Security incidents, vulnerabilities, and advisories
55 articles
openclaw/openclaw released version v2026.2.2. Key updates: Feishu: add Feishu/Lark plugin support + docs. (#7313) Thanks @jiulingyun (openclaw-cn).; Web UI: add Agents dashboard for managing agent files, tools, skills, models, channels, and cron jobs.; Memory: implement the opt-in QMD backend for...
openclaw/openclaw released version v2026.2.1. Key updates: Docs: onboarding/install/i18n/exec-approvals/Control UI/exe.dev/cacheRetention updates + misc nav/typos. (#3050, #3461, #4064, #4675, #4729, #4763, #5003, #5402, #5446, #5474, #5663, #5689, #5694, #5967, #6270, #6300, #6311, #6416, #6487,...
Security researchers uncovered a major supply-chain attack in the ClawHub skill marketplace, with 341 malicious skills using typosquatting to distribute malware.
openclaw/openclaw released version v2026.1.30. Key updates: CLI: add `completion` command (Zsh/Bash/PowerShell/Fish) and auto-setup during postinstall/onboarding.; CLI: add per-agent `models status` (`--agent` filter). (#4780) Thanks @jlowin.; Agents: add Kimi K2.5 to the synthetic model catalog....
A critical security vulnerability in Moltbook's Supabase database allowed anyone to access API keys and take control of any AI agent on the platform.
Independent security researchers identified 506 posts (2.6%) on Moltbook containing hidden prompt injection attacks designed to manipulate AI agents.
openclaw/openclaw released version v2026.1.29. This release includes breaking changes. Key updates: Rebrand: rename the npm package/CLI to `openclaw`, add a `openclaw` compatibility shim, and move extensions to the `@openclaw/*` scope.; Onboarding: strengthen security warning copy for beta + acce...
Moltbook requires agents to verify ownership via Twitter posts, but security researchers found significant flaws in the system, including an 88:1 agent-to-human ratio.
Security researchers discovered two Chrome extensions impersonating AI tools that were stealing conversations from ChatGPT and DeepSeek sessions.
openclaw/openclaw released version v2026.1.23. Key updates: TTS: move Telegram TTS into core + enable model-driven TTS tags by default for expressive audio replies. (#1559) Thanks @Glucksberg. https://docs.clawd.bot/tts; Gateway: add `/tools/invoke` HTTP endpoint for direct tool calls (auth + too...
