MCPwner AI Pentesting Tool Finds Multiple 0-Day Vulnerabilities in OpenClaw
What MCPwner Is
MCPwner is an MCP (Model Context Protocol) server that enables AI agents to conduct automated penetration testing against security targets. The developer built it to orchestrate older AI models like GPT-4o and Claude 3.5 Sonnet, which when properly directed through MCPwner can find deep architectural flaws that standard scanning tools miss.
Recent OpenClaw Findings
When pointed at OpenClaw, MCPwner successfully identified multiple 0-day vulnerabilities that have now received official advisories. These weren't just minor bugs but critical security issues:
- Environment Variable Injection
- ACP permission auto-approval bypass
- File-existence oracle information disclosure
- safeBins stdin-only bypass
The tool found logic bypasses and injection points that traditional static analysis tools completely overlooked.
Technical Approach
MCPwner demonstrates that mid-tier and older AI models, when properly orchestrated through this MCP server, can outperform traditional static analysis for vulnerability discovery. The project has already identified multiple vulnerabilities and other CVEs beyond the OpenClaw findings.
Project Status and Contribution
The project is still in active development but already producing results. The developer is seeking contributors to help sharpen the scanning logic and expand the toolkit. Pull requests and feedback are welcome, particularly from those building in the offensive AI space who want to test the tool.
GitHub repository: https://github.com/Pigyon/MCPwner
📖 Read the full source: r/openclaw
👀 See Also
Snowflake Cortex Code CLI vulnerability allowed sandbox escape and malware execution
A vulnerability in Snowflake Cortex Code CLI version 1.0.25 and earlier allowed arbitrary command execution without human approval via process substitution bypass, enabling malware installation and sandbox escape through indirect prompt injection.
Agent Isolation Security Analysis: From No Sandbox to Firecracker VMs
Analysis of how Cursor, Claude Code, Devin, OpenAI, and E2B isolate agent workloads, ranging from no sandbox to hardware-isolated Firecracker microVMs. Container runtimes have had escape CVEs annually since 2019, while Firecracker has zero guest-to-host escapes in seven years.
Axios 1.14.1 compromised with malware, targets AI-assisted development workflows
Axios version 1.14.1 has been compromised in a supply chain attack that silently pulls in [email protected], an obfuscated RAT dropper. Developers using AI coding assistants like Claude should immediately check their lockfiles and machines for infection.
Claude Cage: Docker Sandbox for Claude Code Security
A developer created a Docker container called Claude Cage that isolates Claude Code to a single workspace folder, preventing access to SSH keys, AWS credentials, and personal files. The setup includes security rules and takes about 2 minutes with Docker installed.