Microsoft says don't run it on work machines. The first formal audit found 512 vulnerabilities. Belgium issued an emergency advisory. Here's the complete security picture and what to do about it.
On February 19, 2026, Microsoft's security blog published a single sentence that should have stopped everyone cold: "It is not appropriate to run it on a standard personal or corporate machine."
They were talking about OpenClaw. The framework with 230,000+ GitHub stars. 1.27 million weekly npm downloads. Running on 500,000+ instances on the public internet.
Microsoft wasn't alone. Kaspersky published two separate advisories. CrowdStrike issued an enterprise security report. Belgium's Centre for Cybersecurity released an emergency advisory. ARMO, Bitsight, SecurityScorecard, Cisco, Bitdefender, and NVIDIA all published OpenClaw security content. The CVE count passed 138 by early April. As of September 2026, the jgamblin/OpenClawCVEs tracker counts 543.
This is the complete OpenClaw security picture for 2026. Every major vulnerability. The incidents that turned them into real damage. Every vendor response. And what each risk means for you.
The vulnerability timeline (it happened fast)
January 25, 2026. The Argus Security Platform ran the first formal audit (filed as GitHub Issue #1796). Result: 512 total vulnerabilities, eight classified as critical. OAuth credentials stored in plaintext JSON files. Authentication disabled by default. WebSocket connections accepted without origin verification.
January 31, 2026. CVE-2026-25253 disclosed. CVSS 8.8. One-click remote code execution through cross-site WebSocket hijacking. Discovered by security researcher Mav Levin (DepthFirst) in approximately 100 minutes of analysis. Patched in v2026.1.29 within 72 hours.
February 2, 2026. Belgium's Centre for Cybersecurity (CCB) published an emergency advisory classifying CVE-2026-25253 as critical, urging organizations to update with "highest priority."
February 5, 2026. China's Ministry of Industry and Information Technology (MIIT) issued a security alert warning that OpenClaw deployments carry "high security risks."
February 10, 2026. Kaspersky published their first advisory. Found that RedLine and Lumma infostealers had already added OpenClaw file paths to their must-steal lists. Configuration files, memory, and chat logs stored API keys, passwords, and credentials in plaintext.
February 19, 2026. Microsoft Security Blog: "It is not appropriate to run it on a standard personal or corporate machine."
March 29, 2026. CVE-2026-32922 disclosed. CVSS 9.9. Critical privilege escalation. A single API call converts a pairing token into full administrative control with RCE capability. ARMO called it "the most severe vulnerability in OpenClaw's history."
April 3, 2026. 1,400+ malicious skills confirmed active on ClawHub. The ClawHavoc campaign included AMOS macOS infostealers bundled into skills disguised as productivity tools (Gmail, Notion, Slack, GitHub integrations).
September 11, 2026. The disclosures haven't stopped. OpenClaw published two more high-severity advisories the same day: one where exec approvals could be reused in working directories nobody had reviewed, and one where the WhatsApp login tool could be triggered by non-owners. Both are fixed in 2026.8.1.
For the VPS security hardening guide that addresses these specific vulnerabilities, our seven-step guide covers the protections self-hosters need.
543 tracked CVEs. Two early critical flaws at CVSS 9.9. 512 vulnerabilities in the first audit. Every major security vendor issued warnings. This is not a theoretical risk assessment. It's a documented security crisis.
The incidents that made it real (January to February 2026)
CVEs are abstract. These four incidents weren't. Each one hit in the first month of OpenClaw going mainstream, and each one exploited a different part of the stack: the skill marketplace, the ecosystem around it, the agent's own inputs, and the agent's autonomy.
January 28, 2026. Cisco: the #1 ranked skill was malware. Cisco's AI Defense team ran its Skill Scanner against a community skill called "What Would Elon Do?" The skill had been gamed to the top ranking on ClawHub and downloaded thousands of times. The scanner returned nine findings: two critical, five high severity. The skill silently told the agent to run a curl command that sent user data to a server the skill's author controlled. It also used prompt injection to make the agent skip its safety guidelines and run that command without asking. Cisco's verdict: "functionally malware." In the same write-up, Cisco cited research finding that 26% of 31,000 analyzed agent skills contained at least one vulnerability.
