Executive Summary
OpenClaw (formerly Clawdbot, then Moltbot) has become the most popular open-source AI assistant platform, amassing over 200,000 GitHub stars in a matter of weeks. But its meteoric rise has been accompanied by a catastrophic security situation.
The Threat Landscape
The "Lethal Trifecta" (Simon Willison)
OpenClaw combines three dangerous properties that make it vulnerable by design:
Reads emails, files, credentials, browser history, chat messages
Browses web, processes arbitrary messages, installs third-party skills
Sends emails, makes API calls, can exfiltrate data
Palo Alto Networks adds a fourth: persistent memory. OpenClaw stores context in SOUL.md and MEMORY.md files, enabling time-shifted attacks where payloads are injected one day and detonated later.
Why Attackers Target OpenClaw
- Over 100,000 developers trusted it with credentials within weeks of launch
- Credentials stored in plaintext Markdown and JSON files (
~/.openclaw/) - Open ClawHub marketplace has minimal vetting (only requires 1-week-old GitHub account)
- Rapid rebrands created identity confusion exploited by scammers
- The
~/.clawdbotdirectory is predicted to become a standard infostealer target
Critical Vulnerabilities (CVEs)
CVE-2026-25253: One-Click RCE
Remote Code Execution via Control UI
The Kill Chain (discovered by DepthFirst):
- 1 Victim visits malicious URL
- 2 Control UI accepts
gatewayUrlquery parameter without validation - 3 Token exfiltrated to attacker in milliseconds
- 4 Cross-site WebSocket hijacking (server doesn't validate origin)
- 5 Attacker disables sandbox via API (
exec.approvals.set = off) - 6 Escapes Docker container (
tools.exec.host = gateway) - 7 Full RCE on host machine
Complete system compromise from a single link click.
Upgrade to v2026.1.24-1 or later. Rotate all tokens.
CVE-2026-24763 & CVE-2026-25157
HIGHCommand injection vulnerabilities allow attackers to execute arbitrary commands through improperly sanitized input fields in the gateway.
CVE-2026-22708
HIGHIndirect prompt injection — OpenClaw doesn't sanitize web content before feeding it to the LLM. The web becomes a command-and-control channel.
The 40,000 Exposed Instances Problem
SecurityScorecard's findings paint a grim picture:
| Metric | Value |
|---|---|
| Exposed instances | 40,214+ |
| Unique IP addresses | 28,663 |
| Instances with prior breach activity | 549 |
| Instances with known vulnerabilities | 1,493 |
| Vulnerable deployments | 63% |
| Exploitable via RCE | 12,812 |
China (most), followed by US, Singapore
Information services, technology, manufacturing, telecommunications
Common Misconfigurations
0.0.0.0:18789 instead of localhostgateway.auth.password setSupply Chain Attacks: ClawHub Malware
The ClawHavoc Campaign
Koi Security audited 2,857 skills on ClawHub and found 341 malicious ones (12% of registry).
- • Professional documentation
- • Legitimate-sounding names
- • Fake "Prerequisites" section
- • Social engineering attacks
- • Atomic Stealer (AMOS)
- macOS infostealer (335 skills)
- • Reverse shell backdoors
- Hidden in functional code (6 skills)
- • Exchange API keys
- • Wallet private keys
- • SSH credentials
- • Browser passwords
- • SOUL.md / MEMORY.md
All malicious skills shared single C2 IP: 91.92.242[.]30
Credential Exposure in Skills
A separate analysis of 3,984 skills found that 283 skills (7.1%) contain critical security flaws that expose sensitive credentials in plaintext through the LLM's context window and output logs.
The Moltbook Breach
Moltbook, the AI-agent social network, ran on Supabase with Row Level Security (RLS) disabled. The Supabase API key was visible in client-side JavaScript.
Exposed Data
Hosting Provider Security Failures
Common Failures in Managed Hosting
| Issue | Impact | Prevalence |
|---|---|---|
| Gateway bound to 0.0.0.0 | Internet-accessible control | Most services |
| No pairing mode | Unauthorized connections accepted | Most services |
| Root filesystem access | Agent can read /etc/passwd, SSH keys | Most services |
| No Tailscale/VPN | Direct internet exposure | Most services |
| Default credentials | Easy takeover | Common |
Security Researcher Commentary
"Security checklist: gateway not public, pairing required, filesystem scoped (no /), and access via Tailscale/SSH tunnel. If a provider can't show you 'nmap clean' + no root mounts in 5 min, don't hand them your API keys."
"The amount of 'services' spinning up OpenClaw by just blindly binding to 0.0.0.0:18789 and leaving the Control UI wide open is terrifying. We're seeing literal 1-click RCEs right now because of this lazy infrastructure."
The Security Checklist
Minimum Requirements (Non-Negotiable)
Additional Hardening
Questions to Ask Hosting Providers
Before signing up with any OpenClaw hosting service:
Timeline of Security Incidents
ProClaw Security Advantage
This research underscores why security-first managed hosting is critical. ProClaw addresses every issue identified:
| Issue | How ProClaw Solves It |
|---|---|
| Exposed gateway | Private networking via Cloudflare Tunnel by default |
| No pairing | Pairing mode enabled, explicit approval required |
| Root filesystem | Scoped to dedicated workspace directory |
| No authentication | Strong authentication configured |
| Malicious skills | Skills audited or disabled by default |
| Outdated versions | Automatic security updates |
| No monitoring | Alerts for unusual activity |
Our promise: If a provider can't demonstrate secure configuration in 5 minutes, they shouldn't be trusted with your AI agent.
Conclusion
OpenClaw's security situation is dire. The combination of:
- Viral adoption (200K+ GitHub stars)
- Minimal security defaults
- Open marketplace with no vetting
- Multiple critical CVEs
- 40,000+ exposed instances
...creates a perfect storm for attackers.
If you're running OpenClaw:
- 1 Update immediately to patch known CVEs
- 2 Audit your configuration against the checklist above
- 3 Rotate all tokens if you suspect exposure
- 4 Consider managed hosting with security-first providers
References
Security Research
Supply Chain Research
Last updated: February 15, 2026
Ready for Security-First Hosting?
ProClaw handles security hardening so you can focus on building. Every item on the checklist? Already done.
Get Started