Skip to content
Adoption Curve SeriesUpdated February 2026

OpenClaw Risk Assessment

An independent look at security risks in one of the most popular open-source AI agent frameworks.

What Is OpenClaw?

OpenClaw is an open-source personal AI agent created by Peter Steinberger, an Austrian developer. Originally launched as "Clawd" in November 2025, it was renamed to Moltbot on January 27, 2026, then to OpenClaw on January 30. It runs locally on your machine and connects to messaging platforms like WhatsApp, Telegram, Discord, Slack, and Microsoft Teams. With 140K+ GitHub stars and 2 million visitors in its first week, it's one of the fastest-growing agent projects in the wild.

It makes building conversational AI agents remarkably easy. That's both the appeal and the problem.

In February 2026, Steinberger announced he was joining OpenAI, and the project is moving to an open-source foundation.

What It Does Well

This isn't a takedown piece. OpenClaw has made real investments in security tooling — including 34 security-focused commits in the rebrand release and published machine-checkable security models. The problem is that none of it is on by default.

Docker Sandboxing

Optional containerised execution isolates skills from the host system. When enabled, it significantly limits blast radius.

Permissions System

Granular permission controls exist for skills, tool access, and user authorisation. Configuration-driven with role-based access.

Security CLI

A dedicated security command-line tool scans configurations for common misconfigurations and suggests hardening steps.

The Core Problem

It ships unlocked.

Security in OpenClaw is opt-in, not built-in. The default configuration prioritises developer convenience over safety. That's a reasonable choice for a local experiment — but these agents don't stay local.

Technical Detail ▸

The default setup binds an unauthenticated HTTP endpoint, stores credentials in plaintext config files, and provides no network segmentation between skills. Security researchers have documented 600+ publicly-exposed instances running default configurations. The gap between "it works on my laptop" and "it's in production" is one deployment command.

Risk Matrix

Critical— Exploitable with minimal effort

Insecure by Default

Out of the box, OpenClaw has no authentication. Anyone who can reach the server can control it. Security is opt-in, not built-in.

Technical Detail ▸

Default configuration binds to 0.0.0.0:3978 with no auth middleware. The /api/messages endpoint accepts unauthenticated POST requests. Security features (API keys, allowlists) exist but must be explicitly enabled in configuration.

Publicly Exposed Instances

Security researchers found over 600 OpenClaw instances visible on the public internet, many with default settings. That means open doors to corporate systems.

Technical Detail ▸

Shodan/Censys scans reveal 600+ internet-facing instances on default ports. Many expose the Bot Framework Emulator endpoint. Combined with no default auth, these are effectively unauthenticated RPC endpoints into corporate infrastructure.

Plaintext Credential Storage

API keys and passwords are stored in plain configuration files by default. If someone accesses the server, they get everything.

Technical Detail ▸

Credentials stored in .env files and appsettings.json without encryption at rest. No integration with secrets managers (Vault, AWS Secrets Manager) out of the box. Bot Framework App ID/Password, LLM API keys, and service credentials all co-located in plaintext.

High— Requires context-specific exploitation

Shadow AI Risk

Teams can spin up OpenClaw instances without IT knowledge. It connects to Slack, Teams, WhatsApp, and more. Invisible AI agents talking to customers is a compliance nightmare.

Technical Detail ▸

Single npm install + config file = operational agent. No central registry or discovery mechanism. Agents can be connected to production messaging channels (Teams, Slack) using personal developer tokens without organisational approval flows.

The Localhost Fallacy

Many operators assume running on localhost is safe. It isn't. Other software on the same machine, browser exploits, or port forwarding can all reach a localhost service.

Technical Detail ▸

Binding to localhost (127.0.0.1) does not prevent access from: local malware, SSRF from co-hosted apps, browser-based DNS rebinding attacks, or container networking in Docker/Kubernetes. The Bot Framework Emulator specifically requires port exposure.

Lateral Movement Vector

Because OpenClaw connects to tools (calendars, databases, file storage), a compromised instance is a gateway to move across your entire infrastructure.

Technical Detail ▸

OpenClaw skills can execute HTTP requests, database queries, and file operations with the host process permissions. No network segmentation enforced by default. A compromised skill can enumerate and access any service reachable from the host network.

Financial Theft via Tool Access

Skills that connect to payment systems, invoicing, or financial APIs could be manipulated through prompt injection to authorize transactions.

Technical Detail ▸

LLM tool-use exploits (prompt injection, indirect prompt injection via message content) can trigger skill execution. No transaction signing, amount limits, or out-of-band confirmation for financial operations. The LLM decides tool invocation, not a deterministic policy engine.

