The OpenClaw Security Crisis: What Happened and What to Do
In early 2026, security researchers found critical vulnerabilities in tens of thousands of OpenClaw instances. Here's the full timeline and how to protect yourself.
The Timeline
January 2026: OpenClaw launches on GitHub and gains 60,000 stars in 72 hours. Millions of users rush to install it. Most follow basic setup guides without security hardening.
Late January 2026: Security researchers at Palo Alto Networks begin scanning for publicly accessible OpenClaw instances. They find alarming numbers.
February 2, 2026: The Register publishes a detailed report on OpenClaw security issues. The findings are severe.
Key findings:
- 42,665 publicly accessible OpenClaw instances found through simple internet scans
- 93.4% had critical authentication bypass flaws — anyone could connect and control the agent
- 1.5 million API keys exposed through the Moltbook (now renamed) database incident
- 341 confirmed malicious skills discovered on ClawHub, primarily installing macOS malware disguised as trading tools
- One-click remote code execution vulnerability via crafted links — no user interaction required beyond clicking a URL
The "Lethal Quartet"
Palo Alto Networks identified what they called a "lethal quartet" of architectural features that, combined, create unacceptable risk:
- Email access — agents that can read and respond to email
- Untrusted content exposure — agents browsing arbitrary websites
- External communication ability — agents that can send messages and make API calls
- Persistent memory — agents that remember instructions from previous sessions
An attacker only needs to get malicious instructions into one of these channels. The persistent memory ensures the instructions survive across sessions. The communication ability allows data exfiltration. And email access provides the initial attack vector.
What the Experts Said
Kaspersky flagged OpenClaw as a significant threat vector for consumer devices.
Gary Marcus called it a "weaponized aerosol" — powerful and impossible to contain once released.
Gartner stated that OpenClaw carries "unacceptable cybersecurity risk" for enterprise deployment without significant hardening.
The Malicious Skills Problem
ClawHub, the main skill marketplace for OpenClaw, was found to host 341 malicious skills. These skills appeared legitimate — labeled as trading tools, productivity enhancers, or automation helpers — but contained hidden payloads.
Common attack patterns:
- Installing macOS malware that persisted across reboots
- Exfiltrating API keys and credentials
- Creating hidden backdoors for remote access
- Mining cryptocurrency using the host's resources
ClawHub has since implemented stricter screening, but the episode highlighted how the open plugin ecosystem creates supply chain risk.
What You Should Do Right Now
If you self-host OpenClaw:
-
Check if your instance is publicly accessible. Visit your server's IP/domain in a browser. If you see the OpenClaw interface without a login prompt, you're exposed.
-
Put it behind authentication immediately. Use a reverse proxy (Caddy or Nginx) with basic auth at minimum.
-
Update to the latest version. The core vulnerabilities have been patched, but only in recent releases.
-
Audit your installed skills. Remove any skills you don't recognize or actively use.
-
Rotate your API keys. If your instance was publicly accessible at any point, assume your API keys are compromised.
-
Review agent permissions. Disable email access and external messaging unless you specifically need them.
If you use managed hosting:
- Ask your provider if they've applied the latest security patches.
- Verify that your instance is not publicly accessible.
- Check that your API keys are stored with encryption (zero-knowledge is ideal).
If you haven't set up OpenClaw yet:
Wait for the security landscape to stabilize, or use a managed hosting provider that handles security for you. The self-hosted path requires genuine security knowledge.
The Bigger Picture
The OpenClaw security crisis is a preview of what happens when powerful AI agent technology goes mainstream before security practices catch up. The software itself isn't inherently dangerous — but the default configuration trusts everything and locks down nothing.
As AI agents become more capable and more widely deployed, security-first configuration will need to be the default, not the exception. Until then, the responsibility falls on individual users and hosting providers to get it right.
Resources
- Check if your instance is exposed: scan your domain/IP for open port 18789
- Security hardening guide: see our detailed walkthrough
- OpenClaw security mailing list: subscribe on the official GitHub repository
- Report suspicious skills: use ClawHub's reporting mechanism