logo

OpenClaw has a self-attack vulnerability that mistakenly executes Bash commands, leading to key leakage

By: rootdata|2026/03/05 20:43:30
0
Share
copy
aiai
shellshell
when-vipwhen-vip

Web3 security company GoPlus stated that the AI development tool OpenClaw has recently been reported to have experienced a self-attack security incident. During the execution of automated tasks, the system constructed an incorrect Bash command while calling Shell commands to create a GitHub Issue, inadvertently triggering command injection, which led to the exposure of a large number of sensitive environment variables.

In the incident, the AI-generated string contained a set wrapped in backticks, which was interpreted by Bash as command substitution and executed automatically. Since Bash outputs all current environment variables when executing set without parameters, this ultimately resulted in over 100 lines of sensitive information (including Telegram keys, authentication tokens, etc.) being directly written to the GitHub Issue and publicly published. GoPlus recommends that in AI automation development or testing scenarios, API calls should be used instead of directly concatenating Shell commands, and the principle of least privilege should be followed to isolate environment variables. Additionally, high-risk execution modes should be disabled, and a manual review mechanism should be introduced for critical operations.

-- Price

--

You may also like

a16z Crypto: 9 Charts to Understand the Evolution Trends of Stablecoins

Stablecoins are evolving from trading tools into universal payment infrastructure, and this process is quieter and more thorough than most people expected.

Refutation of Yang Haipo's "The End of Cryptocurrency"

This may be the true test of cryptocurrency. It's not about whether the price has reached a new high, nor about who will achieve financial freedom in the next bull market, but rather whether, after all the grand narratives have been washed away by cycles, it can still leave behind some simpler, more...

Can a hairdryer earn $34,000? Interpreting the reflexivity paradox of prediction markets

Prediction markets are essentially betting on reality, and when participants can access or even influence this path earlier, the market no longer just reflects reality but begins to shape it in return.

6MV Founder: In 2026, the "landmark turning point" for crypto investment has arrived

"I will deploy funds in 2026, so I will tell you this is the best year in history."

Abraxas Capital Mints $2.89 Billion USDT: Liquidity Boost or Just More Stablecoin Arbitrage?

Abraxas Capital just received $2.89 billion in freshly minted USDT from Tether. Is this a bullish liquidity injection for crypto markets, or is it business as usual for a stablecoin arbitrage giant? We analyze the data and the likely impact on Bitcoin, altcoins, and DeFi.

A VC from the Crypto world said AI is too crazy, and they are very conservative

Amid the Crypto frenzy and with investors who once missed out on Pinduoduo, a new AI fund called Impa Ventures was established, rejecting bubble narratives and adhering to a conservative "problem-first" strategy to seek real business value.
The Joker is back
Bigger pools, auto-play, lucky buffs.
The Joker is backJoin now and grab your rewards.

Contents

Popular coins

Latest Crypto News

17:42

FF team address transfers 13 million dollars worth of tokens to the new wallet

According to monitoring by onchainschool.pro, the FF team address (0xeF6...7071) transferred tokens worth $13 million to a new wallet, which will then distribute to other participants or fund wallets. This is the largest transfer record for the project to date.An hour ago, approximately $1,000,000 w...
17:42

Quantum computers can crack 15-bit ECC keys, and there is currently no threat to 256-bit Bitcoin security, but the countdown for migration is accelerating

Project Eleven today awarded the Q-Day prize to researcher Giancarlo Lelli, who successfully derived a 15-digit elliptic curve private key from a public key using publicly accessible quantum hardware, marking the largest scale demonstration of its kind to date, a 512-fold increase from the 6-digit d...
16:42

Data: The trading volume of NFTs on the Ethereum chain in the past 24 hours was nearly 4 million USD, with BAYC trading volume increasing by over 266%

According to data monitoring by CryptoSlam, the trading volume of NFTs on the Ethereum chain reached $3.934 million in the past 24 hours, an increase of 72.78%. The trading volume of BAYC exceeded $1.45 million, with a 24-hour increase of 266.35%; Countyard's trading volume was about $980,000, with ...
16:42

Data: In the past 24 hours, the total liquidation across the network was 208 million USD, with long positions liquidated at 109 million USD and short positions liquidated at 98.19 million USD

According to Coinglass data, in the past 24 hours, the total liquidation across the network was $208 million, with long positions liquidated at $109 million and short positions liquidated at $98.19 million. Among them, Bitcoin long positions were liquidated at $15.3077 million, Bitcoin short positio...
15:42

a16z: Stablecoins are evolving from trading tools to core financial infrastructure, with Q1 trading volume reaching $4.5 trillion

a16z released the latest research indicating that stablecoins are gradually evolving from their initial role as transaction settlement tools and stores of value into global financial infrastructure. Data shows that following the regulatory clarity driven by the U.S. GENIUS Act, the stablecoin market...
Read more
Community
iconiconiconiconiconiconicon

Customer Support Bot：@WEEX_support_smart_Bot

VIP Services：support@weex.com