GoPlus Security 🚦 (@GoPlusSecurity): 🛡️Did OpenClaw accidentally hack itself?

🛡️Did OpenClaw accidentally hack itself? — When using 🦞#OpenClaw for software development or testing, beware of AI misoperations that may lead to secret key leaks! In this incident, OpenClaw used a system tool (calling exec to run Shell commands) to create a GitHub Issue, but it constructed an incorrect Bash command. This caused OpenClaw to unintentionally perform a Bash injection attack on its own host device, resulting in over 100 lines of highly sensitive environment variables (including Telegram keys, authentication tokens, etc.) being directly inserted into the GitHub Issue content and publicly published. Details: 1. AI generated a string wrapped in double quotes "" intended for GitHub. 2. The string contained a word wrapped in backticks: `set`, which Bash interprets as a “command substitution.” As a result, Bash didn’t treat set as plain text but executed it silently as a subcommand. 3. In Bash, running set with no arguments prints all current environment variables. 4. OpenClaw executed set, and over 100 lines of core environment variables were concatenated into the GitHub Issue text and publicly posted. #GoPlusSecurity Recommendations: -Prefer API calls instead of letting AI directly build Shell commands. -Apply the principle of “least privilege” and strictly isolate environment variables. -Disable dangerous execution modes and ensure proper escaping/filters. -Introduce human-in-the-loop verification for critical operations. Further reading: https://substack.com/home/post/p-189184829