OpenClaw Security Issues: What You Need to Know in 2026

OpenClaw proved something important

OpenClaw reached 145,000+ GitHub stars in 10 weeks. It is the fastest-growing open-source project in recent memory. And the growth was earned. The idea of an autonomous AI agent that actually does things – executes code, manages files, runs scripts, monitors your inbox – resonated with hundreds of thousands of developers.

The vision is right. An AI that talks is useful. An AI that acts is transformative.

But the security model has critical flaws that five major organizations have now documented. This is not speculation. These are findings from Snyk, Kaspersky, Cisco, Wiz, and Bitsight, published in peer-reviewed research and official security advisories. If you use OpenClaw or are considering it, you need to understand what they found.

The ClawHub supply chain problem

ClawHub is OpenClaw’s community marketplace for skills – pre-built packages that extend what the agent can do. As of February 2026, it hosts 5,705 community-built skills. Anyone with a GitHub account older than one week can publish.

Snyk’s ToxicSkills research found that 341 of those skills are malicious. Of those, 335 use fake prerequisites to install macOS stealer malware, specifically Atomic Stealer (AMOS), which harvests browser passwords, crypto wallets, and session cookies.

Worse: Snyk analyzed a broader sample and found that 36% of ClawHub skills contain prompt injection – hidden instructions that hijack the agent’s behavior. A skill that claims to format your emails could silently instruct the agent to exfiltrate your files.

This is not a hypothetical. It is a measured, published finding.

Raw system access with a thin guardrail

OpenClaw runs as a long-lived process on your machine with access to your filesystem, shell, and network. The security model relies on an allowlist – a list of approved commands the agent can run. Everything else is theoretically blocked by parsing shell AST patterns.

In practice, this is a weak boundary. The allowlist approach means security depends on predicting every dangerous command pattern in advance. Researchers have demonstrated bypasses. The Kaspersky blog documented specific scenarios where the agent’s broad permissions allow lateral movement across your system.

The core issue: OpenClaw’s security model is opt-out (block known-bad patterns) rather than opt-in (allow only explicitly approved actions in isolated environments). Opt-out security has a long history of failure in software engineering.

Credential exposure in plaintext

OpenClaw stores API keys in ~/.clawdbot in plaintext. Your OpenAI key, Anthropic key, Google key, and any service tokens the agent needs – all sitting in a readable file on your filesystem.

It gets worse. When users rotate keys, the old values are sometimes preserved in .bak files in the same directory. A malicious skill – or any process with file read access – can harvest both current and historical credentials in a single read operation.

This is not an edge case. It is the default behavior.

One-click remote code execution

Security researchers documented a one-click RCE vulnerability in OpenClaw’s skill installation flow. A crafted skill package can execute arbitrary code on the host machine during installation – before the user has a chance to review what it does.

Combined with the ClawHub supply chain problem, this creates a direct attack path: publish a malicious skill, wait for installations, execute code on every machine that installs it.

Cisco’s data exfiltration demonstration

Cisco’s AI security team published a detailed demonstration showing how a third-party skill can silently extract sensitive data from the host system. The skill appears benign – performing its advertised function – while simultaneously reading files and sending contents to an external server.

Because OpenClaw skills run with the same permissions as the agent (which has broad system access), there is no isolation boundary between what a skill is supposed to do and what it actually does.

What the security community is saying

The response from the security community has been direct:

• XDA-Developers published an article titled “Please stop using OpenClaw”
• Computerworld described the platform as “a security nightmare”
• Gary Marcus called it “a disaster waiting to happen”
• Kaspersky published a detailed blog post cataloging specific vulnerabilities and recommending users isolate OpenClaw on dedicated hardware

These are not fringe voices. They represent the mainstream consensus of the security research community.

What you can do

If you are currently using OpenClaw, you have three options:

Option 1: Harden your existing setup. Move OpenClaw to an isolated virtual machine. Avoid all ClawHub skills. Store API keys in a proper secrets manager instead of ~/.clawdbot. Use the community openclaw-secure-stack for skills scanning and prompt injection protection. This reduces risk but does not eliminate the fundamental architectural issue.

Option 2: Try NanoClaw. This 700-line TypeScript fork runs inside Apple containers, providing meaningful isolation on macOS. It is minimal, supports fewer integrations, and is early-stage – but it addresses the raw system access problem.

Option 3: Switch to a sandboxed alternative. Cloud-based platforms like LikeClaw run all agent code inside isolated E2B containers. Skills are vetted before publishing. Credentials are encrypted. There is no host machine to compromise. The tradeoff is that your agent runs in the cloud rather than locally.

The right choice depends on your priorities. If local-first privacy is non-negotiable, harden your setup or try NanoClaw. If security and zero-setup matter more, sandboxed cloud agents eliminate the entire category of risk.

The deeper lesson

OpenClaw’s security problems are not bugs to be patched. They are consequences of an architectural decision: give the agent full system access and figure out security later.

That approach does not scale. As AI agents become more capable and more autonomous, the blast radius of a security failure grows. The industry is moving toward sandboxed execution for the same reason we moved from running code as root to running it in containers. Isolation is not a limitation. It is a feature.

The demand OpenClaw proved is real. Autonomous AI agents that execute code, manage files, and automate workflows – that is the future. The question is whether that future runs on your bare machine or inside a sandbox designed for it.