Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
OpenClaw versions 2026.2.13 through 2026.3.24 have an ANSI escape sequence injection vulnerability (a bug where attackers can sneak special terminal control codes into the system) in approval prompts that allows attackers to trick the terminal display by manipulating tool metadata. This means an attacker could use malicious tool names containing these control sequences to make false information appear in approval prompts and permission logs.
LiteLLM (a library for working with multiple AI models) versions through April 8, 2026 contain a vulnerability that allows remote attackers to execute arbitrary code (run commands they shouldn't be able to run) through bytecode rewriting (modifying compiled code) at a specific web endpoint called /guardrails/test_custom_code. This is a serious security flaw because attackers on the internet could potentially take control of systems running vulnerable versions.
A path traversal vulnerability (a weakness that lets attackers access files outside their intended directory) was found in the chatgpt-on-wechat CowAgent software version 2.0.4 and earlier, specifically in the memory API endpoint where it processes a filename argument. This flaw can be exploited remotely by attackers, and proof-of-concept code has already been published online.
OpenAI discovered that Axios, a third-party developer library (a pre-written code package used to build software), was compromised in a software supply chain attack (where attackers infiltrate widely-used tools to affect many companies at once) on March 31, 2026, and their macOS app-signing process briefly used a malicious version. OpenAI found no evidence that user data or systems were compromised, but is revoking and updating their security certificates (digital credentials that verify software is authentic) and requiring all macOS users to update their OpenAI apps to prevent the risk of fake apps appearing legitimate. As of May 8, 2026, older versions of ChatGPT Desktop (before 1.2026.051), Codex App (before 26.406.40811), Codex CLI (before 0.119.0), and Atlas (before 1.2026.84.2) will no longer receive updates and may stop working.
PraisonAIAgents is a system that coordinates multiple AI agents working together as teams. Before version 1.5.128, the web_crawl() function didn't check URLs before fetching them, allowing attackers or malicious content to trick agents into accessing sensitive internal systems, cloud configuration data, or local files through specially crafted URLs like file:// paths.
PraisonAIAgents (a system that coordinates multiple AI agents working together) versions before 1.5.128 contain a vulnerability in the read_skill_file() function that allows reading any file from a computer's filesystem without restrictions. An attacker using prompt injection (tricking an AI by hiding instructions in its input) could exploit this to steal sensitive files, because unlike other file-reading functions in the same system, read_skill_file() lacks both boundary protections and approval requirements.
PraisonAI versions before 4.5.128 have a security flaw in their /media-stream WebSocket endpoint (a connection protocol for real-time communication) that allows anyone to connect without proving who they are or validating they're authorized. When attackers connect, the server automatically opens a session to OpenAI's API using its own credentials, and since there are no limits on how many connections or messages are allowed, an attacker can drain the server's resources and use up the victim's OpenAI API credits.
PraisonAI, a system for managing multiple AI agents working together, had a vulnerability in versions before 4.5.128 where the deploy.py file didn't check if certain configuration values (openai_model, openai_key, and openai_base) contained commas before putting them into a command. Since commas are used as separators in the gcloud deployment command, an attacker could sneak extra commas into these values to inject arbitrary environment variables (settings that control how the deployed service behaves) into the cloud service.
PraisonAI, a system that uses multiple AI agents to work together as teams, has a vulnerability in versions before 4.5.128 where it displays agent output as HTML without properly cleaning it first. An attacker can inject malicious JavaScript code (code that runs in a web browser) through poisoned data or tricked prompts, and this code will execute when someone views the output.
PraisonAIAgents (a system for running multiple AI agents as teams) has a critical vulnerability in versions before 1.5.128 where user-controlled commands are passed directly to subprocess.run() with shell=True (a function that executes system commands), allowing attackers to inject shell metacharacters (special characters like pipes and semicolons that the shell interprets as instructions) and run arbitrary code. An attacker who gains file-write access through prompt injection (tricking an AI by hiding malicious instructions in its input) can modify the .praisonai/hooks.json configuration file to execute malicious code automatically every time the agent runs.
OpenClaw, a local AI assistant tool, had a security flaw where Git environment variables (special settings that control how Git works) were not being removed before running system commands, potentially allowing attackers to redirect Git operations to malicious locations. This vulnerability affected OpenClaw versions up to 2026.3.30.
LangChain, a framework for building AI agents and applications powered by large language models, had a vulnerability in how it validated f-string templates (a Python feature for inserting variables into text strings). Before versions 0.3.84 and 1.2.28, certain template classes could accept and execute dangerous expressions that should have been blocked, including attribute access and nested replacement fields hidden in format specifiers, which could allow attackers to access unintended data or run unwanted code.
