Critical AI System Vulnerabilities in OpenClaw and Langflow Lead to Security Risks and Exploitation

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

360 Security discovered and reported a zero-day vulnerability in OpenClaw's intelligent agent gateway, confirmed by its founder, allowing attackers to bypass authentication and potentially crash systems. Separately, Langflow's API flaw enabled remote code execution, actively exploited within 20 hours of disclosure, causing unauthorized access and data theft. Both incidents highlight urgent AI security challenges.[AI generated]

Why's our monitor labelling this an incident or hazard?

The OpenClaw Gateway is an AI-related system (smart agent gateway) whose security vulnerability allows attackers to bypass authentication and gain control, potentially causing system resource exhaustion or crashes. This constitutes a direct risk of harm to property or system integrity. Since the vulnerability is confirmed and exploitable, and the article reports on the discovery and confirmation of this high-risk flaw, it qualifies as an AI Incident due to the realized security risk and potential harm stemming from the AI system's malfunction or misuse.[AI generated]
AI principles
Robustness & digital securityAccountability
Industries
Digital securityIT infrastructure and hosting
Affected stakeholders
BusinessConsumers
Harm types
Economic/PropertyHuman or fundamental rights
Business function:
ICT management and information security
AI system task:
Goal-driven organisationReasoning with knowledge structures/planning

Articles about this incident or hazard