Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-24 · source-backed
A novel vulnerability in OpenClaw: the current working directory path was embedded into agent system prompts without sanitization. Control characters in directory names (newlines, Unicode bidi/zero-width markers) break prompt structure and inject attacker instructions. Patched in version 2026.2.15. Critical implication: ANY agent that embeds filesystem paths, URLs, or other system-derived strings into prompts without sanitization is vulnerable. Audit all system-derived string inputs to your LLM prompts.
Each link below shares sources, entities, or timing with this story.
OpenClaw uses Claude Code / Shared entities / Same source domain / What happened next
Linked by a graph relationship (OpenClaw uses Claude Code); both cover Audit, LLM, URLs; reported by the same outlet (github.com).
Anthropic deprecates OpenClaw / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Anthropic deprecates OpenClaw); both cover Audit, LLM; overlapping topics (agent, control).
Microsoft released OpenClaw / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Microsoft released OpenClaw); both cover Critical, CVE; overlapping topics (agent, attacker, critical).
Linked by a graph relationship (Microsoft released OpenClaw); both cover Audit, CVE; overlapping topics (agent, audit, critical).
Microsoft released OpenClaw / Shared entities / What happened next
Linked by a graph relationship (Microsoft released OpenClaw); both cover Audit, CVE, LLM; picks up the Audit thread on 2026-06-17.
Anthropic deprecates OpenClaw / Shared entities / Same source domain / What happened next
Linked by a graph relationship (Anthropic deprecates OpenClaw); both cover CVE, LLM; reported by the same outlet (github.com).
OpenClaw uses SQLite / Shared entities / Shared topic / What happened next
Linked by a graph relationship (OpenClaw uses SQLite); both cover Audit, CVE; overlapping topics (agent, attacker).
Anthropic deprecates OpenClaw / Shared entities / Same source domain / What happened next
Linked by a graph relationship (Anthropic deprecates OpenClaw); both cover Control, LLM; reported by the same outlet (github.com).