Is OpenClaw Safe? Complete Security Guide (2026)

OpenClaw has 187K GitHub stars and millions of users. It also has critical vulnerabilities, malicious plugins, and 135K exposed instances. Here is what you need to know before installing it.

OpenClaw has significant security risks that you need to understand before installing it. In January 2026, researchers disclosed CVE-2026-25253, a critical remote code execution vulnerability that let attackers take full control of exposed OpenClaw instances through WebSocket hijacking. Security firms found over 135,000 OpenClaw installations exposed to the public internet across 82 countries. And 341 malicious skills were discovered on ClawHub, OpenClaw's community marketplace, including one that deployed the Atomic Stealer malware on macOS systems.

That does not mean you cannot use OpenClaw safely. But it does mean you need to understand the risks, apply the right configuration, and take ongoing responsibility for your own security. This guide covers every known vulnerability, who is sounding the alarm, and exactly how to lock down your installation.

The Security Track Record

OpenClaw's security history is concerning. Here is a timeline of the major incidents:

OpenClaw is not inherently malicious. It is a powerful open-source tool with a massive community. But its self-hosted architecture means every user is their own security team, and most users are not security professionals.

How OpenClaw Security Works

Before diving into the vulnerabilities, it helps to understand OpenClaw's security model.

OpenClaw is local-first. It runs on your machine (or your server), processes everything locally, and stores data on your filesystem. The only external connections it makes are API calls to your configured AI providers (OpenAI, Anthropic, Google, etc.).

In theory, this is good for privacy. Your conversations, files, and data stay on your hardware. No third party sees your messages or tasks.

In practice, this means:

• Your machine is the attack surface. If OpenClaw is compromised, the attacker has access to everything OpenClaw can access -- files, API keys, messaging accounts, and connected services.
• Your API keys are stored locally. By default, they sit in a configuration file with 600 permissions (owner-only read/write). But if someone gains access to your system, those keys are exposed.
• Your messaging accounts are connected. A compromised OpenClaw instance means an attacker can read and send messages on your behalf across every connected platform.
• You are responsible for updates. OpenClaw does not auto-update. If you do not manually update, you run vulnerable versions indefinitely.

Known Vulnerabilities

CVE-2026-25253: Remote Code Execution via WebSocket Hijacking

This is the most serious OpenClaw vulnerability to date. The OpenClaw gateway (the component that connects messaging platforms to the AI engine) uses WebSocket connections for real-time communication. Researchers found that the authentication check on WebSocket upgrade requests could be bypassed with a crafted handshake.

In plain language: if your OpenClaw gateway was accessible from the internet, an attacker could connect to it, skip the login, and run any command on your machine. One click. Full access. No password needed.

The vulnerability was patched in version 2026.1.29, released within 48 hours of disclosure. But here is the problem: thousands of users are still running older versions.

ClawHub Malware: 341 Malicious Skills

ClawHub is OpenClaw's community marketplace where users publish and install "skills" -- plugins that extend OpenClaw's capabilities. In December 2025, security researchers from CrowdStrike identified 341 malicious skills disguised as legitimate utilities (Source: CrowdStrike Threat Intelligence, December 2025).

The most notable was the "ClawHavoc" campaign. It worked like this:

1. Attackers published skills with appealing names like "Smart Email Pro," "Calendar Sync Plus," and "Weather Premium"
2. The skills worked as advertised -- they actually provided the promised functionality
3. Hidden in the code was a payload that downloaded and executed the Atomic Stealer malware on macOS systems
4. Atomic Stealer exfiltrated browser passwords, cryptocurrency wallet keys, SSH keys, and saved credentials

The skills looked legitimate. They had positive reviews (likely from fake accounts). They passed basic code review. The malicious payload was obfuscated and only triggered after a 72-hour delay, making it harder to connect the infection to the skill installation.

135,000+ Exposed Instances

In January 2026, researchers at Cisco Talos performed a global scan and found over 135,000 OpenClaw instances with their gateway ports exposed to the public internet (Source: Cisco Talos Intelligence, January 2026). These were spread across 82 countries, with the highest concentrations in the United States, Germany, China, South Korea, and Brazil.

Many of these instances were running with:

• Default credentials -- the gateway password was never changed from the installation default
• No firewall rules -- the gateway port (default 3456) was open to all IP addresses
• Outdated versions -- many were running versions from 2025 with known, unpatched vulnerabilities
• Connected messaging accounts -- WhatsApp, Telegram, Discord, and email accounts were actively linked

An exposed OpenClaw instance with default credentials is essentially an open door to everything it is connected to: your messages, your email, your API keys, and your filesystem.

