A single WhatsApp message could hijack a personal AI assistant's computer: why it is not safe to use

What happened

On July 10, 2026, a security researcher explained how three flaws in OpenClaw, a personal AI assistant, could be linked together. When combined, one incoming WhatsApp message could run code on the user's computer without the user doing anything.

Two of the flaws (GHSA-hjr6-g723-hmfm and GHSA-9969-8g9h-rxwm) plus a path-traversal bug (GHSA-575v-8hfq-m3mc, meaning the app could be tricked into opening files outside its allowed area) let an attacker break out of the assistant's limited workspace. From there they could reach protected folders and read secrets such as SSH keys and cloud credentials. OpenClaw fixed the issues in version 2026.6.6. Related bugs were reported in May 2026.

What it means for you

If you run an assistant that reads your messages, remember this: text a stranger sends can become instructions the assistant follows, not only what you type yourself. A message you never opened can still cause harm.

What to do instead

Update any AI assistant to its latest version and turn on automatic updates. Think before you let an agent read incoming messages, email, or files from people you do not know. Give it access to only the folders it truly needs.

AgentPod lists only skills we have reviewed and tested, so you start from a smaller, checked set rather than anything you find online.

Sources:

• https://thehackernews.com/2026/07/researcher-details-whatsapp-to-host.html