DepthFirst company blog
1-Click RCE to steal your Moltbot data and keys
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary…
- Points
- 178
- HN comments
- 72
- Submissions
- 1
- Cited by
- 0 commenters
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Feb 1, 2026 | 1-Click RCE to steal your Moltbot data and keys by arwt | 178 | 72 |
