Six flaws found hiding in OpenClaw’s plumbing

Security researchers at Endor Labs found six high-to-critical vulnerabilities in OpenClaw, an open-source AI agent framework (a platform combining large language models with tools and external integrations). The flaws include SSRF (server-side request forgery, where attackers trick a server into making unintended requests), missing webhook authentication, authentication bypasses, and path traversal (unauthorized access to files outside intended directories), all confirmed with working proof-of-concept exploits. OpenClaw has already published patches and security advisories addressing these issues.