# AIVirusDB > Evidence-backed public intelligence for AI agent ecosystems. AIVirusDB publishes defensive, source-backed analysis of threats affecting MCP, OpenClaw, Hermes Agent, RAG, memory, and tool-connected AI systems. Cite the canonical record URL and its primary sources when using this material. ## Core resources - [Threat database](https://www.aivirusdb.com/threats/): Search verified AI agent threats, vulnerabilities, packages, and campaigns. - [Threat rankings](https://www.aivirusdb.com/rankings/): Explainable prioritization by risk, exploitation, confidence, and patch state. - [Taxonomy](https://www.aivirusdb.com/taxonomy/): The canonical AIVirusDB threat categories and definitions. - [Standards crosswalk](https://www.aivirusdb.com/standards/): Evidence mappings to OWASP, MITRE, CWE, and related frameworks. - [Methodology](https://www.aivirusdb.com/methodology/): Scoring, confidence, sourcing, and disclosure rules. - [Public threat dataset](https://www.aivirusdb.com/threats.json): Versioned machine-readable public records with source URLs. ## Public threat records - [Feishu tools could ignore per-account disablement](https://www.aivirusdb.com/threats/ghsa-2q7j-2vhx-56g8/): Feishu tools could ignore per-account disablement. GitHub Advisory Database identifies npm package @openclaw/feishu \< 2026.6.9-beta.1 as affected. Severity: high. Patch status: patched. - [Feishu permission tools could ignore per-account disablement](https://www.aivirusdb.com/threats/ghsa-w8wf-3qvj-6xqf/): Feishu permission tools could ignore per-account disablement. GitHub Advisory Database identifies npm package @openclaw/feishu \< 2026.6.9-beta.1 as affected. Severity: high. Patch status: patched. - [OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks](https://www.aivirusdb.com/threats/openclaw-qqbot-pre-dispatch-slash-commands-could-skip-allowfrom-checks-71e918ad/): A vulnerability in the OpenClaw QQBot component allows slash commands to be dispatched before the configured allowFrom policy is applied, potentially bypassing access controls. Severity: high. Patch status: patched. - [OpenClaw webhook rotation could leave a stale-secret window](https://www.aivirusdb.com/threats/openclaw-webhook-rotation-could-leave-a-stale-secret-window-49d83880/): Affected Slack and Zalo channel runtimes could accept an old webhook secret after secrets reload. Events could therefore be accepted briefly after an operator expected revocation. Severity: medium. Patch status: patched. - [OpenClaw browser actions could bypass private-network navigation checks](https://www.aivirusdb.com/threats/openclaw-browser-actions-could-bypass-private-network-navigation-checks-3089a568/): Some browser interactions could navigate beyond the initial private-network check. An authenticated caller with browser evaluation capability could read content that direct navigation policy would block. Severity: medium. Patch status: patched. - [OpenClaw workspace configuration could alter dependency setup](https://www.aivirusdb.com/threats/openclaw-workspace-configuration-could-alter-dependency-setup-32388e62/): A workspace environment file could influence executable selection during bundled dependency setup. Exposure depends on a trusted operator opening the workspace and lower-trust configuration reaching that feature. Severity: high. Patch status: patched. - [flock wrapper could bypass durable exec approval binding](https://www.aivirusdb.com/threats/ghsa-3fp5-v549-9v66/): flock wrapper could bypass durable exec approval binding. The official advisory identifies openclaw \<= 2026.6.6 as affected. Severity: high. Patch status: patched. - [Discord guild actions could skip cross-provider requester authorization](https://www.aivirusdb.com/threats/ghsa-3pmr-x9g8-m55r/): Discord guild actions could skip cross-provider requester authorization. The official advisory identifies openclaw = 2026.6.6 as affected. Severity: high. Patch status: patched. - [Browser CDP discovery could accept blocked WebSocket URLs](https://www.aivirusdb.com/threats/ghsa-3x84-qq85-fj65/): Browser CDP discovery could accept blocked WebSocket URLs. The official advisory identifies openclaw \< 2026.6.6 as affected. Severity: high. Patch status: patched. - [MCP loopback could expose owner-only tools to non-owner runs](https://www.aivirusdb.com/threats/ghsa-52xj-c9p8-78cv/): MCP loopback could expose owner-only tools to non-owner runs. The official advisory identifies openclaw \>= 2026.5.20, \< 2026.6.6 as affected. Severity: high. Patch status: patched. - [Sandbox bind mounts could bypass parent-directory denylist checks](https://www.aivirusdb.com/threats/ghsa-575v-8hfq-m3mc/): Sandbox bind mounts could bypass parent-directory denylist checks. The official advisory identifies openclaw \< 2026.6.6 as affected. Severity: high. Patch status: patched. - [Plugin install commands could allow non-owner persistence](https://www.aivirusdb.com/threats/ghsa-7vrr-rp4x-4g76/): Plugin install commands could allow non-owner persistence. The official advisory identifies openclaw \>= 2026.5.20, \< 2026.6.9 as affected. Severity: high. Patch status: patched. - [Host exec environment filtering could allow Git ext transport](https://www.aivirusdb.com/threats/ghsa-9969-8g9h-rxwm/): Host exec environment filtering could allow Git ext transport. The official advisory identifies openclaw \<= 2026.6.1 as affected. Severity: high. Patch status: patched. - [WhatsApp group IDs could satisfy elevated sender allowlists](https://www.aivirusdb.com/threats/ghsa-fh38-965w-f6c3/): WhatsApp group IDs could satisfy elevated sender allowlists. The official advisory identifies openclaw \>= 2026.3.22, \< 2026.6.6 as affected. Severity: high. Patch status: patched. - [Host exec environment filtering could miss interpreter startup variables](https://www.aivirusdb.com/threats/ghsa-hjr6-g723-hmfm/): Host exec environment filtering could miss interpreter startup variables. The official advisory identifies openclaw \<= 2026.6.1 as affected. Severity: high. Patch status: patched. - [OpenAI-compatible HTTP model overrides could miss admin authorization](https://www.aivirusdb.com/threats/ghsa-jhfx-v2j8-x3m6/): OpenAI-compatible HTTP model overrides could miss admin authorization. The official advisory identifies openclaw \<= 2026.6.6 as affected. Severity: high. Patch status: patched. - [OpenShell mirror sync could follow remote symlink parents](https://www.aivirusdb.com/threats/ghsa-m38g-vpwj-mpg9/): OpenShell mirror sync could follow remote symlink parents. The official advisory identifies openclaw \<= 2026.6.6 as affected. Severity: high. Patch status: patched. - [Sandbox exec-server HTTP requests could reach internal networks](https://www.aivirusdb.com/threats/ghsa-mgvr-6gvw-3rgr/): Sandbox exec-server HTTP requests could reach internal networks. The official advisory identifies openclaw \< 2026.6.6 as affected. Severity: high. Patch status: patched. - [Isolated cron jobs could regain denied exec tools](https://www.aivirusdb.com/threats/ghsa-mm9g-83wh-mhwj/): Isolated cron jobs could regain denied exec tools. The official advisory identifies openclaw \>= 2026.6.1, \< 2026.6.9 as affected. Severity: high. Patch status: patched. - [MS Teams message actions could miss requester authorization](https://www.aivirusdb.com/threats/ghsa-p5xh-frrh-cmgj/): MS Teams message actions could miss requester authorization. The official advisory identifies openclaw \>= 2026.4.12-beta.1, \< 2026.6.6 as affected. Severity: high. Patch status: patched. - [Native web search could ignore OpenClaw tool policy](https://www.aivirusdb.com/threats/ghsa-v4f6-x5g5-2g4g/): Native web search could ignore OpenClaw tool policy. The official advisory identifies openclaw \>= 2026.5.28, \< 2026.6.6 as affected. Severity: medium. Patch status: patched. - [Message mutations could skip requester authorization](https://www.aivirusdb.com/threats/ghsa-v7hx-r36p-f68m/): Message mutations could skip requester authorization. The official advisory identifies openclaw = 2026.6.6 as affected. Severity: high. Patch status: patched. - [Plugin install wrappers could skip install policy](https://www.aivirusdb.com/threats/ghsa-wgq8-x5wm-g4rw/): Plugin install wrappers could skip install policy. The official advisory identifies openclaw \>= 2026.6.5, \< 2026.6.9 as affected. Severity: medium. Patch status: patched. - [Host exec environment filtering could miss rustup startup variables](https://www.aivirusdb.com/threats/ghsa-wxh3-g47h-q3mc/): Host exec environment filtering could miss rustup startup variables. The official advisory identifies openclaw \<= 2026.6.2 as affected. Severity: high. Patch status: patched. - [MCP Go HTTP servers can accept cross-site requests that trigger tools](https://www.aivirusdb.com/threats/ghsa-89xv-2j6f-qhc8/): A malicious website can send cross-site requests to an MCP Go server lacking authorization, potentially invoking tools with the server's authority. Severity: high. Patch status: patched. - [LangChain serialization can expose secrets through untrusted agent data](https://www.aivirusdb.com/threats/ghsa-c67j-w6g6-q2cm/): Untrusted metadata can survive LangChain serialization as object instructions and expose environment secrets when vulnerable deserialization settings are used. Severity: critical. Patch status: patched. - [LangChain file-search agents can read beyond their configured directory](https://www.aivirusdb.com/threats/ghsa-gr75-jv2w-4656/): Untrusted paths, search patterns or symlinks can bypass directory boundaries in LangChain agent middleware and configuration loaders, exposing files outside the intended root. Severity: medium. Patch status: patched.