OpenClaw browser agents

OpenClaw’s official docs show two browser modes: a managed, isolated profile named "openclaw" and an attachable profile that uses "driver: 'existing-session' / attachOnly: true" to hook agents into an already-running Chromium session. (openclaws.io) The browser-control service binds to localhost ports derived from the Gateway (default gateway.port = 18791), meaning the agent’s control plane listens on loopback rather than an external endpoint by default. (openclaws.io) OpenClaw’s browser tooling uses Playwright and the Chrome DevTools Protocol (CDP) to let agents perform authenticated workflows — navigation, DOM interaction, screenshots, and form submissions — the same primitives needed to automate ticketing, portal login, and SOP capture. (lzw.me) Multiple security firms have published exploit findings: ZeroPath reported a flaw that lets malicious websites abuse OpenClaw to exfiltrate credentials and noted the project amassed roughly 149,000 stars on GitHub during early adoption. (zeropath.com) Oasis Security published a proof-of-concept titled "ClawJacked" showing an attacker could guess or abuse gateway authentication to gain full control of an agent and escalate to workstation-level access in their tests. (oasis.security) Vendor advisories from CrowdStrike and community analyses recommend treating OpenClaw installations as high‑privilege services because they can run shell commands, access files, and persist interaction history; hardening advice includes restricting private-network/CDP access and implementing red‑teaming and prompt‑injection testing. (crowdstrike.com)