Saint Claw Chain, Who Broke the Agent's Cage

Patron of AI agents left to their own devices, sandboxes checked a moment too early, and plugins trusted too much.

Life

On 15 May 2026 researchers at Cyera published Claw Chain: four chainable vulnerabilities in OpenClaw, the open-source AI agent platform. Anyone who gained execution inside the OpenShell sandbox, through a malicious plugin or a prompt injection, could ride two check-then-use races to read and write outside the cage, steal keys and tokens from environment variables and, thanks to a "senderIsOwner" flag taken at its word, promote themselves to master of the agent. The patches had shipped on 23 April 2026, before publication.

Prayer

O Saint Claw Chain, who teaches agents to slip their pen, keep our digital claws where we put them. Amen.

How to celebrate

Celebrated by updating OpenClaw past the 23 April 2026 patches, installing only trusted plugins, and never letting the client say who the owner is.

Give the agent a finger and it takes the whole paw.