OpenClaw gives users yet another reason to be freaked out about security

OpenClaw, a viral AI agentic tool with 347,000 GitHub stars, patched a critical privilege escalation vulnerability (CVE-2026-33579, CVSS 8.1–9.8). The flaw allowed any attacker with the lowest-level pairing permission to silently elevate themselves to full admin access with no user interaction required. For organizations using OpenClaw as a company-wide AI agent platform, this means an attacker could read all connected data sources, exfiltrate credentials, execute arbitrary tool calls, and pivot to other connected services — effectively a full instance takeover.