OpenClaw Flaws Let a WhatsApp Message Trigger Host Code Execution

Three high-severity flaws in the open-source AI coding assistant OpenClaw can be chained so that a single WhatsApp message leads to credential theft, privilege escalation, arbitrary code execution, and escape from the tool's Docker-based sandbox to the host. Researcher Chinmohan Nayak showed that attacker-crafted prompts disguised as normal debugging requests could exploit unsafe handling of untrusted input in OpenClaw 2026.6.1, including an environment-variable filter bypass, command execution via Git's ext:: transport helper, and a parent-directory bypass in sandbox bind mounts.

The sandbox bypass could expose sensitive material such as SSH keys, AWS credentials, GPG secrets, and even the Docker socket, enabling broader compromise without any prior foothold on the target system. The issues are tracked as GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc, and were fixed in OpenClaw 2026.6.6; users were urged to upgrade, enable sandbox mode for non-main sessions, restrict exec in tool allowlists, watch for malicious git clone activity involving the ext:: protocol, limit direct-message pairing from untrusted numbers, and rotate credentials if exposure is suspected.