OpenClaw suffers from a "self-attack" vulnerability: mistakenly executing Bash commands leads to key leakage
BlockBeats news, on March 5, Web3 security company GoPlus posted that the AI development tool OpenClaw recently experienced a "self-attack" security incident. During the execution of automated tasks, the system constructed an incorrect Bash command while calling a Shell command to create a GitHub Issue, accidentally triggering command injection and causing a large number of sensitive environment variables to be exposed.
In the incident, the AI-generated string contained set wrapped in backticks, which Bash interpreted as command substitution and automatically executed. Since Bash outputs all current environment variables when set is executed without parameters, more than 100 lines of sensitive information (including Telegram keys, authentication tokens, etc.) were directly written into the GitHub Issue and publicly released.
GoPlus recommends that in AI automated development or testing scenarios, API calls should be used instead of directly concatenating Shell commands, and the principle of least privilege should be followed to isolate environment variables. High-risk execution modes should be disabled, and manual review mechanisms should be introduced for critical operations.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
BUZZ - Halozyme shares rise after winning a case against Merck's injectable Keytruda in a Dutch court
October 7 – Halozyme (HALO.O) shares rose 1.4% pre-market to $111.24. Halozyme announced it had obtained an injunction from a Dutch court (link), prohibiting Merck MRK.N from manufacturing, selling, and importing subcutaneous Keytruda in eight European markets. The court determined that Merck had infringed Halozyme’s EP622 patent and rejected Merck’s claims that the patent was invalid. Halozyme stated that patients will still have access to the intravenous version of Keytruda, which is not affected by the injunction. As of the close of the previous trading day, HALO shares have risen 62% this year. (For non-English speakers, Reuters automatically translates its reports into several languages. Due to possible errors or missing context in automated translations, Reuters does not guarantee the accuracy of such translated texts, which are provided for readers’ convenience only. Reuters assumes no liability for any damages or losses caused by use of the automated translation function.)
BUZZ-KeyBanc upgrades Corteva rating to "Overweight"; stock price rises
On October 7, KeyBanc upgraded the rating of agricultural technology company Corteva Inc (CTVA.N) from "Sector Weight" to "Overweight." CTVA rose 1.6% in pre-market trading to $14.1. The brokerage pointed out that new product launches, cost reductions, and improvements in farmers' economic conditions will be strong growth drivers for 2028-2029. The company’s ample cash reserves enable it to flexibly fund growth initiatives, stock buybacks, and potential acquisitions. Out of 23 brokerages, 16 have given the stock a "Buy" or higher rating, and 7 have rated it "Hold." The median target price is $18. As of the previous trading day's close, the stock had gained 38.3% year to date.
Antofagasta’s Centinela strike adds copper supply risk
Elon Musk personally defines Terafab: TSMC can at most "sublease a portion," operation is out of the question.
Musk clarified that Terafab will be independently constructed and operated, with TSMC possibly subleasing part of the site; Intel will be involved in technology development and will supply Tesla and SpaceX AI.
Crypto prices
More