AGiXT, a platform for automating AI agents, has a vulnerability in its safe_join() function (a tool meant to safely combine file paths) that fails to check whether file paths stay within the agent's allowed workspace. Before version 1.9.2, an authenticated attacker could use directory traversal sequences (special path tricks like '../' to navigate outside intended folders) to read, write, or delete files on the server.
OpenClaw, a user-controlled local assistant, had a vulnerability where ClawHub package downloads didn't verify the integrity of downloaded files (a security check ensuring files haven't been tampered with). This meant malicious or corrupted plugin archives could be installed without detection. The vulnerability affected OpenClaw versions 2026.4.1 and earlier.
OpenClaw (a local AI assistant software) had a security bug where the `node.pair.approve` function checked for `operator.write` permissions instead of the more restrictive `operator.pairing` scope, allowing users without proper authorization to approve device pairing on executive-capable nodes. This vulnerability only affects OpenClaw in its single-user trust model and does not impact multi-tenant services.
OpenClaw, a local AI assistant, had a security flaw where WebSocket sessions (persistent connections that allow real-time communication between a client and server) using a shared gateway token remained active even after the token was rotated (changed to a new one). This meant that even after administrators changed the authentication token, old sessions could continue operating without re-authenticating.
OpenClaw, a user-controlled local assistant, had a security flaw where `node.invoke(browser.proxy)` could bypass the `browser.request` guard and modify persistent browser profiles (stored settings that shouldn't be changed without permission). The vulnerability affected versions up to v2026.04.01.
OpenClaw's `device.token.rotate` function had a security flaw where it could create tokens with roles (sets of permissions) that hadn't been properly approved through the required pairing process, potentially letting users gain unauthorized access levels. This vulnerability only affects OpenClaw, which is a local assistant software that runs on a user's own device.
OpenClaw, a local AI assistant tool, had a security vulnerability where certain environment variables (HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS) were not blocked from being passed to system commands, allowing attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) through malicious build tool settings. This vulnerability affected versions before 2026.4.8.
PraisonAI has a critical vulnerability where the `execute_command` function and workflow shell execution pass user-controlled input directly to `subprocess.run()` with `shell=True`, allowing attackers to inject arbitrary shell commands through YAML workflow files, agent configurations, and LLM-generated tool calls by exploiting shell metacharacters like semicolons and pipes.
Fix: Upgrading to version 2.0.5 mitigates this issue. The patch identifier is 174ee0cafc9e8e9d97a23c305418251485b8aa89.
NVD/CVE DatabaseFix: Update to the latest versions of OpenAI's macOS apps through in-app update or official links. OpenAI also addressed the root cause by fixing the GitHub Actions workflow misconfiguration: the workflow previously used a floating tag instead of a specific commit hash and lacked a configured minimumReleaseAge for new packages; these have been corrected. OpenAI rotated the macOS code signing certificate, published new builds of all affected macOS products with the new certificate, and worked with Apple to prevent software notarization using the previous certificate.
OpenAI BlogFix: Update PraisonAIAgents to version 1.5.128 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: Update PraisonAIAgents to version 1.5.128 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: Update PraisonAI to version 4.5.128 or later, which fixes this vulnerability.
NVD/CVE DatabaseFix: Upgrade PraisonAI to version 4.5.128 or later, which fixes this vulnerability.
NVD/CVE DatabaseFix: Update PraisonAI to version 4.5.128 or later, which includes a fix for this vulnerability.
NVD/CVE DatabaseFix: Update PraisonAIAgents to version 1.5.128 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: Update OpenClaw to version 2026.4.8 or later, which patches the vulnerability by properly removing Git plumbing environment variables before executing host commands.
GitHub Advisory DatabaseFix: Update LangChain to version 0.3.84 or 1.2.28 or later, where the f-string validation has been fixed.
NVD/CVE DatabaseFix: Update AGiXT to version 1.9.2, where this vulnerability is fixed.
NVD/CVE DatabaseFix: Update to OpenClaw npm package version 2026.4.8 or later. The fix is also available in the main branch at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.
GitHub Advisory DatabaseFix: Update OpenClaw to version 2026.4.8 or later. The fix is available in the npm package and has been verified in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 on the main branch.
GitHub Advisory DatabaseFix: Update OpenClaw to version 2026.4.8 or later. The fix is available in the npm package and has been verified in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 on the main branch.
GitHub Advisory DatabaseFix: Update to patched version `2026.4.8` or later. The fix is available in npm and was verified in commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.
GitHub Advisory DatabaseFix: Update OpenClaw to version 2026.4.8 or later. The fix is available in the patched npm version and was merged into the main codebase at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.
GitHub Advisory DatabaseFix: Update OpenClaw to version 2026.4.8 or later. The fix was released in npm version 2026.4.8 and is available on the main branch at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.
GitHub Advisory Database