OpenClaw is averaging 1.8 CVEs *PER DAY* https://days-since-openclaw-cve.com/

[cwebber@social.coop]

By the way, I encourage browsing through the CVEs reported https://nvd.nist.gov/vuln/search#/nvd/home?keyword=openclaw&resultType=records

These are by and large not minor CVEs.

[rnd@toot.cat]

@cwebber honestly, at this point i expect openclaw servers to get automatically hacked within minutes, the same way you couldn't let a windows xp sp1 machine online without having it subjected to either the malware that knocked down a system service and forced your machine to shut down after a minute or the malware that knocked down a system service and caused weird bugs to happen

[simulo@hci.social]

@cwebber number go up!

[alienghic@timeloop.cafe]

@cwebber

Is it a crime to hack instances in a country you're at war with?

Some of those openclaw agents were in Russia.

[vv@solarpunk.moe]

@cwebber the more CVEs a project has, the more Web Scale it is

[maol@c.im]

@cwebber
OpenClaw is averaging 1.8 CVEs *PER DAY*... since day 1, i.e. November 2025, wow!

They must be popular to have so many security researchers check them out

[shansterable@ohai.social]

@cwebber
CVE = Common Vulnerabilities and Exposures, in case that helps anyone else besides me

I try to do for initialisms and acronyms what alt text does for images.

Wikipedia: "The Common Vulnerabilities and Exposures (CVE) system, originally Common Vulnerability Enumeration, provides a reference method for publicly known information-security vulnerabilities and exposures."

[phl@mastodon.social]

@vv @cwebber https://tenor.com/h1iAp0cylbl.gif

[thanatoidjones@mastodon.social]

@shansterable @cwebber Thank you!

[darkling@mstdn.social]

@vv @cwebber I thought webscale was the unsightly crusty build-up on the inside of the intertubes.

[disorderlyf@todon.eu]

@cwebber

[vv@solarpunk.moe]

@phl @cwebber yep, this is what i was thinking of, haha

[turre@mementomori.social]

@cwebber CVE as a service

[phl@mastodon.social]

@vv @cwebber It lives rent free in our heads all these years later

[ckure@infosec.exchange]

@cwebber Everybody: AI can’t find CVEs
OpenClaw: Bet

[vv@solarpunk.moe]

@phl @cwebber i can't bring myself to watch it because the voice is so annoying

[lunathemoongirl@cailincat.cloud]

@cwebber I mean you could make an argument that the CVE s dont matter given the target audience of openclaw

[cwebber@social.coop]

@lunathemoongirl Indeed, OpenClaw is a CVE

[lunathemoongirl@cailincat.cloud]

@cwebber why bother exploiting the program when i can ask the Aiagent to please hand over all the keys and password

[solonovamax@tech.lgbt]

@cwebber I doubt they update frequently, so you can even try some quite old CVEs against them!