Incident·WS-0075·Jan 30, 2026·disclosed Feb 9, 2026 (10 days later)·in the wild·AI security flaws

OpenClaw one-click takeover flaw; 40,000+ agents exposed

OpenClaw (formerly Clawdbot/Moltbot)

32/100

WS-2 Moderate

Harm score 45, signal score 16. Autonomy: tool (a person misused it). How the scores work.

Harm 2/5

damage actually done

Reach 3/5

who was affected

Autonomy 0/4

how much the AI did on its own

Novelty 2/5

how new the behavior was

Permanence 2/5

how hard it is to undo

OpenClaw patched CVE-2026-25253 (CVSS 8.8) in version 2026.1.29. The flaw let a single malicious link steal the agent's auth token and run code on the host. Two other high-severity CVEs were fixed in the same release. SecurityScorecard scans published 9 Feb found 40,214 internet-exposed OpenClaw instances, about 12,800 of them exploitable for remote code execution, because the agent listened on all interfaces by default.

Damage

40,214 exposed instances; 12,812 RCE-vulnerable; compromised hosts expose stored API keys, OAuth tokens and SSH keys; actual exploitation unquantified

Sources

The Hacker News, second source. Mav Levin (depthfirst) found the CVE. Sources give the patch date as 29 or 30 Jan 2026. Most exposed instances were still on older versions.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.