ClawJacked attack let malicious websites hijack OpenClaw to steal data

Security researchers disclosed "ClawJacked," a high-severity vulnerability in the self-hosted AI platform OpenClaw that allowed browser JavaScript to open WebSocket connections to a localhost gateway, brute-force the management password at hundreds of attempts per second, and auto-register as a trusted device—potentially enabling credential theft, file exfiltration, arbitrary command execution, and full workstation compromise; OpenClaw released a fix in version 2026.2.26 and administrators should update immediately.