Home
360's AI Agent Exposes Critical OpenClaw Flaws, Raising New Security Risks for AI-Native Apps

]On April 7, 360's Vulnerability Mining Intelligent Agent reported three critical security flaws in the AI agent OpenClaw, one classified as high-severity and two as medium-severity. All vulnerabilities were officially patched and disclosed. This milestone demonstrates a shift from rule-based to intelligent, thought-driven automated security audits, offering essential support for securing AI-native applications.
The high-severity flaw targets the approval and execution mechanism of local scripts, allowing attackers to execute unauthorized code by modifying already-approved scripts and compromising user devices. The two medium-severity issues involve reuse of security verification parameters in OAuth manual authorization and resource management weaknesses during WebSocket data processing in voice calls. The first could expose users' Google service account credentials, while the second may trigger resource exhaustion leading to device crashes. These vulnerabilities strike at the core operations of AI agents, revealing significant risks in permission isolation and protocol implementation.
360 reports that its vulnerability mining intelligent agent has discovered multiple high-value flaws across several mainstream AI agents. Unlike conventional scanning tools, this system mimics security experts' attack-defense intuition, automating detection, verification, and reproduction of vulnerabilities—freeing human analysts for more creative risk assessment. As AI agents become embedded in user workflows, AI-powered automated vulnerability discovery will serve as critical infrastructure for securing the AI supply chain's foundational layers, driving the industry toward more resilient security defenses.
Related article
Stripe to Acquire OpenRouter as AI Model Routing Gains Momentum
Stripe has agreed to acquire OpenRouter, an AI model-routing platform that gives developers access to hundreds of models through a single interface. The deal adds model selection and routing to Stripe’s existing work around AI usage and token-based b
Former OpenAI Researcher Barrett Zoph Returns to Google to Support Gemini Development
Barret Zoph, who previously abruptly left and joined OpenAI due to a disagreement with Thinking Machines Lab CEO Miriam Mularati, has once again changed employers. Alphabet's Google announced that Zoph will return as Vice President of Research, bring
How Recursive Intelligence Raised $335M at $4B Valuation in 4 Months
The co-founders of startup Ricursive Intelligence seemed destined to be co-founders.Anna Goldie, CEO, and Azalia Mirhoseini, CTO, are so well-known in the AI community that they were among those AI engineers who “got those weird emails from Zuckerber
Related Special Topic Recommendations
Comments (0)
0/500

]On April 7, 360's Vulnerability Mining Intelligent Agent reported three critical security flaws in the AI agent OpenClaw, one classified as high-severity and two as medium-severity. All vulnerabilities were officially patched and disclosed. This milestone demonstrates a shift from rule-based to intelligent, thought-driven automated security audits, offering essential support for securing AI-native applications.
The high-severity flaw targets the approval and execution mechanism of local scripts, allowing attackers to execute unauthorized code by modifying already-approved scripts and compromising user devices. The two medium-severity issues involve reuse of security verification parameters in OAuth manual authorization and resource management weaknesses during WebSocket data processing in voice calls. The first could expose users' Google service account credentials, while the second may trigger resource exhaustion leading to device crashes. These vulnerabilities strike at the core operations of AI agents, revealing significant risks in permission isolation and protocol implementation.
360 reports that its vulnerability mining intelligent agent has discovered multiple high-value flaws across several mainstream AI agents. Unlike conventional scanning tools, this system mimics security experts' attack-defense intuition, automating detection, verification, and reproduction of vulnerabilities—freeing human analysts for more creative risk assessment. As AI agents become embedded in user workflows, AI-powered automated vulnerability discovery will serve as critical infrastructure for securing the AI supply chain's foundational layers, driving the industry toward more resilient security defenses.
Stripe to Acquire OpenRouter as AI Model Routing Gains Momentum
Stripe has agreed to acquire OpenRouter, an AI model-routing platform that gives developers access to hundreds of models through a single interface. The deal adds model selection and routing to Stripe’s existing work around AI usage and token-based b
Former OpenAI Researcher Barrett Zoph Returns to Google to Support Gemini Development
Barret Zoph, who previously abruptly left and joined OpenAI due to a disagreement with Thinking Machines Lab CEO Miriam Mularati, has once again changed employers. Alphabet's Google announced that Zoph will return as Vice President of Research, bring
How Recursive Intelligence Raised $335M at $4B Valuation in 4 Months
The co-founders of startup Ricursive Intelligence seemed destined to be co-founders.Anna Goldie, CEO, and Azalia Mirhoseini, CTO, are so well-known in the AI community that they were among those AI engineers who “got those weird emails from Zuckerber











