OpenClaw's Proactive AI Promise Collides with Widespread Security Flaws

Vulnerable Access Points Draw Immediate Alarm (Image Credits: Images.fastcompany.com)

Cybersecurity researchers recently uncovered roughly 1,000 unprotected gateways to OpenClaw, an innovative open-source AI agent accessible via messaging apps like WhatsApp and Telegram.

Vulnerable Access Points Draw Immediate Alarm

Security teams identified these gateways exposed on the public internet, granting unauthorized entry to users’ sensitive data. Anyone could potentially view personal information through these lapses. A white-hat hacker even manipulated OpenClaw’s skills system, which supports plugins for tasks such as web automation and system management. That exploit propelled the skill to the top of global rankings, leading to widespread downloads. Although the demonstration remained harmless, it highlighted a flaw ripe for malicious exploitation.The incident underscored prompt vulnerabilities in agentic AI.

Compromise of these gateways equates to full read-and-write control over affected computers and linked accounts, including emails and phone numbers. Reports of actual exploitation incidents have surfaced already. Users hosting OpenClaw on misconfigured virtual private servers amplified the risks further. Such setups often overlooked basic protections, leaving digital lives exposed.

From Clawdbot to OpenClaw: A Rapid Evolution

Peter Steinberger, a London-based developer renowned for PDF tools, launched the agent as Clawdbot in November 2025. It later rebranded to Moltbot and then OpenClaw following a request from Anthropic. This timeline aligned with surging interest in AI file interactions sparked by tools like Anthropic’s Claude Code. That terminal-based agent handled large projects via conversational prompts, thrilling developers while alienating others due to its command-line demands.

OpenClaw built on these foundations by adding user-friendly layers and proactive capabilities. Unlike reactive systems, it initiates tasks independently, eliminating constant user input. This feature fueled excitement across tech communities on platforms like X and Reddit. Demand even boosted sales of Mac Minis, a favored hosting option for the agent. Steinberger provided detailed security guides online, though adoption varied among users.

Expert Voices Highlight the Perils

The agent’s appeal stems from its ease – no coding expertise required for setup or oversight. Yet this simplicity breeds danger, as users grant broad access to their devices. Jake Moore, a cybersecurity specialist at Eset, captured the tension: “I love it, yet [I’m] instantly filled with fear.” He noted that enthusiasm often overrides caution, especially with unrestricted permissions.

Moore elaborated on the stakes: “Opening private messages and emails to any new technology comes with a risk and when we don’t fully understand those risks, we could be walking into a new era of putting efficiency before security and privacy.” Alan Woodward, a cybersecurity professor at the University of Surrey, echoed these concerns. “Developments like Clawdbot are so seductive but a gift to the bad guys,” he stated. Prompt injection attacks pose another threat, where malicious instructions hide in websites or emails for the AI to execute unchecked.

Balancing Innovation and Safeguards

OpenClaw’s design as an always-on assistant risks user complacency. Without constant monitoring, vulnerabilities like those demonstrated by researcherscould lead to data breaches or worse. Key risks include:

• Unprotected gateways enabling remote control of files and accounts.
• Skills system exploits allowing malicious plugins to spread globally.
• Misconfigured servers exposing instances to the open web.
• Prompt injections turning everyday content into attack vectors.
• Overly permissive access granting AI unchecked digital authority.

Experts stress user responsibility in securing deployments. Woodward warned, “With great power comes great responsibility and machines are not responsible. Ultimately the user is.” As agentic AI proliferates, stronger default protections and awareness campaigns may prove essential.

OpenClaw exemplifies AI’s dual nature – empowering yet precarious – urging developers and users alike to prioritize defenses from the outset. What steps would you take to secure such an agent? Share your thoughts in the comments.