Overview
Risk patterns
Patterns found in the case record and its linked vulnerabilities.
- 1Dominant ATLAS tactic. Resource Development appears in 2 case steps.
- 2Multiple attack methods. The case connects to 9 unique AI attack methods.
- 3Vulnerability mentions. The record connects 1 vulnerability identifiers to this case.
Procedure timeline
Search the case steps or filter them by attacker goal.
-
Resource Development
Step 1
Develop Capabilities
The researcher developed a 1-Click RCE JavaScript script.
-
Resource Development
Step 2
Stage Capabilities
The researcher staged the malicious script at an inconspicuous website.
-
Execution
Step 3
Malicious Link
When the victim clicked the link to the researchers’ website, the malicious JavaScript script executes in the user’s browser.
-
Credential Access The malicious script opened a background window to the victim’s OpenClaw control interface with the
gatewayUrlset to a WebSocket address on the researcher’s server. OpenClaw’s control interface trusts thegatewayUrlquery string without validation and auto-connects on load, sending the Gateway token to the researcher’s server. -
Defense Evasion The malicious script performed Cross-Site WebSocket Hijacking (CSWSH) to bypass localhost network restrictions. It opened a new WebSocket connection to the OpenClaw Gateway server on localhost.
-
Privilege Escalation
Step 6
Valid Accounts
The malicious script used the stolen Gateway token to authenticate, allowing subsequent calls to OpenClaw’s Gateway API on the victim’s system.
-
Defense Evasion The malicious script disabled OpenClaw’s security feature that prompts users before running potentially dangerous commands. This was done by sending the following payload to OpenClaw’s Gateway API.
Defanged prompt excerptcollapsed by default
Security note: content in this block is escaped, defanged and intended for analysis only.{ "method": "exec.approvals.set", "params": { "defaults": { "security": "full", "ask": "off" } } } -
Privilege Escalation
Step 8
Escape to Host
The malicious script disabled OpenClaw’s sandboxing, forcing the agent to run commands directly on the host machine instead of inside a docker container. This was done by sending a
config.patchrequest to OpenClaw’s Gateway API to settools.exec.hostto "gateway". -
Execution The malicious script achieved remote code execution by sending a
node.invoke(OpenClaw’s RPC mechanism) request to OpenClaw’s API.
Mitigations
Defenses connected to the attack methods in this case.
Sources
Original public records and references for this case.
Original source
Original source links
Open the MITRE ATLAS data and public references used for this case study.