Is OpenClaw Safe? An Honest Security Assessment for 2026

OpenClaw went from zero to 180,000+ GitHub stars in weeks. CrowdStrike, Cisco, Kaspersky, and Trend Micro have all published advisories about it. Researchers found nearly a thousand publicly exposed instances running without authentication. And you’re here asking: is OpenClaw safe?

The honest answer: it depends entirely on you.

OpenClaw is not a chatbot. It’s an autonomous AI agent with shell access, file system control, messaging integrations, and browser automation — running on your machine, with your credentials. That’s an extraordinary amount of power. Whether it’s safe comes down to how deliberately you configure it.

This isn’t FUD. This is a field guide.

What OpenClaw Actually Does (And Why That Matters for Security)

Before we talk about OpenClaw security risks, let’s be precise about what the software does — because most of the risk stems from its architecture, not from bugs.

OpenClaw is an open-source AI agent framework that:

Runs locally on your hardware (Mac, Linux, Raspberry Pi)
Connects to messaging platforms — Telegram, Discord, WhatsApp, Slack
Executes shell commands on the host operating system
Reads and writes files across your filesystem
Controls a web browser via automation
Manages its own memory and configuration in local Markdown files
Installs and runs community “skills” — plugin-like extensions from ClawHub

In short: you’re giving a frontier AI model the keys to your computer and wiring it into your communication channels. The model acts on your behalf, with your permissions, at machine speed.

That’s not inherently dangerous. But it’s inherently consequential. Every misconfiguration has real impact.

The Real OpenClaw Security Risks

Let’s break down what the security community has actually found — not hypotheticals, but documented issues.

1. Exposed Instances With No Authentication

In January 2026, researcher @fmdz387 used Shodan to discover nearly 1,000 publicly accessible OpenClaw installations running without authentication. Another researcher, Jamieson O’Reilly, demonstrated he could access Anthropic API keys, Telegram bot tokens, Slack accounts, full chat histories, and — critically — execute commands with administrator privileges on those machines.

The core issue: OpenClaw’s Gateway server, by default, binds to the local network. Users who expose it to the internet without enabling authentication are handing over root-level access to anyone who finds the port.

This is not an OpenClaw bug. It’s a configuration failure. But it’s one the defaults make too easy to stumble into.

2. Prompt Injection as a Breach Vector

This is the risk that keeps security teams up at night. CrowdStrike’s February 2026 advisory put it bluntly: when an AI agent has legitimate access to APIs, databases, and system tools, prompt injection becomes a full-scale breach enabler.

Here’s the scenario: OpenClaw reads an email, a webpage, or a message that contains adversarial instructions embedded in the text. The model follows those instructions — and because it has shell access, it can exfiltrate data, install software, or modify files.

OpenClaw’s own documentation acknowledges this: “When tools are enabled, the typical risk is exfiltrating context or triggering tool calls.” Their recommended mitigation is using a read-only “reader agent” to summarize untrusted content before passing it to the main agent. Smart architecture, but it requires deliberate setup.

3. Overprivileged Default Configuration

Trend Micro’s analysis hit the nail on the head: OpenClaw’s “unrestricted configurability” allows users to grant arbitrary permissions without enforced security checks. The flexibility that makes OpenClaw powerful is the same flexibility that makes it dangerous in careless hands.

By default, OpenClaw can:

Execute any shell command
Read and write anywhere the user has access
Send messages on your behalf
Browse the web with your cookies and sessions

Most users never tighten these defaults. That’s how you end up with an AI agent that has more access than any human employee would be granted on day one.

4. Community Skills Without Moderation

OpenClaw’s ClawHub hosts around 6,000 community-created skills. There’s minimal categorization, filtering, or security review. Installing a skill is essentially running someone else’s code on your machine, with your agent’s full permissions.

This is the npm/pip supply chain problem, amplified by the fact that the runtime has shell access and messaging capabilities.

5. The “Self-Hackable” Architecture

OpenClaw stores its configuration, memory, and skills in local Markdown files — and the agent can modify them. This is a feature: it allows the agent to self-improve and adapt. It’s also a risk: a compromised or manipulated agent can rewrite its own instructions, escalate its own permissions, or modify its behavior in ways you don’t expect.

How to Run OpenClaw Safely: Practical Mitigations

If you’ve read this far and you’re still planning to run OpenClaw — good. Here’s how to be smart about it.

Run the Security Audit (Regularly)

OpenClaw ships with a built-in security audit tool. Use it:

openclaw security audit openclaw security audit --deep

openclaw security audit --fix

The --fix flag applies safe guardrails automatically: tightening group policies, re-enabling log redaction, and locking down file permissions. Run this after every configuration change.

Lock Down Network Exposure

Never expose the Gateway port to the public internet without authentication
Bind to 127.0.0.1 (localhost only) unless you have a specific reason not to
If you need remote access, use Tailscale or a VPN — not port forwarding
If you’re behind a reverse proxy, configure gateway.trustedProxies correctly

Restrict Tool Access

Start with the minimum tools your use case requires
Use exec security modes: deny by default, allowlist for specific commands
Disable browser control if you don’t need it
Disable elevated permissions unless you have a clear, specific need

Harden Messaging Policies

Set groupPolicy to allowlist, not open
Restrict DM access to known user IDs
Use separate agents for untrusted channels (public Discord servers, open groups) versus private channels

Isolate Untrusted Content

Use a read-only reader agent to process emails, web pages, and messages from unknown sources
Never let the main agent directly parse untrusted content when it has tool access
This is your primary defense against prompt injection

Vet Skills Before Installing

Read the source code of any ClawHub skill before installing
Treat skills like third-party dependencies: audit them
Prefer skills with transparent source repos and active maintenance

Use a Dedicated Machine

Run OpenClaw on a dedicated device — not your daily driver
A Mac mini or Raspberry Pi that doesn’t have your banking credentials, SSH keys, or work documents
This limits the blast radius of any compromise

File Permissions Matter

Ensure ~/.openclaw is 700 (owner-only access)
Config files should be 600
Credential files (credentials/*.json) should never be group- or world-readable

Who Should Use OpenClaw

OpenClaw is a power tool. It’s for people who:

Understand Unix permissions, networking, and process isolation
Are comfortable reading security advisories and applying patches
Want to build custom AI workflows and accept the responsibility that comes with it
Have a dedicated machine or VM to run it on
Are willing to invest time in proper configuration

If that sounds like you, OpenClaw is genuinely remarkable. The productivity gains are real. The automation possibilities are vast. But the safety is your responsibility.

Who Should Not Use OpenClaw (Yet)

Be honest with yourself. OpenClaw is probably not for you if:

You wouldn’t know how to check if a port is exposed to the internet
You’d install community skills without reading the source
You’re planning to run it on your primary work laptop with access to production systems
You expect it to be secure out of the box with no configuration
You think “it’s open source, so it must be safe”

There’s no shame in waiting. The project is maturing rapidly, and the security tooling is improving with every release. Today’s risky default might be tomorrow’s hardened baseline.

The Bottom Line on OpenClaw Security

Is OpenClaw safe? It can be — but safety isn’t the default state. It’s the result of deliberate configuration, ongoing vigilance, and understanding what you’re actually running.

The security industry’s concern isn’t that OpenClaw is malware. It’s that OpenClaw is a preview of the agentic AI paradigm — where autonomous systems act with real permissions on real infrastructure — and most users aren’t ready for the responsibility that entails.

OpenClaw’s own documentation says it best: “There is no ‘perfectly secure’ setup.” The goal is to be deliberate about who can talk to your agent, where it can act, and what it can touch.

Start with the smallest access that works. Widen it as you gain confidence. Run the security audit. Read the advisories. And treat your AI agent like what it is: an incredibly capable system with the access level of a sysadmin and the judgment of a language model.

That combination demands respect.

—

Last updated: February 2026. OpenClaw security practices evolve rapidly — check the official security documentation for the latest guidance.