GitHub - jgamblin/OpenClawCVEs: Tracking OpenClaw CVEs
agents
| Source: Mastodon | Original article
A new GitHub repository, jgamblin/OpenClawCVEs, has been launched to catalogue every publicly disclosed vulnerability affecting the OpenClaw personal‑AI assistant. The tracker, now listing 156 CVEs – 128 of them still unpatched – is the most comprehensive record of the software’s security flaws to date.
The effort follows a flurry of disclosures in March 2026, when nine CVEs were announced within four days, including a critical 9.9‑score bug that could grant attackers full root control on a host running OpenClaw. Those incidents, which we first reported on April 4, 2026 in “OpenClaw gives users yet another reason to be freaked out about security,” highlighted the fragility of the project’s self‑hosting model. Since then, Anthropic has begun cutting off API access for OpenClaw‑based Claude Code deployments, a move we covered on the same day.
OpenClaw’s appeal lies in its ability to run large language models locally on consumer hardware, offering privacy‑focused users a “AI agent” that can execute commands with elevated privileges. The new CVE tracker makes clear that this power comes with a steep risk: unpatched flaws can be weaponised into botnets or ransomware, turning a helpful assistant into a covert malware platform. Security researchers have warned that the line between legitimate AI tooling and malicious code is blurring, especially when users grant root access without scrutinising the underlying software.
What to watch next is whether the OpenClaw maintainers can accelerate patch releases and improve their vulnerability disclosure process. The tracker’s real‑time updates will likely become a reference point for enterprises and hobbyists deciding whether to self‑host. Parallel developments – such as tighter API restrictions from cloud providers and possible regulatory scrutiny of locally‑run AI agents – could reshape the ecosystem. Stakeholders should monitor upcoming security advisories, patch roll‑outs, and any shifts in the relationship between OpenClaw and larger AI platforms.
Sources
Back to AIPULSEN