An installation package for OpenClaw Assistant, a product of 360, leaked an SSL private key; Zhou Hongyi, the company's founder, had previously promised "never to disclose passwords."

Security researcher Lukasz Olejnik published an article on the X platform stating that 360's AI OpenClaw assistant, "360 Security Lobster," leaked an SSL private key in its installation package. The private key corresponds to the domain *.myclaw.360.cn and is valid until April 2027. Attackers could use this private key to impersonate 360 ​​servers, intercept user traffic, or forge login pages. Previously, 360 founder Zhou Hongyi promised "never to disclose passwords" when launching the product. It's worth noting that 360 currently has 461 million users and a company valuation of approximately $10 billion. This information has also been corroborated by some developers in the Chinese-speaking region.