw instance can actually reach - AI provider keys, messaging channels, shell execution, workspace files, and logs - then cut standing access to the minimum necessary.

1 additional consideration

Browser-to-localhost exposure regression testing

Beyond the techniques mapped above, teams shipping local AI assistants should also add release-time regression testing that treats arbitrary websites as the attacker and probes localhost HTTP and WebSocket surfaces for origin confusion, silent pairing, and loopback trust assumptions. The victim uses an ordinary browser, not an operator-controlled AI browser task. AI browser-context admission and Playwright write-confirmation methods therefore are not credited for this connection; Gateway authentication, Origin policy and pairing controls must protect the actual boundary.
Recommendation: Maintain a harness that opens the local service from a public HTTPS page in Chrome, Edge, Firefox, and Safari, then verifies origin checks, pairing prompts, auth throttling, and administrative method exposure before each release.

Conclusion

OpenClaw is a strong reminder that localhost is not a security boundary when the browser can still speak WebSocket to it. The defensive floor is to bind agent authority to verified runtime identity, narrow every session and RPC method to the smallest usable scope, and test local agent gateways the way you would test any privileged control-plane API.

Last updated: