Is OpenClaw safe? Security risks and a hardening checklist (2026)
Is OpenClaw safe? What its defaults protect and what they don't, its CVE record, exposed instances and malicious skills, plus a hardening checklist.
OpenClaw can be run reasonably safely, but only with care: its defaults keep strangers from reaching it, yet the commands it runs for you execute on your own machine, with no sandbox and no approval prompts, until you turn those on. Its record calls for caution too: 722 published security advisories since January 2026, hundreds of malicious add-ons found on its skill registry, and tens of thousands of instances found reachable from the internet. Keep it private, patched and boxed in, and don’t hand it accounts or data you couldn’t afford to have misused.
We haven’t run OpenClaw ourselves. This analysis rests on OpenClaw’s security documentation, its GitHub advisories, the US National Vulnerability Database (NVD) and published security research, all read on October 20, 2026 (see how we work).
The verdict in five points
- Tools run on the host unless you sandbox them. The README says so: “Tools run on the host for the main session unless you configure sandboxing.” Host commands also run without approval prompts by default (exec approvals).
- One trust boundary per gateway. Anyone who can message a tool-enabled agent can use its tools (trust model).
- A long vulnerability record. 722 published advisories, 14 of them critical, and hundreds of CVE records on NVD.
- Malicious skills. Researchers found hundreds on ClawHub in early 2026, and a few got past its scanners as late as May.
- Exposed instances. Scans counted from about 21,600 to about 245,000 reachable instances between January and May 2026.
In its favor: a normal install listens only on the local machine and needs a token, strangers must pair before the bot reads their messages, advisories are published openly, and openclaw security audit checks your setup. None of its CVEs are in CISA’s Known Exploited Vulnerabilities catalog (CISA).
OpenClaw’s threat model, in plain words
The security docs start from “one trust boundary per gateway”: a single operator, or a team whose members trust each other. OpenClaw is “not a hostile multi-tenant boundary”; people who don’t trust each other need separate gateways, “ideally separate OS users or hosts” (security).
The trust model adds that anyone who can message a tool-enabled agent shares its tool authority, and that most failures are “someone messaged the bot and the bot did what they asked”. The stance is to “assume the model can be manipulated” and limit the damage. Running host commands “without approval prompts in the trusted single-operator default” is by design, not a bug. A formal threat model rates three of 22 threats critical: direct prompt injection, malicious skill installation and credential harvesting.
In plain words: OpenClaw assumes you alone are in charge and that the model can be talked into things. The questions that matter are who can talk to your agent, and what its tools can reach.
What the defaults protect, and what they don’t
The docs say “OpenClaw ships with conservative defaults”. That holds for who can reach the agent, much less for what it can do once reached.
| Setting | Default in the current docs | What it means |
|---|---|---|
| Gateway bind | Loopback, 127.0.0.1:18789 |
Only the machine itself can connect |
| Bind in container images | An “exposed bind” | Docker installs bind beyond loopback unless you change it |
| Gateway auth | Required; onboarding generates a token, even for loopback | No token, no connection |
| Unknown DM senders | Get a pairing code that expires in 1 hour | You approve each new sender |
| Group chats | Allowlisted, usually behind a mention | The bot ignores groups you haven’t added |
| Sandbox | Off | Tools run directly on the host |
| Exec approvals | security: full, ask: off on gateway hosts |
Commands run without asking you |
| Elevated mode | Needs tools.elevated.enabled and an allowlisted sender |
Runs commands outside the sandbox |
| Tool profile | full after local onboarding |
Every built-in tool is available |
| Sending across chats | Allowed | An agent can message other conversations |
Sources: security, network exposure, access control, sandbox modes, tool policy, tool permissions.
Three points deserve attention:
- Token strength. Bitsight reported in February that even a one-character credential was accepted (Bitsight). Today’s docs say startup rejects blank values and published example placeholders, but state no minimum length, so use a long random token.
- Containers. Check the bind on any Docker image or one-click VPS template. OpenClaw’s DigitalOcean guide warns against third-party Marketplace images “unless you have reviewed their startup scripts and firewall defaults” (DigitalOcean guide).
- Damage limits start off. Sandbox and approvals are what contain a tricked agent. A paired Mac node lets the Gateway run commands on that Mac, which the docs call “remote code execution on that Mac”.
One open question: SecurityScorecard’s STRIKE team said in February that OpenClaw bound to 0.0.0.0:18789 (all network interfaces) out of the box (The Register). We couldn’t find docs from early 2026 to confirm what the default was then.
Gateway tokens and pairing
Devices pair too. Every connection to the Gateway carries a device identity; loopback connections can be approved automatically, but tailnet and LAN connections need explicit approval (architecture). So a dashboard opened from another machine must be approved first, and it still needs the token.
If you have no token, openclaw doctor --generate-gateway-token creates one, and openclaw gateway auth-token --show displays it. openclaw dashboard opens the dashboard with a single-use pairing link, never the token itself (Control UI, dashboard). Guard the token like a password.
The vulnerability record
By the numbers, as of October 20, 2026
- 722 published GitHub security advisories: 14 critical, 249 high, 390 medium and 69 low, published from January 31 to September 11, 2026 (GitHub).
- OpenClaw’s own tally matches. Its security page (reviewed September 9) counts 1,799 reports filed, 58% closed without an advisory, and 14 confirmed critical out of 137 filed as critical. A third of the 722 fixes were in add-ons, not the core.
- CVE counts conflict. OpenClaw says 39 advisories carry a CVE ID, yet NVD returns 575 CVE records matched to OpenClaw, 531 of them assigned by VulnCheck (NVD). Scores vary by who rates them: CVE-2026-44112 is 9.6 from VulnCheck and 6.3 from NVD.
- An outside audit. Trail of Bits filed 27 private advisories through OpenAI’s “Patch the Planet”; none of those rated were critical, and fixes shipped in 2026.8.1 (OpenClaw blog).
Most advisories came in February and March, after OpenClaw went viral; none in July or August, then 75 in September.
Notable vulnerabilities
The best known is CVE-2026-25253 (CVSS 8.8). The web dashboard took a gatewayUrl from the link it was opened with and connected automatically, sending the stored gateway token along. With it, an attacker could change sandbox and tool settings and run commands. A loopback-only Gateway didn’t help, because the victim’s own browser made the connection (GitHub advisory). It was fixed in 2026.1.29, released January 30 (The Hacker News), and depthfirst, which found it, advised users to “rotate tokens if you suspect yours may have leaked” (depthfirst). The sources disagree on affected versions: depthfirst says up to v2026.1.24-1, GitHub up to 2026.1.28.
In April, Cyera disclosed “Claw Chain” to the maintainers: four flaws, including reads and writes that escaped the OpenShell sandbox, all fixed in 2026.4.22 (CSA). Several flaws rated 9.9 let callers with limited rights gain more, such as approving device pairings or minting broader tokens.
The score below is the assigning organization’s, with NVD’s where it differs; “Fixed in” is the first version listed as not affected.
Selected CVEs and advisories, with fixed versions
Fourteen of the most serious or most cited flaws. Filter by what they let an attacker do.
| ID | CVSS 3.1 | What it allowed | Fixed in | Published |
|---|---|---|---|---|
| CVE-2026-25253 | 8.8 | One-click theft of the gateway token through a crafted link, then commands on the host | 2026.1.29 | Feb 1 |
| CVE-2026-24763 | 8.8 | Command injection in Docker sandbox execution through PATH | 2026.1.29 | Feb 2 |
| CVE-2026-25157 | 7.7 (NVD 7.5) | OS command injection in the SSH node command | 2026.1.29 | Feb 4 |
| CVE-2026-25593 | 8.4 | An unauthenticated local client could rewrite config and inject commands | 2026.1.20 | Feb 6 |
| GHSA-gv46-4xfq-jv58 | 9.9 | Remote code execution by bypassing approval on node invoke | 2026.2.14 | Feb 14 |
| CVE-2026-28363 | 9.9 (NVD 8.8) | Exec allowlist bypass with abbreviated sort options | 2026.2.23 | Feb 27 |
| CVE-2026-22172 | 9.9 | Token or password connections could claim higher scopes | 2026.3.12 | Mar 20 |
| CVE-2026-32048 | 7.5 (NVD 9.9) | A sandboxed session could spawn work under an unsandboxed agent | 2026.3.1 | Mar 21 |
| CVE-2026-32922 | 9.9 | Pairing-level callers could mint tokens with broader scopes | 2026.3.11 | Mar 29 |
| CVE-2026-33579 | 9.9 | Privilege escalation through /pair approve | 2026.3.28 | Mar 31 |
| CVE-2026-41329 | 9.9 | Sandbox bypass through heartbeat context | 2026.3.31 | Apr 21 |
| CVE-2026-44112 | 9.6 (NVD 6.3) | Sandbox writes could escape the mount (Claw Chain) | 2026.4.22 | May 6 |
| CVE-2026-44115 | 8.8 | Shell expansion in heredocs slipped past the exec allowlist (Claw Chain) | 2026.4.22 | May 6 |
| CVE-2026-44118 | 7.8 | Local MCP clients could pose as the owner (Claw Chain) | 2026.4.22 | May 6 |
Showing all 14.
Dates are NVD publication dates in 2026 (GitHub for the GHSA). Sources: NVD and GitHub advisories, read October 20, 2026.
Update often, but on purpose
Every flaw above has a fix; what matters is running a version that has it. OpenClaw shipped five stable releases between October 10 and 18, ending with v2026.10.5, and an extended-stable channel suits people who want fewer updates (release channels). openclaw update’s rollback doesn’t reverse database migrations, so back up first (updating). China’s CNCERT advises turning off automatic updates, so update deliberately rather than blindly.
Exposed instances
Several firms scanned the internet for OpenClaw in early 2026. Their counts differ because they measured different things at different times:
| Who | When | Count | Method |
|---|---|---|---|
| Censys | As of Jan 31 | 21,639 | Dashboard page titles |
| Bitsight | Jan 27 to Feb 8 | Over 30,000, cumulative | Daily probe of port 18789 |
| SecurityScorecard STRIKE | Feb 9 | 40,214 on 28,663 IPs | Not described |
| STRIKE, later that day (The Register) | Feb 9 | Over 135,000 | Not described |
| Shodan plus ZoomEye (CSA) | “As of May 2026” | About 65,000 + 180,000 | Not described |
Reachable isn’t the same as open: Censys found most exposed instances “still require a token value”, and the CSA notes that scans don’t show whether authentication is on. STRIKE’s first report called 63% of observed deployments vulnerable; SecurityScorecard’s own post two days later said 35.4% (SecurityScorecard). The largest figure adds two search engines’ counts, which may overlap. A Gateway on loopback, reached through Tailscale or an SSH tunnel, can’t be counted this way.
Prompt injection and model choice
Anything the agent reads can carry instructions: web pages, search results, emails, documents, attachments. The docs treat hook payloads as untrusted “even when they come from your own systems”, and an attack doesn’t need public DMs (prompt injection). ThaiCERT warned that data such as API keys can leak through link previews in Telegram or Discord without a click (ThaiCERT).
OpenClaw marks outside content as untrusted, but the docs say that “doesn’t replace” allowlists, approvals or sandboxing, and advise to “keep hard enforcement - tool policy, exec approvals, sandboxing, and channel allowlists”.
The model matters too: “Use the latest-generation, best-tier model for any bot that can run tools or touch files/networks.” The docs cite “a 2026 crowdsourced test of 272K attacks” where attacks succeeded 0.5% of the time against Claude Opus 4.5, 1.0% against Sonnet 4.5, 1.3% against Haiku 4.5 and 8.5% against Gemini 2.5 Pro, and add that adaptive human attackers still beat state-of-the-art defenses over 80% of the time. That’s the docs’ citation; we couldn’t trace the study, and those models are a generation or more old. See the best model for OpenClaw, and local models for why small ones need tighter limits.
Skills and plugins: the supply-chain risk
Skills are instructions the agent follows, and they can tell it to download and run things. Koi Security found 341 malicious skills among 2,857 it audited on ClawHub, most using a fake “Prerequisites” step to install the Atomic Stealer macOS malware (The Hacker News). ClawHub has scanned uploads since February 7, yet Unit 42 found five malicious skills that got through between February and May (Unit 42). Plugins are code running inside the Gateway, and the docs say to “treat them as trusted code” and pin exact versions (tool permissions). See OpenClaw skills and ClawHub for how to vet one.
Who warns against it
- Gartner (reported February 12) advised blocking OpenClaw and allowing it only “in isolation, in non-production virtual machines with throwaway credentials” (CSO Online).
- China. CNCERT issued an alert on March 10 (CGTN), Fast Company reported directives against installing it at state agencies and state-owned firms (Fast Company), and March 22 guidelines said to run it only on isolated devices, VMs or containers, without admin rights (China Daily).
- Hong Kong told bureaus on March 16 not to install it on computers linked to the government network (AFP via Macau Business).
- Singapore’s IMDA (reported May 14) advised against primary workstations or devices with highly sensitive information (People Matters).
- Employers. Southern Methodist University said on March 4 that OpenClaw “is not approved for use on university-owned or managed devices at this time” (SMU), and a secondary report on February 20 said a Meta manager called it “strictly prohibited” on work devices (Trending Topics).
- OpenAI’s Kevin Lin, who announced OpenClaw Enterprise, said in September that “the default stance of IT in most organizations is to ban agentic platforms like OpenClaw altogether” (The Register).
The advice is consistent: isolate it, don’t give it admin rights or sensitive data, and vet what you add.
Security events in 2026, in order
The timeline collects the events above, each linked to its source.
OpenClaw security events, January to October 2026
Dates are the source's publication date. Counts are the source's own and were measured in different ways.
- Malicious skillsCisco calls a top-ranked skill "functionally malware"
Its scanner found the skill "What Would Elon Do?" sending data to the author's server and telling the agent to skip safety guidelines. Cisco said it had been inflated to rank first in the registry.
Source - VulnerabilitiesOne-click token theft published (CVE-2026-25253)
A crafted link could steal the gateway token, even from a loopback-only Gateway. Rated CVSS 8.8; fixed in 2026.1.29, released January 30.
Source - Exposed instancesCensys counts 21,639 exposed instances
Up from about 1,000 in under a week, found by dashboard page titles. Most still required a token.
Source - Malicious skillsClawHavoc: 341 malicious skills
Koi Security audited 2,857 ClawHub skills and found 341 malicious, 335 of them from one campaign pushing the Atomic Stealer macOS malware.
Source - Warnings and bansChina's vulnerability database flags OpenClaw
MIIT's NVDB warned of "elevated risks under default or improper configurations" and advised closing public access.
Source - Fixes and defensesClawHub starts VirusTotal scanning
Every skill is hashed and checked; malicious ones are blocked from download and active skills are re-scanned daily. The post calls it "not a silver bullet".
Source - Exposed instancesSTRIKE reports 40,214 exposed instances
SecurityScorecard's team said 63% of observed deployments were vulnerable. A later count that day passed 135,000.
Source - Warnings and bansGartner advises blocking OpenClaw
Allow it only in isolated, non-production VMs with throwaway credentials, and rotate any corporate credentials it touched.
Source - VulnerabilitiesCritical approval bypass fixed
GHSA-gv46-4xfq-jv58, rated CVSS 9.9: remote code execution through a node invoke approval bypass. Fixed in 2026.2.14.
Source - Warnings and bansChina's CNCERT issues an alert
It named prompt injection, malicious skills and unsafe defaults, and advised keeping the management port off the internet and isolating OpenClaw in containers.
Source - Vulnerabilities"Claw Chain" fixed in 2026.4.22
Four flaws found by Cyera, including sandbox read and write escapes. The highest was rated 9.6 by VulnCheck.