Cleartext Credential Storage

By default, OpenClaw stores API keys and messaging platform tokens in its configuration file at ~/.openclaw/config.yaml. The file has 600 permissions (only the owner can read/write), which is the correct Unix practice.

However, the credentials are stored in cleartext. There is no encryption at rest. If an attacker gains read access to your filesystem (through a separate vulnerability, social engineering, or physical access), every API key and token is immediately visible.

OpenClaw added optional encrypted credential storage in v2025.11, but it is not enabled by default. Most users never turn it on.

Who's Sounding the Alarm

The warnings about OpenClaw's security are not coming from random bloggers. Major cybersecurity firms and AI researchers have flagged concerns:

• Cisco Talos published the research identifying 135,000+ exposed instances and described OpenClaw as "one of the most widely deployed insecure AI agents in consumer use" (Source: Cisco Talos Blog)
• CrowdStrike tracked the ClawHavoc campaign and warned that "the ClawHub skill ecosystem has become a significant malware distribution vector" (Source: CrowdStrike Threat Report)
• Kaspersky added OpenClaw-related indicators of compromise to their threat intelligence feed (Source: Kaspersky Threat Intelligence)
• Trend Micro flagged OpenClaw instances as a common entry point in enterprise network compromises (Source: Trend Micro Research)
• CyberArk warned about the credential storage practices and published a proof-of-concept for API key extraction (Source: CyberArk Labs)
• Snyk identified multiple dependency vulnerabilities in OpenClaw's npm packages (Source: Snyk Vulnerability Database)
• Gary Marcus called OpenClaw's security model "recklessly optimistic about user competence" in his newsletter (Source: Gary Marcus, "The Road to AI We Can Trust")

When Cisco, CrowdStrike, Kaspersky, Trend Micro, CyberArk, and Snyk all flag the same product, that is a signal worth paying attention to.

Enterprise Bans

Several organizations have explicitly banned OpenClaw from corporate environments:

The South Korean tech industry was particularly aggressive. Naver, Kakao, and Karrot all issued bans within the same two-week period in October 2025, after internal audits found employees had connected corporate messaging accounts to personal OpenClaw instances (via Korean tech press reports, October 2025).

Google Cloud's VP of Infrastructure Security issued an internal warning that OpenClaw creates an "unacceptable attack surface" when connected to corporate messaging platforms, particularly Slack and email (via Google internal memo, reported by The Register).

How to Secure Your OpenClaw Installation

If you still want to use OpenClaw (and many people do -- it is genuinely useful), here is how to minimize your risk. Follow every step.

openclaw security audit --fix

This scans your installation for known misconfigurations and fixes what it can automatically. It checks file permissions, gateway exposure, credential storage, and installed skill integrity. Always run this after installation and after every update.

# In ~/.openclaw/config.yaml
gateway:
  host: "127.0.0.1"    # NEVER use "0.0.0.0"
  port: 3456
  ssl: true

This ensures the OpenClaw gateway only accepts connections from your own machine. It cannot be reached from the internet, your local network, or any other device. If you need remote access, use a VPN or SSH tunnel -- never expose the gateway port directly.

docker run -d \
  --name openclaw \
  --network host \
  --read-only \
  -v openclaw-data:/data \
  -v openclaw-config:/config:ro \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  openclaw/openclaw:latest

Docker containerization means that even if OpenClaw is compromised, the attacker is trapped inside the container. They cannot access your host filesystem, other applications, or network services beyond what you explicitly allow.

• Run openclaw skill audit <skill-name> to scan for known malicious patterns
• Check the author's profile: look for verified accounts with multiple skills and a long history
• Read the source code on GitHub (all ClawHub skills are open source)
• Only install skills with 100+ downloads and 3+ months of active maintenance
• Use VirusTotal integration: openclaw skill scan --virustotal <skill-name>
• Check the skill's network permissions -- does a weather skill really need access to your filesystem?

# In ~/.openclaw/config.yaml
gateway:
  auth:
    method: "token"
    token: "your-long-random-token-here"  # Use: openssl rand -hex 32
    rate_limit: 10   # requests per second
    lockout_after: 5  # failed attempts

Never use the default credentials. Never use a simple password. Generate a random token with openssl rand -hex 32 and store it in your password manager.

