Mav Levin and the OpenClaw bug that made localhost a browser pivot

An OpenClaw user can do the sensible thing and keep the Gateway on localhost. That still leaves a browser in the security story. CVE-2026-25253 showed how a malicious page could steer the Control UI toward an attacker-chosen gateway, capture the stored token, and use the agent's own control plane. The person publicly attached to that research is Mav Levin, a security researcher whose February 2026 disclosure gave the issue a concrete attack chain and a patch trail.

Levin merits a profile because the useful part of this story is not a warning that AI agents are dangerous. It is the sequence of ordinary assumptions that failed together: a URL parameter, automatic connection, WebSocket origin handling, a bearer token, and administrative permissions. Each detail matters to an OpenClaw operator who wants to know what local actually protects.

The record points to Levin, with an important qualification

DepthFirst's research page was published on February 1, 2026. It carries Mav Levin's name and identifies him as a Founding Security Researcher. The article says DepthFirst's security system surfaced one logic flaw and that Levin combined it with a second bug he found. That is evidence of how the company and researcher describe the work, not an independent reconstruction of every step.

The GitHub Advisory Database record supplies a separate public record. It identifies the affected package as clawdbot, lists versions at or below 2026.1.28 as affected, and names 2026.1.29 as the patched version. The advisory rates the issue high at 8.8 and marks user interaction as required. It credits DepthFirstDisclosures as reporter and lists both Mav Levin and 0xacb as finders.

That last detail corrects the easy one-researcher version of the story. The public record supports Levin as a credited finder and as the author of a detailed public disclosure. It does not support calling him the sole author of every component, the sole finder, or the person who wrote the patch.

His public trail is technical, not mythic

Levin's own biography describes a path through AI security, vulnerability research, blockchain security, and offensive security. It says he studied computer science at Stanford, served in IDF Unit 8200, worked at Trail of Bits and Anthropic, and founded Stanford ZERO. It also lists a 2026 BSidesSF talk about weaponizing an OpenClaw vulnerability. These are self-reported career details, so they should be read as part of his public account rather than treated as independently verified credentials.

A second public trail is his GitHub profile. The account links back to mavlevin.com and shows public repositories connected to CyberQueens, uTorrent vulnerability research, and other CVE work. That does not prove the quality of every project or settle the chronology of his career. It does show a consistent public identity built around readable security work, exploit analysis, and code.

That background helps explain why the OpenClaw finding is a good fit for a profile. Levin's public work is less about describing a product from the outside and more about following a value across several boundaries until its consequences become visible.

The finding followed a chain of small assumptions

The first part of the chain was in the Control UI. According to the DepthFirst disclosure, the application accepted a gatewayUrl value from the query string, saved it, and connected to the new gateway during page load. The connection handshake included the stored authentication token. A crafted link could therefore make the browser send that token to a server chosen by an attacker.

That direct path was serious but limited. The disclosure says it depended on an internet-facing instance and did not by itself defeat local-only operation, sandboxing, or approval prompts. Levin then described the second part: OpenClaw's WebSocket server did not validate the browser's origin. A malicious site could use the victim's browser as a bridge to open a WebSocket connection to the victim's localhost Gateway, even though an outside server could not directly reach that loopback address.

The stolen token mattered because it was not a narrow session credential. The report says it carried operator.admin and operator.approvals authority. Through the Gateway API, the demonstrated chain could turn off command confirmation, change execution settings, and invoke a host command. The issue was therefore not a sandbox escape in isolation. It was a control-plane compromise that allowed the attacker to change the settings meant to contain the agent.

The repository advisory describes the same broad failure: an unvalidated gateway URL, automatic connection, token exposure, and operator-level access that could lead to code execution. The public evidence supports a composed chain. DepthFirst's system identified one part, Levin reported another, and the advisory credits another finder as well. That division is worth keeping visible.

Why localhost was not the whole boundary

Loopback is useful. It prevents ordinary remote clients from opening a direct connection to the Gateway. It does not prevent a browser that already has access to the Control UI from making an outbound connection, carrying cookies or stored application state, and speaking WebSocket to a local service. In this case, the browser changed the shape of the network boundary.

This is an inference from the documented chain, not a claim that localhost is useless. It means that a local binding answers only one question: where the service accepts direct network connections. It does not answer whether an authenticated browser, a web page, a query parameter, or a connected control plane can cause sensitive actions.

The chain also gives operators a better question than whether a feature is called a sandbox. If an attacker obtains an operator token, which controls remain independent of the compromised API? OpenClaw's approval prompts and execution mode were valuable controls, but the report shows why controls managed by the same administrative surface can fail together.

The patch and its version trail

The official advisory lists v2026.1.29 as the patched version. The release record shows that version was released on January 30, 2026 and included gateway security warnings, including warnings around tokens in query parameters and exposure without authentication.

The linked fix commit makes the behavioral change clearer. Instead of applying a new gateway URL immediately, the UI stores it as pending state. A confirmation modal shows the destination and warns that a malicious URL can compromise the system. The user must confirm before the connection is made. GitHub records the commit as authored by tyler6204 and 0xacb, another reason not to turn the disclosure into a single-author patch story.

There is also a version discrepancy that operators should not gloss over. The DepthFirst article's closing line gives an older affected cutoff, up to v2026.1.24-1, while the reviewed GitHub advisory lists versions through v2026.1.28. The sources do not explain the difference. For remediation, use the maintained advisory and verify the installed version rather than copying the older line from the disclosure.

What operators can take from the work

These are documented checks derived from the advisory and OpenClaw's security guidance. They are not results from a hands-on test in this profile.

1. Check the installed version before investigating anything else. For this vulnerability, the public advisory's boundary is v2026.1.29 and later. If an older authenticated Control UI may have been exposed to a malicious link, treat the token as potentially compromised and rotate it.
2. Check the actual network posture. OpenClaw's security documentation says a regular host install binds the Gateway to loopback, while container images have different exposure defaults. Run openclaw security audit and inspect reverse proxies, firewall rules, and authentication instead of relying on the word local.
3. Keep the browser in the threat model. An authenticated Control UI is part of the security boundary. The patch adds confirmation for a changed gateway URL, but a confirmation screen is still a decision point. Treat unexpected gateway destinations and links containing connection parameters as suspicious.
4. Keep one trust boundary per Gateway. The official guidance says a shared Gateway is for a single operator or mutually trusting team, not mutually adversarial users. Split the Gateway, credentials, and preferably the operating-system boundary when the users do not share trust.

Those checks reduce exposure. They do not prove that a machine was never compromised or that another OpenClaw feature is safe. That distinction is exactly the discipline the original research makes easier to see.

What the public record cannot prove

No source here proves widespread exploitation of CVE-2026-25253. The 8.8 CVSS score describes severity, not how many victims existed. The sources also do not prove that Levin alone discovered the full vulnerability, that he authored the patch, or that every OpenClaw installation had the same configuration.

Levin's biography remains partly self-description, and the BSidesSF event page linked from it was not available for independent review. The public GitHub and advisory records are stronger evidence for his identity as a credited finder than for every biographical claim on his site.

Finally, this finding does not settle the separate risks around third-party skills, plugins, prompt injection, or model providers. It addresses one control-plane chain. A patched browser pivot is not a general security certificate for an agent with host access.

Why Mav Levin merits the profile

Mav Levin's OpenClaw work is worth following because it makes a difficult security idea concrete. A service can be local and still be reachable through a user's browser. A permission system can look protective and still be changed by the control plane that owns it. The practical lesson is to follow the path between features, not inspect each feature in isolation. That is a useful profile of a researcher, and a useful way to read OpenClaw.

Sources

• Mav Levin, About Me (accessed 2026-09-13)
• Mav Levin public GitHub profile (accessed 2026-09-13)
• DepthFirst, 1-Click RCE To Steal Your OpenClaw Data and Keys (published 2026-02-01; accessed 2026-09-13)
• GitHub Advisory Database, CVE-2026-25253 (published 2026-01-31; accessed 2026-09-13)
• OpenClaw repository security advisory (published 2026-01-31; accessed 2026-09-13)
• OpenClaw v2026.1.29 release (published 2026-01-30; accessed 2026-09-13)
• OpenClaw gateway URL confirmation fix (accessed 2026-09-13)
• OpenClaw Gateway security documentation (accessed 2026-09-13)