Source - Exposed instancesCSA cites about 245,000 instances on Shodan and ZoomEye
About 65,000 and 180,000 respectively, "as of May 2026", with no method given. Scans don't show whether auth is on.
Source - Fixes and defensesNVIDIA SkillSpector joins ClawHub scanning
Across 67,453 skills, the pipeline returned 206 Malicious and 25,504 Suspicious verdicts.
Source - Malicious skillsUnit 42: five malicious skills got through
Found unblocked between February and May, since removed. One padded its README with 22 MB to get past scanner size limits.
Source - Fixes and defensesTrail of Bits audit recap
27 private advisories, none critical among those rated; fixes shipped in 2026.8.1 and the 2026.7.33 long-term release.
Source - Fixes and defensesTencent AIG added to ClawScan
Every uploaded skill and plugin now also goes through Tencent's AIG scanner alongside SkillSpector and an AI judge.
Source
How to harden OpenClaw
The docs’ hardened baseline and exposure runbook give the steps. The simplest protection is distance: run it on a machine that holds nothing else of value, such as a small VPS (see where to run OpenClaw). Then:
- Update, then audit. Run
openclaw update, thenopenclaw security audit --deepafter every config change.--fixtightens file permissions and allowlists open group policies, but won’t rotate secrets, change bind or auth, or remove plugins (security CLI). - Keep the Gateway private. Leave the bind on
loopbackwith a long random token. For remote access the docs prefer Tailscale Serve; an SSH tunnel also works:ssh -N -L 18789:127.0.0.1:18789 user@gateway-host. On a VPS, add a firewall; the docs’ Ansible setup allows only SSH and Tailscale ports. - Control who can talk to it. Keep
dmPolicyonpairingor an allowlist, neveropen. If several people message it, setsession.dmScopetoper-channel-peer. - Box the tools. Set the sandbox to
non-mainorall, settools.exec.asktoon-missoralwayswith an allowlist, and keep elevated mode off. For agents that read untrusted content, denygateway,cron,sessions_spawnandsessions_send. - Use a strong model for any agent with tools.
- Vet add-ons. Read skills first; keep
plugins.allowexplicit and pin versions. - Give it its own identity: a separate phone number, OS user, accounts and API keys, with a spending cap at your model provider.
- Protect the disk. Use full-disk encryption,
700on~/.openclaw, and keep provider keys out of the workspace.env(secrets). OpenClaw 2.0’s patch notes say “Secret Store values are not encrypted at rest” (The Register). - If something leaks, close public routes, rotate the token and integration credentials, set
dmPolicytodisabled, review logs and re-run the deep audit.
Harden your OpenClaw setup
Sixteen steps from OpenClaw's security docs, as of October 2026. Critical items count three times as much as good-to-haves. Your ticks are saved in this browser only.
Items are weighted: critical ones count three times as much as nice-to-haves.
FAQ
Is OpenClaw safe to use?
It can be, for one person on a machine set aside for it, kept updated, with the sandbox and command approvals on and only vetted skills. As shipped, it limits who can reach it but not what its tools can do.
Is OpenClaw malware?
No. It’s open-source software from the OpenClaw Foundation, published on GitHub under the MIT license. Some third-party skills on its ClawHub registry were malware, so the risk lies in what you add.
Can OpenClaw be hacked?
Yes, like any software that runs commands. It has hundreds of published vulnerabilities, including one-click token theft (CVE-2026-25253), and prompt injection can steer the model through content it reads. As of October 2026, none of its CVEs are in CISA’s catalog of known exploited vulnerabilities.
Should I run OpenClaw on my main computer?
The guidance we found says no. Gartner, China’s March guidelines and Singapore’s IMDA all advise isolation: a separate machine, VM or container, without admin rights or sensitive data. See VPS and app hosting for small servers.
What does openclaw security audit do?
It checks your setup against the secure defaults: who can trigger the bot, what its tools can reach, exec settings, network and browser exposure, file permissions and plugins. --deep adds live Gateway checks and --fix applies safe repairs (running the audit).