GHSA-hjr6-g723-hmfm: OpenClaw WhatsApp-to-Host Attack Chain – Detection and Remediation

A critical attack surface has emerged at the intersection of personal AI assistants and instant messaging. Recent research has detailed a "WhatsApp-to-Host" attack chain leveraging three now-patched vulnerabilities in the OpenClaw personal AI assistant. The most severe of these, tracked as GHSA-hjr6-g723-hmfm (CVSS 8.8), enables remote actors to bridge the gap between a WhatsApp message and the underlying host operating system.

For defenders, this is a high-priority issue. The vulnerability allows for credential theft, unauthorized privilege escalation, and arbitrary code execution without user interaction beyond the initial message receipt. If your organization utilizes OpenClaw or allows personal AI tools in the environment, immediate patching and detection enforcement are required to prevent host compromise.

Technical Analysis

Affected Product: OpenClaw Personal AI Assistant Vulnerability ID: GHSA-hjr6-g723-hmfm Severity: High (CVSS 8.8)

OpenClaw functions as an AI assistant that integrates with communication platforms like WhatsApp to automate tasks. The vulnerability stems from improper sanitization of inputs received via the WhatsApp integration module.

The Attack Chain

1. Initial Vector: An attacker sends a specially crafted message or payload to the target's WhatsApp number linked to the OpenClaw instance.
2. Processing: The OpenClaw application processes the incoming message. Due to the flaws identified (specifically GHSA-hjr6-g723-hmfm), the application fails to properly isolate the parsing logic from the host system.
3. Exploitation: The payload triggers a buffer overflow or logic flaw, allowing the attacker to break out of the application sandbox.
4. Execution: Arbitrary code is executed on the host OS under the context of the OpenClaw user.

While the vendor has released patches, the barrier to entry for exploitation is low, requiring no authentication beyond WhatsApp access. This makes it a prime candidate for automated worming or targeted phishing campaigns.

Detection & Response

Defenders must assume that patches may not be applied immediately. Therefore, detecting the exploitation attempt—specifically the unusual process spawning behavior resulting from the WhatsApp-to-Host bridge—is critical.

SIGMA Rules

---
title: Potential OpenClaw Exploitation via Shell Spawn (Windows)
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects OpenClaw spawning a shell process, indicative of the GHSA-hjr6-g723-hmfm exploit chain or unauthorized code execution.
references:
  - https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\OpenClaw.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative tasks performed by OpenClaw
level: high
---
title: OpenClaw Suspicious Child Process (Linux)
id: 9d8c7b6a-5f4e-3d2c-1b0a-9f8e7d6c5b4a
status: experimental
description: Detects OpenClaw spawning a shell or scripting interpreter on Linux hosts, potentially indicating exploit of GHSA-hjr6-g723-hmfm.
references:
  - https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: '/openclaw'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/perl'
  condition: selection
falsepositives:
  - Authorized script execution via AI assistant
level: high

KQL (Microsoft Sentinel / Defender)

DeviceProcessEvents
| where InitiatingProcessFileName =~ "OpenClaw.exe" or InitiatingProcessFileName =~ "openclaw"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "zsh", "python")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256
| order by Timestamp desc

Velociraptor VQL

-- Hunt for OpenClaw spawning shells or interpreters
SELECT Parent.Name AS ParentProcess, Name, Pid, Ppid, CommandLine, Exe
FROM pslist()
WHERE Parent.Name =~ "OpenClaw"
  AND Name IN ("cmd.exe", "powershell.exe", "bash", "sh", "python", "perl")

Remediation Script (PowerShell)

# OpenClaw GHSA-hjr6-g723-hmfm Emergency Response Script
# Checks for running OpenClaw processes and terminates them if patch status is unknown

$ProcessName = "OpenClaw"
$RunningProcess = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue

if ($RunningProcess) {
    Write-Warning "[ALERT] OpenClaw is currently running and vulnerable to GHSA-hjr6-g723-hmfm."
    Write-Host "Terminating process $ProcessName to mitigate immediate risk..."
    
    try {
        Stop-Process -Name $ProcessName -Force -ErrorAction Stop
        Write-Host "[SUCCESS] Process terminated."
    } catch {
        Write-Error "[ERROR] Failed to terminate process: $_"
    }
} else {
    Write-Host "[INFO] OpenClaw is not currently running."
}

Write-Host "[ACTION] Please apply the latest security patch from the OpenClaw vendor immediately."

Remediation

To fully remediate this threat, organizations must take the following steps:

1. Apply Patches Immediately: Update OpenClaw to the latest version provided by the vendor that addresses GHSA-hjr6-g723-hmfm. Verify the build number includes the fixes mentioned in the official security advisory.
2. Review Integration Permissions: If immediate patching is not possible, temporarily disable the WhatsApp integration module within OpenClaw to sever the attack vector.
3. Principle of Least Privilege: Ensure the OpenClaw application runs with a non-administrative user account. This limits the potential impact of a successful RCE to the user level rather than SYSTEM.
4. Network Segmentation: Restrict the ability of AI assistant endpoints to communicate directly with the internet or internal critical systems unless explicitly necessary.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub