OpenClaw Zero-Click Vulnerability Exposes Developer AI Agents to Remote Hijacking A newly identified zero-click vulnerability in OpenClaw, a local WebSocket-based AI agent framework, allows attackers to compromise developer systems with minimal interaction. The attack exploits a malicious PowerShell script that executes when a developer visits a compromised or malicious website, requiring no further user action. Once triggered, the script performs a multi-stage attack: - Execution & Persistence: The PowerShell script modifies files and establishes a WebSocket gateway on `localhost`, acting as a command-and-control (C2) hub. - Privilege Escalation: The malware bypasses User Account Control (UAC) via `CoGetObjectContext` and gains SYSTEM-level access by exploiting the Kernel Security Device Driver. - Defense Evasion: It removes traces of compromise using commands like `winget uninstall` and deploys a rootkit to maintain persistence under `\DosDevices\c:`. - Credential Theft & Surveillance: The agent logs keystrokes and intercepts data, while connected nodes (macOS, iOS, or other machines) expose system commands, file access, and contact data. With an authenticated session, attackers can: - Search Slack history for API keys. - Read private messages. - Exfiltrate files from linked devices. - Execute arbitrary shell commands. The vulnerability highlights risks in AI agent frameworks, where a single web visit can grant full control to threat actors. Security researchers have flagged the tradecraft and TTPs (Tactics, Techniques, and Procedures) associated with OpenClaw, emphasizing its potential for widespread exploitation in developer environments.