OpenClaw has a self-attack vulnerability that mistakenly executes Bash commands, leading to key leakage
Web3 security company GoPlus stated that the AI development tool OpenClaw has recently been reported to have experienced a self-attack security incident. During the execution of automated tasks, the system constructed an incorrect Bash command while calling Shell commands to create a GitHub Issue, inadvertently triggering command injection, which led to the exposure of a large number of sensitive environment variables.
In the incident, the AI-generated string contained a set wrapped in backticks, which was interpreted by Bash as command substitution and executed automatically. Since Bash outputs all current environment variables when executing set without parameters, this ultimately resulted in over 100 lines of sensitive information (including Telegram keys, authentication tokens, etc.) being directly written to the GitHub Issue and publicly published. GoPlus recommends that in AI automation development or testing scenarios, API calls should be used instead of directly concatenating Shell commands, and the principle of least privilege should be followed to isolate environment variables. Additionally, high-risk execution modes should be disabled, and a manual review mechanism should be introduced for critical operations.
You may also like

SBF's little brother turned 225 million into 5.5 billion in one year

In a World of Disruption, How Can Humanities Workers Better Use AI?

Anthropic Open Letter: The Hypocritical Sam Altman, PUA Master

On the same day that Kraken's Fedmaster Account was approved, the banking lobbying group immediately launched a counterattack.

Bitwise: This weekend's attack accelerated the on-chain migration of the financial world

Market Downturn: Which Assets Are Worth Watching?

The real opportunity of stablecoins is not to kill Visa

Trump's AI Farce: Insult if You Don't Pay
US & Canada Crypto Tax Season 2026: Official Tax Reporting Support from WEEX × KoinX
Prepare for US & Canada crypto tax season 2026. Learn how to export your WEEX transaction history and access official reporting support through our partnership with KoinX.

Conversation between Tom Lee and "The Big Short" Author: AI has detected bubble signal, crypto correction due to gold liquidity being "siphoned off"

The true reason for Claude's ban, Kraken accessing the Federal Reserve payment system, What is the English community paying attention to?

「Buying the Dip」 of 400,000 BTC: Is $74,000 a Rebound or a Reversal?

OpenClaw, Another Batch of Middle Class Jobless

Morning News | Backpack will launch on-chain IPO subscription service; Predict.fun strategically acquires on-chain prediction platform Probable; SoFi partners with Mastercard for strategic cooperation

Inventorying the Washington power in the crypto space, who is speaking out for U.S. crypto legislation?

650 million dollars, 1.5 billion dollars, 2 billion dollars, the crypto VC landscape has changed!

Why prediction markets are the largest untapped collateral pool in DeFi
500% XAUT Staking, Zero-Fee Gold Futures and $100K Rewards: Why Traders Are Turning to WEEX for Tokenized Gold
Explore WEEX's $100,000+ gold campaign featuring 500% XAUT staking, zero-fee gold contracts, and $30,000 PAXG rewards. Trade tokenized gold today.