endorlabs.comwriteup

AI SAST in Action: Finding Real Vulnerabilities in OpenClaw | Blog | Endor Labs

Endor Labs describes applying its AI SAST engine to the open-source OpenClaw AI agent framework, tracing data flows from attacker-controlled sources (HTTP params, config, conversation history, external API responses) through transformations to dangerous sinks like command execution and file operations. The team validated findings by deploying OpenClaw in Docker and building working proof-of-concept exploits, confirming 7 vulnerabilities spanning HTTP handlers, business logic, tool dispatch, and low-level implementation layers, now reported to maintainers via responsible disclosure with technical details pending patch release.