• OpenAI: Set monthly spending limits and usage alerts in the API dashboard
• Anthropic: Configure spend limits and enable email notifications
• Google: Set budget alerts in Google Cloud Console
• Create dedicated API keys for OpenClaw -- never reuse keys from other projects
• Rotate keys quarterly, or immediately if you suspect compromise

If a compromised OpenClaw instance is using your API keys, you will see unexpected usage spikes. Alerts let you catch this quickly and revoke the keys before costs escalate.

openclaw config set credentials.encryption enabled
openclaw config set credentials.encryption_key "$(openssl rand -hex 32)"

This encrypts your API keys and messaging tokens at rest. Even if an attacker reads your config file, the credentials are encrypted.

openclaw update check
openclaw update apply

Security patches are released frequently. The CVE-2026-25253 fix was shipped within 48 hours of disclosure, but users who did not update remained vulnerable for weeks.

Should You Use OpenClaw?

It depends on your risk tolerance and technical ability. Here is a framework:

OpenClaw is a powerful tool. But power without security is a liability. Be honest about your technical ability before committing.

Safer Alternatives

NanoClaw

NanoClaw is a fork of OpenClaw designed specifically for security. It runs every skill in an isolated container, restricts filesystem access by default, encrypts all credentials at rest, and enforces loopback-only gateway binding out of the box. It sacrifices some of OpenClaw's flexibility for a significantly smaller attack surface.

The trade-off: fewer ClawHub skills are compatible, and advanced integrations may require more configuration. But for most personal automation use cases, NanoClaw provides 90% of OpenClaw's functionality with a fraction of the risk.

Managed OpenClaw Hosting

Several providers now offer managed OpenClaw hosting with security hardening included. These services handle updates, firewall configuration, credential encryption, and monitoring for you. Typical pricing runs $15-30/month.

You lose the "self-hosted" benefit (your data lives on their servers), but you gain professional security management. For users who are not comfortable managing their own server security, this is the pragmatic choice.

Claude Code (For Coding Tasks)

If your primary need is software development and coding automation, Claude Code is a fundamentally safer option. It runs in a sandboxed environment with granular permission controls, never stores your credentials, and is managed by Anthropic's security team. It does not do messaging or personal automation, but for coding work, it is the more secure choice.

FAQ

Is OpenClaw safe to use?

OpenClaw has significant security risks including a critical RCE vulnerability (CVE-2026-25253), 135,000+ exposed instances, and malicious ClawHub skills. It can be made safer with proper configuration (firewall, Docker, credential encryption), but it requires technical security knowledge to run safely.

What is CVE-2026-25253 in OpenClaw?

CVE-2026-25253 is a critical remote code execution vulnerability (CVSS 8.8) that allows attackers to execute arbitrary code on your machine via WebSocket hijacking when the OpenClaw gateway is exposed to the internet. It was patched in version 2026.1.29. Update immediately if you have not already.

Has OpenClaw been hacked?

Yes. The ClawHavoc campaign used 341 malicious ClawHub skills to deploy the Atomic Stealer malware on macOS systems, stealing browser passwords, cryptocurrency wallets, and SSH keys. Additionally, 135,000+ instances were found exposed with default credentials across 82 countries.

How do I secure my OpenClaw installation?

Run openclaw security audit --fix, bind the gateway to 127.0.0.1 only, use Docker containerization, vet all ClawHub skills before installing, use strong gateway authentication, enable encrypted credential storage, monitor API key usage, and keep the software updated.

What are safer alternatives to OpenClaw?

NanoClaw offers container-isolated execution with strict sandboxing. Managed OpenClaw hosting providers handle security hardening for you. For coding tasks specifically, Claude Code provides sandboxed execution with granular permissions out of the box.

Related Guides

• What Is OpenClaw? Complete Guide
• How to Install OpenClaw Safely
• OpenClaw Skills & ClawHub Guide -- includes security vetting guidance
• OpenClaw for Business -- enterprise risks and compliance gaps
• Best OpenClaw Alternatives in 2026
• OpenClaw vs Claude Code: Which Should You Use?
• OpenClaw System Prompt Guide -- configure agent personality and behavior
• OpenClaw Memory Guide -- how memory files work and security implications
• Connect OpenClaw to WhatsApp & Telegram -- messaging channel setup