CVE-2026-26320: OpenClaw macOS client confirmation dialog hides part of deep link message

Summary

OpenClaw's macOS desktop client registers the openclaw:// URL scheme, and its confirmation dialog for openclaw://agent deep links without a key showed only the first 240 characters of the message while executing the full text after the user clicked Run. In versions 2026.2.6 through 2026.2.13, an attacker could pad the message with whitespace to hide a malicious payload outside the visible preview, so a user could approve one message and run another. Depending on the user's configured tool approvals or allowlists, this may lead to arbitrary command execution.

Mitigation

Fixed in 2026.2.14. Other mitigations stated in the source: do not approve unexpected "Run OpenClaw agent?" prompts triggered while browsing untrusted sites, and use unattended deep links only with a valid `key` for trusted personal automations.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)