The AI agent has been running for less than two months, and already has 83 accumulated vulnerabilities

China National Vulnerability Database (CNNVD) announced on 9 October: In less than two months, from 5 August to 28 September, another 83 security vulnerabilities were collected for the AI agent framework OpenClaw. Adding to the red alert issued by the National Cyber Security Emergency Response Center in March this year, this open-source agent project has cumulatively disclosed over 250 vulnerabilities.

Key Takeaways

1 These 83 vulnerabilities are mainly command and code injections, path traversal, and access control defects, with generally low exploitation difficulty.

2 In typical scenarios, remote callers can bypass administrator authorisation to drive tools that should only belong to the owner, directly reading files, modifying files, and executing commands.

3 AI agents inherently come with file read/write, shell, and network access privileges; an access control defect is equivalent to handing over the entire machine to the other party.

4 For enterprises implementing agents, four tasks must be done together: upgrading, privilege reduction, network isolation, and audit logging.

I. What the Announcement Stated

CNNVD's announcement stated: According to statistics from the Artificial Intelligence Vulnerability Database (AIVD), a total of 83 OpenClaw vulnerabilities were collected from 5 August to 28 September 2026.

The warning issued by the National Cyber Security Emergency Response Center in March this year revealed a more detailed breakdown: among the 82 recently exposed vulnerabilities, there were 12 critical, 21 high, 47 medium, and 2 low severity.

II. Three Typical Categories of Vulnerabilities: Where the Permission Boundary Collapsed

OpenClaw is an open-source AI agent runtime that developers use to connect large models to their own tools, files, and services. Its high-risk points are concentrated on the boundary of "who can direct the agent to do what".

CVE-2026-62186 appeared in versions prior to 2026.6.8: low-trust callers exploit misconfigured input paths to bypass administrator authorisation and execute actions that should be restricted. CVE-2026-100544 is even more direct—the tool filtering logic that should only allow the owner to use it "fails open" under specific configurations, allowing remote callers to read data, modify files, execute commands, and even control services connected to the agent.

The earlier disclosed ClawJacked demonstrated another path: malicious websites silently obtain full control of locally running instances via a WebSocket vulnerability chain after users visit a page, without requiring plugins, extensions, or additional clicks.

III. Why AI Agent Vulnerabilities Are So Valuable

Traditional Web vulnerabilities require a chain of exploits to obtain a shell; AI agents, from day one, are configured with three types of privileges: file read/write, command execution, and network access. Once access control is lost, attackers do not need to perform "privilege escalation"—the agent itself is a ready-made attack tool.

Inherently high privileges: To complete tasks, agents are granted privileges to read files, run commands, and call APIs; an authorisation defect is equivalent to handing over all these privileges wholesale.

Configuration relies on manual input: Which callers are allowed to connect and whether tools are restricted to the owner depend entirely on the deployer's configuration, and default settings are often overly permissive.

Attack surface is exposed externally: Interfaces covering WebSocket and HTTP models listen to the network, and both malicious web pages and forged requests can reach them.

IV. Protection Checklist for Enterprises

1

Upgrade to the latest version

Verify version numbers against AIVD announcements and vendor advisories, focusing on fixes for authorisation bypass and tool filtering.

2

Reduce tool and caller permissions

Disable unnecessary inbound calls; configure tools as "owner only"; allocate capabilities across file, command, and network access based on the principle of least privilege.

3

Network-isolate listening ports

Do not expose the agent's local ports to the public network; place WebSocket and model interfaces in controlled network segments, and prohibit cross-origin connections on the browser side.

4

Full traceability and auditability

Record who invoked which tool and executed what action at what time; subject high-risk actions to manual review so incidents can be traced back.

V. What Cyritex Can Do

Incidents like OpenClaw reveal two main gaps: the agent's own permission boundaries lack validation, and malicious components in the AI ecosystem lack continuous monitoring. The Cyritex product suite addresses these as follows:

Agent Operations

CyriAI implements security operations using a Multi-Agent architecture, explicitly defining behavioural boundaries during deployment, requiring manual review for high-risk actions, and ensuring full auditability and traceability.

Supply Chain Interception

CyriGate is deployed between the external open-source ecosystem and internal enterprise artifact repositories to intercept malicious component requests and malicious AI SKILLs requests, ensuring that "risks do not enter repositories, and hidden dangers do not land".

Ecosystem Monitoring

Continuously monitor a total of 2,032,940+ AI Skills across four major platforms—ClawHub, Anthropic Marketplace, skills.sh, and GitHub/skills—identifying 350,725 malicious Skills, representing a malicious rate of approximately 20%.

The more capable an AI agent is, the more its permission boundaries require validation. Only by placing the agent within an auditable, interceptable, and reviewable framework can it safely connect to production systems.

References

[1] China National Vulnerability Database (CNNVD), "Notice on Major Artificial Intelligence Security Vulnerabilities - Multiple Security Vulnerabilities in OpenClaw", 2026-10-09
[2] CCTV.com / National Cyber Security Emergency Response Center, "OpenClaw Security Risk Warning", 2026-03-13

[3] CVE.org, "CVE-2026-62186 OpenClaw Authorisation Bypass Vulnerability"

[4] Vulnerability-Lookup, "CVE-2026-100544 OpenClaw Tool Filtering Flaw", 2026-09

[5] Cloud Security Alliance, "ClawJacked: WebSocket Exploitation Enabling Malicious Sites to Hijack Local AI Agents", 2026-03