There has been growing attention on OpenClaw, the viral open-source autonomous AI agent, after multiple security researchers highlighted weaknesses that make it a real risk if used without strong controls.
OpenClaw started life as Clawdbot, was later renamed Moltbot, and is now known as OpenClaw. Despite the name changes, the underlying architecture and security concerns remain largely the same.
What OpenClaw is and why people are using it
OpenClaw is an open-source AI assistant that runs on your own hardware and can take actions on your behalf. This includes sending emails, managing calendars, interacting with Slack, Teams and WhatsApp, executing shell commands, and automating workflows across local and cloud systems.
That capability has driven explosive adoption. The project has become one of the fastest-growing repositories on GitHub, with well over 100,000 devs experimenting with it. The appeal is obvious. It moves AI from chat to action.
That same power is also what makes it dangerous.
What the security issues are
Security researchers from multiple organisations have raised serious concerns about how OpenClaw is designed and how it is typically deployed.
High-privilege access
OpenClaw often runs with broad system permissions by default. It can read and write files, execute commands, access environment variables, and interact with external services. Without strict sandboxing, this creates a large attack surface.
Plaintext credential storage
API keys, OAuth tokens, and other sensitive credentials are stored in cleartext on disk. Malware authors are already adapting their tooling to search for and steal these files.
Remote code execution risk
A critical vulnerability has been disclosed that allows remote code execution if OpenClaw processes malicious content. In practice, this means a user could be compromised simply by interacting with attacker-controlled data.
Prompt injection and unsafe actions
Because the agent interprets natural language and takes real actions, prompt injection attacks are especially effective. Researchers demonstrated that an attacker could trick the agent into forwarding private emails to an external address within minutes using simple instructions.
Misleading “local-first” assumptions
While OpenClaw is often marketed as local-first, data frequently still flows to cloud APIs unless fully local models are used. Frontier models may offer better prompt injection resistance, but they also introduce external dependencies and data exposure.
Shadow IT and exposed deployments
Security teams estimate that a significant portion of usage is happening without IT approval. Many of these users are developers and sysadmins who already have high levels of access. Internet scans have also found exposed OpenClaw interfaces that could allow unauthorised interaction.
How widespread the risk is
OpenClaw is not a niche tool. Adoption is large and growing quickly, with hundreds of thousands of private deployments likely in use. That scale means even a small percentage of misconfigured or vulnerable setups represents a meaningful attack surface.
Because the tool runs locally and is often installed by individuals, organisations may have little visibility into where it is running or what credentials it holds.
Why this matters
Autonomous AI agents represent a shift from AI that advises to AI that acts. When something with that level of autonomy also holds credentials and system access, the impact of compromise increases significantly.
This moves the risk beyond data leakage into full system compromise, credential theft, lateral movement, and long-term persistence. It also creates a new category of shadow IT that many organisations are not yet prepared to detect or govern.
What you should do
If you are experimenting with OpenClaw:
- Treat it as privileged infrastructure, not a personal productivity tool
- Avoid granting access to sensitive systems or credentials
- Isolate and sandbox deployments wherever possible
- Patch immediately and track security advisories closely
- Rotate credentials if there is any chance they were exposed
For organisations, this is a good moment to decide whether autonomous agents belong in your environment at all, and if they do, what guardrails are mandatory.
Have you used (or tested) OpenClaw as of yet?