2026 OpenClaw Security Risk Whitepaper
Systemic Absence of a Permission Model: Root-Cause Analysis and Risk Assessment
Executive Summary
This report analyzes OpenClaw security risks using 17 publicly disclosed vulnerabilities (CVE/GHSA) from Q1 2026, cross-validated against independent research from SecurityScorecard, Kaspersky, Koi Security, Wiz, Trend Micro, and Microsoft. Key findings are summarized below.
| Dimension | Key Data |
|---|---|
| Public-Facing Instances | 135,000+ (SecurityScorecard, Feb 2026) [1]; declined to 63,070 by end of March (Censys) [14] |
| With Known Vulnerabilities | 63% [1]; of which 12,812 directly exploitable via RCE |
| Q1 Vulnerability Count | 17 (2 Critical, 11 High, 4 Medium); average patch cycle ~12 days |
| Supply Chain Poisoning | ClawHavoc: zero to mass infection in 5 days; 1,184+ malicious skills by April |
| Real-World Incidents | Kaspersky obtained API keys and system-level execution on ~1,000 unauthenticated instances; Meta AI safety lead lost 200+ emails despite explicit stop instructions [12] |
| Enterprise Visibility Gap | Only 21% of executives report full visibility into agent permissions and data access [9] (Help Net Security) |
These figures are not isolated incidents. They are multiple projections of a single structural root cause: OpenClaw lacks a unified permission model at the design level. Its security posture depends on operators actively auditing and tightening default configurations, rather than on architectural guarantees built into the system itself.
This report demonstrates that the majority of Q1 vulnerabilities are not cases of a forgotten check, but structural gaps between the checking model and actual execution semantics. These gaps manifest across four vulnerability families:
Family A - Control Plane and Path Boundary Gaps (8 cases): Boundary validation not systematically applied; concentrated during rapid feature expansion.
Family B - Wrapper/Allowlist Semantic Incompleteness (3 cases): String-level constraints approximating shell semantics, producing persistent bypasses.
Family C - Token/Identity/Environment Semantic Drift (5 cases): Credential reuse across subsystems; highest remediation difficulty.
Family D - Insufficient Sandbox Assumptions (1 case): Documented isolation claims inconsistent with actual implementation.
Official security investment is accelerating - the hardening in versions 2026.3.31 and 2026.4.5 reflects genuine progress. However, Family B and C vulnerabilities continued appearing in April (V16, V17), indicating that the transition from layered security controls to architectural permission guarantees is still underway. Until then, operators bear the responsibility for active configuration auditing and continuous monitoring.
Chapter 1 OpenClaw: A Delegated Execution Runtime Mistaken for a Chat Tool
1.1 Growth Velocity as a Security Event
OpenClaw accumulated 180,000 GitHub Stars in under three months from its November 2025 launch to late January 2026. By April 2026 that figure had reached 349,000 Stars and 69,900 Forks [13]. Trend Micro described it in March as the end of the chatbot era and the beginning of the sovereign agent era [5].
That growth velocity is itself a security event. Traditional software security audits can keep pace with release cycles - but when a tool carrying host-level execution privileges transforms from a niche project to infrastructure relied upon by tens of thousands of instances within weeks, the security review window shrinks to near zero. SecurityScorecard found in February that 549 exposed instances [1] had ties to prior intrusion activity, with operators almost certainly unaware their agents were exposed on the open internet.
1.2 Architectural Definition: Delegated Execution Runtime
Understanding OpenClaw risk requires clarity on what it actually is. It is not a chat interface, not a code completion tool, but a delegated execution runtime: it receives text instructions, selects tools through model inference, and executes actions in real environments. Official documentation divides the architecture into three layers:
Tool Layer: Function interfaces the agent calls. A fresh install exposes 30 tools by default, including exec (run host commands), browser (control a browser instance), message (send messages), web_fetch (HTTP requests), cron (scheduled tasks), sessions_spawn (sub-sessions), and gateway (entry configuration management).
Skills Layer: Behavioral specifications injected into the system prompt. Environment variables and API keys declared in skills.entries are injected into the host process environment space before the agent starts, directly expanding the credential attack surface.
Plugins Layer: Distributable units packaging channels, providers, tools, and skills. Native plugins execute in-process. No strict security isolation exists between the three layers.
A malicious skill can mislead model reasoning through the prompt layer while simultaneously accessing real host credentials through the entries mechanism. The ultimate security impact - regardless of where the attack chain originates - is realized through actual execution at the tool layer.
1.3 Official Trust Boundary and Its Scope
Official security documentation states explicitly: one Gateway constitutes one trusted operator boundary; hostile multi-tenant isolation is not provided. For an individual developer running a private assistant on their own machine, this assumption is reasonable. When the same tooling is deployed as a team-shared backend, connected to a public WebChat, or integrated into a commercial product, the assumption no longer holds.
