OpenClaw ClawJacked Allows Token Theft in Browser Cloud IDEs

OpenClaw’s ClawJacked vulnerability affects certain browser-based cloud development environments and stems from how authentication tokens are stored and accessed during active sessions. Identified and disclosed by researchers at Oasis Security, the flaw could allow a malicious website to trick a browser into leaking tokens used to access repositories, containers, and other cloud services.

As a result, attackers could gain unauthorized access to private source code and interact with cloud APIs, potentially modifying development environments or pivoting into broader cloud infrastructure. The attack does not rely on malware but on browser behaviour and token handling.

Organisations can reduce risk by applying vendor-recommended patches, minimising token permissions, enforcing short-lived tokens, using separate browser profiles for development, and monitoring for unusual API usage or repository access patterns, according to the article.