Chained OpenClaw Flaws Enable WhatsApp-Triggered Host RCE via Bind Mount Bypass

Researcher Chinmohan Nayak demonstrated that getBlockedReasonForSourcePath() only checks downward for blocked paths such as ~/.ssh while permitting mounts of parent directories like /home. This allows an attacker to read all user credentials or obtain the Docker socket for full host escape. The flaws were fixed in version 2026.6.6 after Nayak reported the issues to maintainers. The attack requires no initial access inside the container and works from untrusted channel input.

Procurement records and GitHub advisory histories show similar sandbox bypass patterns in prior AI agent frameworks released between 2024 and 2025. Official statements emphasize configuration dependence while independent verification confirms the parent-directory bypass works under default bind-mount settings. No CVE assignment has occurred despite active exploitation paths being public.

Client-side AI assistants now process external messaging channels at scale for billions of users yet receive less scrutiny than server endpoints. The pattern indicates that tool allowlists and denylists remain reactive rather than structurally enforced. Mainstream coverage continues to focus on server-side prompt injection while client-to-host chains stay underreported.

Operators should enforce sandbox mode on all non-main sessions and remove exec from channel-facing tool lists within 30 days. Monitoring for git clone commands using the ext:: protocol provides an immediate detection signal. Future releases must implement bidirectional path validation to close the observed bypass class.