Memory Poisoning

OpenClaw can store conversation history. Attackers can manipulate that memory to change how the agent behaves in future conversations.

Technical Detail ▸

Conversation state stored in memory/CosmosDB without integrity verification. An attacker with message access can inject instructions that persist across turns. No content integrity hashing, anomaly detection, or memory isolation between conversation contexts.

Medium— Organisational and process risks

Project Maturity Concerns

The project has limited security documentation and no published CVE response process. It moves fast but security practices lag behind.

Technical Detail ▸

No SECURITY.md or vulnerability disclosure policy in the repository. No evidence of regular security audits or penetration testing. Dependency update cadence is inconsistent for security patches.

Bring-Your-Own Keys Model

Users plug in their own API keys for LLMs and services. If those keys leak through OpenClaw, the user is liable, not the project.

Technical Detail ▸

API keys passed via environment variables with no scoping, rotation, or usage monitoring. No key isolation between skills. A malicious skill can access all configured API keys via process.env.

Skill Marketplace Vulnerabilities

Community-built skills are essentially plugins with full system access. The review process for contributed skills is not security-focused.

Technical Detail ▸

Skills execute as local file packages with the same permissions as the host process. No sandboxing, capability restrictions, or mandatory code review for community contributions. Unlike remote MCP servers, skills run entirely on the host machine. Cisco's Skill Scanner analysis of 31,000 agent skills found 26% contained at least one vulnerability.

Supply Chain Warning

Think browser extensions, but worse. OpenClaw skills are community-contributed plugins that execute locally as file packages — not remote like MCP servers. They run with full system access. Unlike browser extensions, there's no sandboxed permissions model, no review gate, and no revocation mechanism.

Cisco's open-source Skill Scanner tool analysed 31,000 agent skills and found 26% contained at least one vulnerability. A malicious skill called "What Would Elon Do?" ranked #1 in the marketplace while containing data exfiltration and prompt injection payloads.

Technical Detail ▸

Specific attack vectors identified in the skill ecosystem:

  • Data exfiltration: Skills can make arbitrary HTTP requests (e.g., curl to external servers with conversation data).
  • Prompt injection: Malicious skills can inject system prompts that override the agent's instructions.
  • Tool poisoning: A compromised skill can return manipulated data to the LLM, causing downstream tool calls to execute unintended operations.
  • Dependency confusion: npm-based skill installation is vulnerable to package substitution attacks.

Pilot Recommendation

If your team wants to evaluate OpenClaw, here's a phased approach that manages risk.

Phase 1

Isolated Evaluation

  • • Run in a dedicated VM or container with no access to production networks
  • • Use test API keys with spending limits and rotation
  • • Connect only to sandboxed messaging channels (not production Slack/Teams)
  • • Enable all available security features from day one
  • • Log everything — review agent actions weekly
Technical Detail ▸
  • Deploy via Docker Compose with network isolation (internal-only network)
  • Set AUTH_REQUIRED=true, configure API key auth middleware
  • Bind to 127.0.0.1 only, expose via authenticated reverse proxy
  • Use dedicated service accounts with minimal IAM permissions
  • Enable the security CLI scanner and integrate with CI
Phase 2

Expanded Pilot

  • • Connect to limited production channels with human-in-the-loop approval for actions
  • • Only allow vetted, internally-reviewed skills
  • • Implement transaction limits and confirmation flows for any financial operations
  • • Set up anomaly detection on agent behaviour patterns
Technical Detail ▸
  • Integrate with corporate secrets manager (Vault/AWS Secrets Manager)
  • Deploy behind API gateway with rate limiting and request logging
  • Implement webhook-based approval flows for sensitive tool calls
  • Set up SIEM integration for agent action audit trails
  • Conduct penetration testing against the deployment

Hard No-Go Criteria

Do not proceed past Phase 1 if any of these apply:

  • • Cannot enforce network isolation between the agent and production systems
  • • Security features cannot be enabled (version incompatibility, config conflicts)
  • • No dedicated security review capacity for skill vetting
  • • Regulatory requirements prohibit AI agent access to the data in scope (HIPAA, PCI-DSS, SOX)
  • • No incident response plan exists for autonomous agent misbehaviour

Bottom Line

Pilot-safe with strict controls. Not enterprise-ready out of the box.

OpenClaw is a capable framework with genuine utility. But its default-open security posture means the gap between demo and disaster is dangerously small. Any serious deployment requires deliberate hardening that goes well beyond the quick-start guide.

Sources & Further Reading

This assessment applies the trust engineering framework to real-world agent evaluation.

Trust Engineering FrameworkAll Agent Topics
← Adoption CurveNext: MCP Trust Assessment →