360 responds to the leak of the security lobster private key: It was caused by a business error; the certificate, which was only valid for local use, has been revoked.

According to 1M AI News, the 360 ​​security team responded to the leak of the OpenClaw wildcard certificate and private key, stating that it was a business error that resulted in an internal domain name certificate being packaged into the installation package. The certificate in question, *.myclaw.360.cn, actually resolves to the local loopback address 127.0.0.1, and is used only on the user's local machine, providing no external service. After receiving reports from multiple security researchers, 360 has applied to revoke the certificate. The certificate is now invalid and can no longer be used for any legitimate HTTPS encrypted communication; ordinary users are not affected. The theoretical risk of man-in-the-middle attacks still exists during the leak, but since the service corresponding to the certificate only runs in the local environment, the actual risk is relatively limited. Previous news: The 360 ​​OpenClaw assistant installation package leaked an SSL private key; Zhou Hongyi had previously promised "never to leak passwords."