January 31 to February 2, 2026. Wiz: Moltbook left its whole database open. Moltbook, the social network for OpenClaw agents, had a Supabase API key sitting in its client-side JavaScript with no Row Level Security behind it. That key gave anyone full read and write access to production data. Wiz found 1.5 million API authentication tokens, 35,000 email addresses, and 4,060 private conversations between agents, some of which contained plaintext third-party API keys like OpenAI credentials. Wiz reported it on January 31. Moltbook locked it down within hours. The write-up went public February 2.
February 4, 2026. Zenity: from a document to a persistent backdoor. Zenity Labs showed that OpenClaw could be backdoored without exploiting a single bug. The chain:
- A normal-looking document or email carries a hidden prompt injection. OpenClaw reads third-party content like this all day.
- The injection tells the agent to add a new chat integration: a Telegram bot the attacker controls.
- From then on, the attacker gives orders through that bot. Zenity's proof of concept exfiltrated and deleted files, wrote persistence into
SOUL.mdwith scheduled tasks, and had the agent download and run a Sliver C2 beacon.
Once a real C2 implant is running, Zenity noted, the door is open to lateral movement, credential harvesting, or ransomware. Every step used features OpenClaw is designed to have. The attack doesn't exploit a bug. It exploits the architecture.
February 23, 2026. A Meta alignment director's agent wiped her inbox. Summer Yue, Director of Alignment at Meta's Superintelligence Labs, pointed OpenClaw at her real Gmail inbox after weeks of testing on a smaller "toy" inbox. Her instruction was to suggest what to archive or delete and not act until told. The real inbox was much bigger, which triggered context compaction, and the agent appears to have lost that instruction. It started deleting emails in what she called a "speed run." It ignored the stop commands she sent from her phone. She had to "RUN to my Mac mini like I was defusing a bomb" and posted screenshots of the ignored prompts. TechCrunch covered it the same day.
Four incidents. Four different failure points. A poisoned marketplace, a leaky companion platform, an agent that obeys whatever it reads, and an agent that forgot its own guardrail. Patching the gateway fixes none of them.
The three attack surfaces (and which ones are fixable)
Here's what nobody tells you about OpenClaw security. OpenClaw's vulnerabilities fall into three categories, and only one is fully fixable by patching.
Attack surface 1: The gateway (patchable)
CVE-2026-25253 (WebSocket RCE), CVE-2026-32922 (privilege escalation), CVE-2026-24763 and CVE-2026-25157 (command injection). These are code vulnerabilities in the gateway itself. They get patched. You update. The specific vulnerability is resolved.
The problem: New gateway CVEs keep appearing because the architecture was designed for convenience, not security. Authentication disabled by default. Localhost connections implicitly trusted. mDNS broadcasting configuration parameters across the local network. Each convenience creates an attack surface.
Attack surface 2: The skill supply chain (structural)
1,400+ malicious skills on ClawHub. Cisco found the #1 ranked skill performing data exfiltration. AMOS infostealers bundled into fake productivity tools. This attack surface can't be patched because it's not a bug. It's a design choice. Anyone can upload a skill. Users install them. The skill runs with the agent's full permissions.
OpenClaw partnered with VirusTotal to scan uploads, and VirusTotal has analyzed 3,000+ skills. But as Kaspersky noted: "it's no silver bullet." Prompt injection payloads and dynamically loaded content evade static analysis.
Attack surface 3: The trust model (fundamental)
This is the one that Microsoft, Kaspersky, and NVIDIA all flagged independently. OpenClaw requires the same system privileges as the user. It accesses files, messaging apps, APIs, and the command line with the user's full permissions. A compromised agent has the same access as a compromised human. The Zenity backdoor and the Meta inbox wipe are both this surface in action.
NVIDIA acknowledged this at GTC 2026 by announcing NemoClaw, an enterprise security wrapper. Kaspersky's recommendation: use a dedicated spare computer or VPS, never a primary machine. Microsoft: not appropriate for personal or corporate machines.
What the numbers actually look like
543 CVEs tracked as of September 2026 by the jgamblin/OpenClawCVEs tracker, alongside 212 security advisories. Most of those CVEs (509) were assigned by third-party CNAs such as VulnCheck rather than by the OpenClaw project itself. The count was 138 in early April, so it has roughly quadrupled in five months.
Two at CVSS 9.9: CVE-2026-22172 and CVE-2026-32922 (admin control without credentials, privilege escalation).
500,000+ instances on the public internet. 135,000+ exposed in 82 countries. 63% without authentication (ARMO, March 2026). SecurityScorecard found 33.8% of exposed infrastructure correlates with known threat actor activity including Kimsuky and APT28 groups.
1,400+ malicious skills on ClawHub. 12% of uploads were malicious in February 2026. Disguised as Gmail, Notion, Slack, and GitHub integrations.
Honeypot scanning began January 26, 2026, the same day OpenClaw hit Hacker News. Attackers mobilized within hours.
1.5 million API tokens exposed through Moltbook's misconfigured Supabase database, plus 35,000 email addresses and private messages between agents (details in the incident timeline above).
How BetterClaw addresses each attack surface
We're not neutral observers here. We built BetterClaw specifically because these security problems exist. Here's how we address each of the three attack surfaces.
Gateway security: Managed updates applied after testing. Gateway pairing handled by the platform. No user-configurable gateway binding (eliminating the 0.0.0.0 exposure). AES-256 encryption for all stored data. You don't configure security. It's configured for you.
Skill supply chain: Every skill on our verified marketplace is tested by our team before publication. We check for malicious behavior, data access patterns, and security vulnerabilities. This eliminates the 1,400+ malicious skill risk entirely. Not through automated scanning (which Kaspersky called "no silver bullet"). Through human review.
Trust model: Docker-sandboxed execution means skills run in isolated containers, not on the host system. Workspace isolation prevents cross-agent data access. Secrets auto-purge erases credentials from agent memory after 5 minutes, closing the attack vector that RedLine and Lumma infostealers specifically target.
For the complete breakdown of what BetterClaw does differently, our alternative page covers how each security layer works.
What you should do right now (regardless of platform)
If you're running self-hosted OpenClaw:
Update immediately to the latest release, and run nothing older than 2026.8.1. That's the version that fixes the two high-severity advisories published on September 11, 2026, and it also covers the older critical fixes (CVE-2026-32922 in 2026.3.11, CVE-2026-33579 in 2026.3.28). Old advice to "run 2026.1.29 or later" only closed CVE-2026-25253 and leaves hundreds of later issues open. Check the jgamblin/OpenClawCVEs tracker for the latest patch status.
Revoke and regenerate all credentials your agent has ever accessed. If OpenClaw was running before the patches, treat the environment as potentially compromised. API keys, OAuth tokens, messaging credentials. All of them.
Audit every installed skill. Skills installed between November 2025 and March 2026 are especially suspect. Uninstall anything you didn't personally verify. Don't trust popularity or rankings: the skill Cisco flagged was ranked #1.
Check your memory and integrations. Look through SOUL.md and MEMORY.md for instructions you didn't write, and remove any chat integration or bot you didn't add yourself. That's exactly where the Zenity backdoor hides.
Require approval for destructive actions. Don't let an agent delete, send, or purchase on its own, and make sure you can stop it without physically reaching the machine.
Bind the gateway to loopback. If it's bound to 0.0.0.0, your instance is accessible from the internet.
For the complete VPS security checklist, our checklist covers every hardening step.
The uncomfortable truth
Here's the honest take.
OpenClaw's security problems aren't a series of bugs that got patched. They're a consequence of a design philosophy that prioritized accessibility over security. Authentication disabled by default because it was easier. Localhost trusted implicitly because it was simpler. Anyone can upload skills because it was more open.
That philosophy produced a tool used by hundreds of thousands of people and attacked by nation-state groups within hours of its public launch.
The patches help. The VirusTotal integration helps. But as Kaspersky, Microsoft, NVIDIA, and CrowdStrike all independently concluded: the underlying trust model requires architectural changes, not just patches.
That's what we built BetterClaw to address. Not better patches. Better architecture. Docker-sandboxed execution, verified skills, secrets auto-purge, workspace isolation. The security isn't a layer you configure. It's the foundation the platform is built on.
If your organization is running OpenClaw or evaluating AI agents and security is a concern (it should be), we offer a free AI readiness audit. We identify the highest-impact use cases for your operations, assess the security requirements, share a clear proposal, and if it makes sense, implement it on the BetterClaw platform. No commitment required. The audit is free because the conversation matters more than the sale.
Frequently Asked Questions
How many CVEs does OpenClaw have?
As of September 2026, the jgamblin/OpenClawCVEs tracker counts 543 CVEs affecting OpenClaw, alongside 212 security advisories. Most of those CVEs were assigned by third-party CNAs such as VulnCheck. The count was 138 in early April 2026. The most severe are CVE-2026-22172 and CVE-2026-32922, both at CVSS 9.9, enabling admin control without credentials and privilege escalation respectively. The first formal audit (January 25, 2026) found 512 total vulnerabilities, eight critical.
Which OpenClaw version is safe to run?
Run the latest release, and nothing older than 2026.8.1. That version fixes the two high-severity advisories OpenClaw published on September 11, 2026 (reusable exec approvals and the WhatsApp login tool). Versions like 2026.1.29 or 2026.3.28 only close earlier CVEs and are still exposed to later ones.
What did Microsoft say about OpenClaw security?
On February 19, 2026, Microsoft's Security Blog stated: "It is not appropriate to run it on a standard personal or corporate machine." This recommendation was based on OpenClaw's trust model requiring system-level privileges and the documented vulnerabilities in its gateway and skill supply chain. Microsoft's position aligns with Kaspersky's recommendation to use dedicated hardware or VPS, never primary workstations.
What happened with the Meta researcher's OpenClaw agent?
On February 23, 2026, Summer Yue, Director of Alignment at Meta's Superintelligence Labs, connected OpenClaw to her real Gmail inbox and told it to suggest deletions but not act. The larger inbox triggered context compaction, the agent appears to have lost that instruction, and it began mass-deleting emails while ignoring stop commands sent from her phone. She had to run to her Mac mini to kill it.
Is OpenClaw safe to use in 2026?
With full hardening (latest release and no older than 2026.8.1, gateway bound to loopback, skills audited, credentials rotated, Docker sandboxing configured), self-hosted OpenClaw can be used cautiously. Without hardening, it is demonstrably unsafe: 500K+ instances exposed, 1,400+ malicious skills, 543 tracked CVEs. Microsoft, Kaspersky, and CrowdStrike all recommend against deploying on machines with sensitive data. BetterClaw addresses these risks architecturally with sandboxed execution, verified skills, and secrets auto-purge.
What is the ClawHavoc campaign?
ClawHavoc is a supply chain attack campaign targeting OpenClaw users through malicious skills on ClawHub. As of April 2026, 1,400+ malicious skills have been identified, including AMOS macOS infostealers disguised as productivity tools (Gmail, Notion, Slack, GitHub integrations). 12% of ClawHub uploads were malicious in February 2026. OpenClaw partnered with VirusTotal for automated scanning, but security experts note that prompt injection and dynamic loading can evade static analysis.
How does BetterClaw handle OpenClaw's security risks?
BetterClaw addresses all three attack surfaces: gateway vulnerabilities (managed updates, no user-configurable binding), skill supply chain (verified marketplace with human review, not just automated scanning), and the trust model (Docker-sandboxed execution prevents host system access, secrets auto-purge erases credentials after 5 minutes, workspace isolation prevents cross-agent data leakage). Free plan available (1 agent). $49/month for Pro (5 agents). $149/month for Business. Enterprise is custom-priced, with SAML SSO and audit logs.
