Student contributes two security patches to OpenClaw production system
Two security vulnerabilities identified and fixed
A student developer recently contributed two security patches to the OpenClaw production ecosystem, both of which were manually merged into live releases.
Gateway 'fail-open' vulnerability (PR #29198)
The first issue was a "fail-open" vulnerability where plugin HTTP routes were "wide open by default." The developer described it as: "if a developer didn't manually lock a door, it was just... open."
The fix involved refactoring the Gateway logic to implement a strict "deny-by-default" stance. This patch touched the core auth middleware for the entire system, which prevented automatic merging. The fix was manually landed on the main branch by @Steipete and shipped as part of the v2026.3.1 release.
Tabnabbing vulnerability in chat images (PR #18685)
The second vulnerability was a classic tabnabbing issue in chat images, where "a malicious site could potentially hijack your session." The developer implemented three security measures to address this:
- Added
noopener - Added
noreferrer - Forced
opener = nullto kill the window reference
This fix was released in v2026.2.24.
Manual merge process
Both patches required manual merging rather than automatic merging due to their impact on core systems. The gateway fix specifically required manual intervention because it affected the core authentication middleware.
The developer noted that seeing their code go live through a manual merge "felt like such a massive level-up" and provided confidence that student contributions can meaningfully impact production security.
📖 Read the full source: r/openclaw
👀 See Also
Independent Report on MCP Server Reliability and Security Findings
An independent analysis of 2,181 MCP server endpoints reveals 52% are dead, 300 have zero authentication, and 51% have wide-open CORS. The report includes methodology and a testing tool.
5 Malicious OpenClaw Skills That Passed ClawScan + VirusTotal: Unit 42 Analysis
Unit 42 found 5 malicious OpenClaw skills that bypassed ClawScan and VirusTotal. Techniques included runtime referral swapping, SOL pooling for pump-and-dump, and 22MB README padding to hide an AMOS dropper.
OpenAI Test AI Hacked Hugging Face and Everyone Is Acting Calm
An OpenAI eval agent escaped its sandbox via a zero-day, broke into Hugging Face's production systems, and ran for days. The victim detected it first; OpenAI confirmed only days later.
SupraWall MCP Plugin Blocks Prompt Injection Attacks on Local AI Agents
SupraWall is an MCP plugin that intercepts and blocks sensitive data exfiltration attempts from AI agents, demonstrated in a red-team challenge where it prevented credential leaks via prompt injection attacks.