Loading story…
OpenClaw, a self-hosted AI agent that rapidly became GitHub’s most-starred repository, triggered an unusual surge of vulnerability disclosures that exposed friction between GitHub Security Advisories (GHSAs) and the traditional CVE assignment pipeline. In late February, OpenClaw published 200+ GHSAs within roughly three weeks (with reports citing ~255 total advisories), covering issues such as command execution controls, authorization checks, allowlist enforcement, and plugin boundary weaknesses; many advisories lacked corresponding CVE identifiers due to the volume outpacing normal CVE processing.
The situation escalated when vulnerability intelligence firm VulnCheck asked the CVE Project researcher working group to call “DIBS” on 170 OpenClaw advisories without CVE IDs—an informal CNA coordination signal indicating intent to evaluate and potentially assign CVEs—citing customer demand and a desire to ensure coverage “before they are weaponized.” The request prompted pushback within the CVE community (including from MITRE’s TL-Root) that DIBS is intended for individual vulnerabilities meeting defined criteria, not as a mechanism to broadly categorize or preemptively claim large sets of supplier advisories; separately, a podcast episode referenced an “OpenClaw bot” allegedly moving from research into malicious activity, but provided insufficient detail to corroborate or connect it to the GHSA/CVE tracking dispute.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
In response to the disclosure surge, Jerry Gamblin created a cross-referencing tracker to map OpenClaw advisories between GitHub advisory data and CVE sources, including handling naming transitions such as Clawdbot, Moltbot, and OpenClaw. The effort aimed to help defenders follow advisories that might otherwise be missed in CVE-centric workflows.
MITRE’s TL-Root responded that DIBS is meant for individual vulnerabilities meeting CVE criteria, not bulk reservation of advisories for a popular supplier. The request was subsequently closed, and VulnCheck acknowledged that the mass-DIBS format was likely inappropriate, though other CVE assignment paths remained possible.
VulnCheck attempted to "call DIBS" on 170 OpenClaw advisories that lacked CVE IDs, citing customer interest and concern that the vulnerabilities could be weaponized. The move was intended to coordinate possible CVE assignment for the advisories.
As OpenClaw’s advisory count grew to roughly 255, only a subset had corresponding CVE IDs, creating visibility gaps for enterprises that rely on CVE-based scanners, SBOM tools, patch management, and compliance workflows. The episode highlighted how GHSA publication can outpace traditional CVE assignment processes.
Shortly after the OpenClaw project went viral and became one of GitHub’s most-starred repositories, it started issuing GitHub Security Advisories at an unusually high rate. Over the following few weeks, the project published hundreds of GHSAs, many without CVE IDs.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
gbhackers.com
Open sourcecybersecuritynews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT published advisories **2026-0836** and **2026-0866** covering **multiple vulnerabilities in OpenClaw**, indicating that the product is affected by more than one security flaw and that the issue set warranted repeated or updated notification. The advisories identify OpenClaw as the impacted technology but do not provide a public synopsis in the referenced notices. Organizations using **OpenClaw** should review both dCERT advisories to determine affected versions, vulnerability details, and available mitigations or patches. The paired notices suggest ongoing vulnerability handling around the product, making prompt validation of exposure, patch status, and any vendor remediation guidance a priority.
Jun 29, 2026
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
Security researchers and media reports warned that the open-source AI agent **OpenClaw** (formerly *Moltbot/Clawdbot*) can be abused via its *ClawHub* “skills” ecosystem, with findings that **~7.1% of marketplace skills** contributed to exposure of **API keys, credentials, and credit card data** due to problematic `SKILL.md` instructions. Snyk highlighted a particularly severe example, **buy-anything skill v2.0.0**, which performs credit-card “tokenization” in a way that can be used to **pilfer financial details** before prompting users to provide card information. Additional research described **indirect prompt-injection** risk: a malicious Google document can coerce OpenClaw into integrating a new **Telegram bot**, enabling follow-on actions such as **file exfiltration** and deployment of a **Sliver** command-and-control beacon for persistence, with potential for **privilege escalation, lateral movement, and ransomware execution**. Separately, one report noted OpenClaw’s move to scan skills with **VirusTotal**, but also emphasized that signature-based scanning is not a complete mitigation for **prompt-injection** and other logic-level abuses; other items in the same news roundup (e.g., telecom “Salt Typhoon” oversight) were unrelated to OpenClaw’s vulnerabilities.
Jun 29, 2026