Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws

A researcher has disclosed an attack chain that exploits three patched security flaws in the OpenClaw personal AI assistant to target hosts via WhatsApp. The vulnerabilities, now fixed, could be used for credential theft, privilege escalation, and arbitrary code execution on the host if successfully exploited. One of the high-severity vulnerabilities has a CVSS score of 8.8. The flaws were identified as affecting the operating system. The vulnerabilities were assigned the identifier GHSA-hjr6-g723-hmfm. The attack chain's specifics involve using WhatsApp as an entry point to reach the host.