"ClawJacked" Flaw Enables AI Agent Hijacking via Malicious Websites

"ClawJacked" Flaw Hijacks Local OpenClaw AI Agents via WebSockets

• Security researchers identified a "ClawJacked" vulnerability in local OpenClaw AI agents, enabling malicious websites to hijack these agents through WebSocket communication.
• This flaw bypasses conventional browser same-origin policy and cross-origin communication restrictions, allowing unauthorized interaction with the local AI agent from untrusted web pages.
• Exploitation of "ClawJacked" could lead to sensitive data extraction, manipulation of the AI's functions, or execution of commands within the user's local computing environment.

Source: The Hacker News | Date: February 28, 2026

References

1. ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket - The Hacker News