There used to be a time when building out a botnet required *some* work – writing exploits, taking over devices, obscuring the purpose of the executable, etc.
Not any more!
Instead of "malware", call it an "AI agent" and people will just happily install it on their devices with full root privileges!
https://github.com/jgamblin/OpenClawCVEs/
Bam! RCE by asking nicely.
🧵
OpenClaw treats this seriously, of course, and by seriously I mean claims this is normal, nothing to see here – and blames the users:
https://openclawai.io/blog/openclaw-cve-flood-nine-vulnerabilities-four-days-march-2026
> This four-day flood isn’t an anomaly. It’s what happens when a project grows from enthusiast tool to infrastructure faster than its security surface can mature.
> If you’re running OpenClaw, you’re signing up to track upstream releases, apply patches promptly, and monitor advisories — indefinitely.
🧵
Do they mention any of this on their landing page? No, of course not:
https://openclawai.io/
Do they mention this on their quickstart page? No, of course not:
https://openclawai.io/quickstart
But they sure mention the managed hosting that is "coming soon"! Which of course they shill in their blogpost about the vulnerabilities:
> For many users, that’s a reasonable tradeoff. For others, it’s the argument for managed hosting.
Security fuckup? More like business opportunity, amirite? 🤡
🧵
OpenClaw is utterly negligent in promoting their stuff to regular users and not having gigantic warnings on their landing page and installation guides.
Their response to these vulnerabilities, mentioning 128 advisories that are "still pending assignment", and shilling their "managed" service, is laughable and craven.
And the way they hide behind the open source label is infuriating:
> The open-source model means every vulnerability gets public scrutiny and transparent fixes.
🧵
It is also entirely par for the course for the broader "AI" ecosystem, which has the same scammy vibes as the NFT space.
For years Microsoft had a line in Copilot's ToS (still does) insisting it is for entertainment purposes only (yet they push it in their products):
https://www.theregister.com/2024/08/14/microsoft_services_agreement_update_warns/
Anthropic's "extensively trained" model got tricked by a tactic used by a 13yo – "really, I'm a researcher!" and the company still does not see it as their responsibility:
https://rys.io/en/181.html#ai-orchestrated-cyberattack
🤡
🧵/end
@rysiek oh it's absolutely clown shoes
but also this is only the consumer terms
so in many countries, advertising laws kick in! if they don't state the gotcha right there in the ads, they risk a finding of deceptive practices
I guess you have to ask really, really nicely, to counteract the other instruction. Or simply add a "system reminder".
From a great and very enjoyable thread (for certain subcategories of "enjoyable"):
@rysiek to a certain extent, I understand the attitude of “hey, this is just a hobby project, I made it for free, don’t expect *anything*”. I too dislike the entitled attitude of users of open source stuff.
*but* the moment this “toy project” became wildly popular, he should have taken down the website and put a big fat warning on GitHub to scare away people who are not experts (but have at least two brain cells). It’s this part that’s, as you said — utterly negligent.
@radex he promoted it from the get go in a way that invited regular non-techies to use it, without ever putting any kind of warning.
It was utterly negligent basically from the moment the website went up.
@rysiek this is absolutely true
It is also true that you can't stop a creek with your hand
@marcink right?
Don't worry, as soon as OpenClaw gets hit by supply-chain attack, which they inevitably are going to, this will flip.
Michał "rysiek" Woźniak · 🇺🇦
David Gerard
Jim Jones
Not a Spring Onion
Radek Pietruszewski
Raymond Neilson
noplasticshower
Skyglobe
marcink
Matt Palmer