OpenClaw security risks: what CTOs need to know before autonomous AI agents reach your infrastructure

OpenClaw went from a weekend hobby project to 179,000 GitHub stars in under a month. It also triggered security advisories from Cisco, CrowdStrike, Kaspersky, Microsoft, and Palo Alto Networks in the same timeframe. For CTOs watching the agentic AI wave, OpenClaw is not just another viral open-source tool. It is a live stress test of every assumption enterprises hold about perimeter security, credential management, and software supply chains. 

This article examines the documented OpenClaw security risks, the design choices that make those risks systemic, and the decisions technology leaders must make as autonomous AI agents approach production environments.

What is OpenClaw?

OpenClaw is an open-source, self-hosted AI agent that connects to large language models and autonomously executes real-world tasks: sending emails, controlling browsers, running shell commands, and automating workflows through WhatsApp, Telegram, and Slack. Built by Peter Steinberger (creator of PSPDFKit), it launched as Clawdbot in November 2025, was renamed twice due to trademark disputes, and by mid-February 2026, Steinberger announced he was joining OpenAI with the project transitioning to an independent foundation.

The tool gained traction because it delivered what big tech’s assistants never managed and that was a genuinely autonomous agent that takes action, not just generates text. In a single week it drew 2 million visitors and caused a temporary Mac mini shortage as users built always-on AI servers. But for security teams, the real concern is that OpenClaw is already appearing on corporate networks, connected to enterprise SaaS tools like Slack, GitHub, and Salesforce, often deployed by employees without formal IT approval. Its persistent memory, privileged system access, and broad messaging integrations make it a highly concentrated attack surface.

Critical vulnerabilities and OpenClaw security risks

A Kaspersky security audit identified 512 vulnerabilities, eight critical. The most severe, CVE-2026-25253 (CVSS 8.8), enables remote code execution where an attacker creates a malicious webpage, the agent visits it, and the gateway token leaks and it grants full administrative control in milliseconds. Patched in version 2026.1.29, but thousands of instances remained unupdated for weeks. By mid-February, Endor Labs disclosed six more vulnerabilities including SSRF and path traversal bugs.

Compounding this, OpenClaw ships with authentication disabled by default. The gateway trusts localhost connections, but most deployments use reverse proxies that make external traffic appear local. Independent scans found over 40,000 exposed instances across 52 countries, with 93.4% exhibiting authentication bypass conditions.

OpenClaw exposed instances on the public internet, late January to mid-February 2026.

Supply chain poisoning: the ClawHavoc campaign

OpenClaw extends through “skills” and community plugins with full filesystem and network access. In late January 2026, threat actors flooded the ClawHub marketplace with trojanized skills. The ClawHavoc campaign ultimately comprised 1,184 malicious packages across 12 publisher accounts. Attackers used ClickFix social engineering to trick users into running terminal commands that delivered the Atomic macOS Stealer (AMOS), exfiltrating browser credentials, SSH keys, and crypto wallets.

OpenClaw partnered with VirusTotal to scan published skills, but acknowledged the limitation: prompt injection payloads and natural-language malicious instructions will not trigger a virus signature.

Prompt injection: the risk that patches cannot fix

Prompt injection is where malicious instructions in emails, documents, or messages are interpreted as legitimate commands which represents a structural risk no software update can eliminate. A successful injection can enable automated lateral movement at machine speed. Cisco’s research demonstrated attack chains where a single malicious payload could direct the agent to exfiltrate files or create backdoor integrations with attacker-controlled bots. Because the underlying LLM cannot distinguish between trusted instructions and untrusted data, this class of risk is inherent to every AI agent with broad system access.

Data protection implications

When connected to enterprise systems, OpenClaw can access email content, calendar data, cloud documents, and OAuth tokens that enable lateral movement. Its persistent memory retains everything across sessions. API keys and session tokens are stored in plaintext JSON files by default. The Moltbook platform, which is a social network built for OpenClaw bots, inadvertently exposed approximately 1.5 million API tokens and 35,000 email addresses due to misconfigured database security. For organizations subject to GDPR, CCPA, or sector-specific compliance frameworks, an unapproved OpenClaw instance processing customer data introduces material regulatory exposure.

What CTOs should do now

The strategic response to OpenClaw should not begin and end with blocking a single tool. The underlying pattern of employees adopting powerful autonomous agents without security review will only intensify as the agentic AI ecosystem matures. What is needed is a structural shift in how organizations classify and govern these systems.

Conclusion

OpenClaw is the first highly visible case study of what happens when autonomous AI agents are deployed without adequate security architecture. The combination of privileged system access, persistent state, a permissionless plugin ecosystem, and inherent susceptibility to prompt injection creates a risk profile that existing enterprise security models were not designed to contain. The lesson is not to avoid agentic AI because the productivity benefits are real and the market is moving decisively in this direction. The lesson is that autonomous agents must be treated as privileged infrastructure, demanding the same rigor around isolation, monitoring, and access governance that organizations apply to their most sensitive systems.

Getting this right requires working with an AI development partner who understands agentic architectures, security engineering, and compliance frameworks and who can help design systems where intelligence and safety are not in opposition.