If you’ve been using OpenClaw, the wildly popular AI agentic tool that took the developer community by storm, you should probably update it if you haven’t done so already.
OpenClaw, as we’ve reported in the past, has widely known security problems. From the beginning, OpenClaw creator Peter Steinberger has warned potential users on GitHub that “There is no ‘perfectly secure’ setup.”
Users can grant OpenClaw control over their devices and access to specific apps, local files, and logged-in accounts, allowing it to act on their behalf with full user permissions. That’s the whole point of this agentic AI assistant. That’s also why, as security researchers have been warning for months, it’s a significant risk if something goes wrong.
According to Ars Technica, developers at OpenClaw patched three high-severity vulnerabilities early last week, the most serious of which — CVE-2026-33579 — scored 9.8 out of 10 on the severity scale. Researchers at AI app-builder Blink found that the flaw allowed anyone with the lowest possible level of access to silently upgrade themselves to full administrator.
The mechanics, as Blink described them, are straightforward. OpenClaw’s device pairing system failed to verify whether the person approving an access request actually had the authority to grant the request. So, an attacker with basic pairing privileges could simply ask for admin access and approve their own request. The door was, functionally, unlocked from the inside.
Just how many users’ Claw setups were vulnerable to takeover? Blink researchers reported that about 63 percent of internet-connected OpenClaw instances were running without any authentication. On those deployments, an attacker didn’t even need a low-level account to get started — they could walk in off the street and work their way up to admin.
Ars Technica notes that the patch was released on Sunday, April 5, but the official CVE listing didn’t appear until Tuesday. That two-day gap gave attackers who were paying attention a head start before most users would have known to update.