← Catalog
Research critical discovered 2026-02-01

OpenClaw 1-Click Remote Code Execution

A malicious link carrying a few milliseconds of JavaScript was enough to achieve remote code execution on the OpenClaw AI agent — modifying its configuration, harvesting credentials, and escaping to the host in a single click.

Execution Persistence Defense Evasion Credential Access Privilege Escalation

What happened

Documented by MITRE ATLAS as AML.CS0050, a researcher (DepthFirst) demonstrated a 1-click remote code execution against the OpenClaw AI agent. A malicious link containing a tiny JavaScript payload — executing in milliseconds — was enough to run attacker code in the agent’s context. From that foothold the attack modified the agent’s configuration, performed credential access, and escaped to the host.

It’s a reminder that agent front-ends are software with a browser-shaped attack surface: if an agent will follow a link and act on its content, a single click can chain into full compromise of the agent and the machine it runs on.

Why it maps to ATLAS

  • AML.T0011.003 — User Execution: Malicious Link: the entry point is a crafted link.
  • AML.T0050 — Command and Scripting Interpreter: the payload executes script/code in the agent.
  • AML.T0081 — Modify AI Agent Configuration: the agent’s own configuration is altered.
  • AML.T0106 — Exploitation for Credential Access: the foothold is used to harvest credentials.
  • AML.T0105 — Escape to Host: the attacker breaks out of the agent sandbox onto the host.

Detection notes

Links are untrusted input — an agent should never auto-execute their content. Lock agent configuration behind confirmation, sandbox the runtime so host escape isn’t possible, and watch for the tell-tale chain: link followed → config changed → host command spawned. Any one of those steps out of order for the task at hand is a strong alert.

Detection

Log sources

  • Agent link-handling + script-execution logs
  • Agent configuration-change audit
  • Host process + sandbox-escape telemetry

Signals

  • Agent following links that execute scripts in its context
  • Unexpected modification of agent configuration/settings
  • Agent process spawning host commands / breaking sandbox

Mitigations

  • Treat links/URLs as untrusted; never auto-execute their content
  • Lock agent configuration; require confirmation for setting changes
  • Strong sandboxing with no host escape; least-privilege agent runtime