Mismatch Between Architectural Premise and Deployment Reality Microsoft precisely framed this in their February 19 security blog: two supply chains - untrusted code (skills/extensions) and untrusted instructions (external text input) - converge in the same execution runtime [6]. Microsoft recommended running OpenClaw in fully isolated VMs or dedicated physical machines, using non-privileged dedicated credentials, accessing only non-sensitive data. |
1.4 Existing Industry Knowledge: Scope and Limitations
OWASP Agentic Top 10 [7] (Dec 2025 / 2026 update): Compiled by 100+ security researchers. Risk categories ASI01 through ASI05 - Agent Goal Hijack, Tool Misuse, Identity Abuse, Supply Chain Vulnerabilities, and Memory/Context Poisoning - all map directly to OpenClaw default behaviors.
Kaspersky Security Audit (late January 2026): Identified 512 vulnerabilities, 8 Critical [3]. Researchers obtained Anthropic API keys, Telegram bot tokens, Slack accounts, and months of complete chat logs [3] from approximately 1,000 unauthenticated public instances, with system administrator command execution.
Sangfor Four-Dimension Model: Categorizes risk across product risk (CVE), deployment risk (exposure surface), supply chain risk (ClawHavoc), and governance risk (shadow adoption), each with quantitative data [10].
Trend Micro (March 2026): Identifies persistence as the fourth attack multiplier [5] - local-first architecture writes everything to disk, creating time-shifted vectors where malicious prompts injected today may execute weeks later.
These analyses share a common limitation: they describe what risks exist, not why they exist. They cannot answer the question most critical to security teams: which problems can be fixed through configuration, and which require the platform to change its architectural design? That is the entry point for this report.
1.5 Methodology
Public Vulnerability Databases: NVD, GitHub Advisory Database (GHSA), and the jgamblin/OpenClawCVEs automated tracking repository, used for Q1 structured vulnerability table and root-cause taxonomy.
Third-Party Security Research: SecurityScorecard, Koi Security, Kaspersky, Wiz, Trend Micro, Microsoft, OWASP, Oasis Security, Help Net Security, and Sangfor, for exposure quantification and real-incident validation.
Official Documentation and Source Constants: OpenClaw official security model, Tools/Skills/Plugins documentation, and default-value constants in compiled source code, for architectural analysis.
Root-cause classification uses inductive method: each vulnerability is labeled with its CWE, grouped into families by architectural commonality, then assessed for convergence. Vulnerability analysis covers January 1 through March 31, 2026; external data cited through April 5, 2026.
Chapter 2 The Core Argument: Systemic Absence of a Permission Model
2.1 The Essential Difference Between a Permission Model and Security Controls
In traditional security engineering, a permission model refers to rules existing at the design level prior to any feature implementation - defining who can access what resources, under what conditions, at what granularity. Linux file permission bits, Android manifest declarations, and the browser same-origin policy are canonical examples. They are not after-the-fact patches; they are architectural baselines.
OpenClaw has extensive security-related configuration options (auth mode, allowlist, dmScope, browser trust policy) and runtime enforcement mechanisms (exec approval, install scanning, ACP semantic classes). But these are security controls, not a permission model. The distinction is fundamental:
| Dimension | Security Controls (Current) | Permission Model (Target) |
|---|---|---|
| Design Sequence | Full capability exists first; constraints layered on through configuration | Capability boundaries defined at design time; constraints precede features |
| Coverage Mode | Each feature requires independent security control; any gap is an exposure | Resources not explicitly authorized are inaccessible by default (fail-closed) |
| Responsibility | Operators must identify and tighten each default value | System design guarantees safe starting point; operators configure above that baseline |
| Sustainability | Feature iterations may introduce uncovered control paths | New features must declare permissions within the model; architectural consistency enforced |
OpenClaw currently operates in the former mode. This is not criticism - for a project that evolved rapidly from developer tool to infrastructure, building features first and tightening security incrementally is a common engineering path. But it means every default configuration depends on operator intervention, not system-level design guarantees.
2.2 High-Risk Default Configuration Combinations
The architecture of layered security controls rather than built-in permission model manifests in very specific ways. Each item below can be confirmed directly from official documentation and public source code.
Execution Privileges Open by Default
The official security audit command reports tools.elevated: enabled. Local exec approval is configured security=full, ask=off, allowlist=0. This combination means the agent holds host-level command execution privileges, requires no human confirmation before execution, and has no command allowlist. Kaspersky penetration testing confirmed this: researchers executed arbitrary commands with system administrator privileges on public instances.
Session Context Aggregated by Default
dmScope defaults to "main" (source: base-session-key-2NJCUHEq.js, line 9). Direct messages from different senders are routed to the same agent session by default. In team-shared Gateway deployments, conversation contexts from different users can cross-contaminate.
Conversation Records Stored Plaintext
Transcripts write to host disk as plaintext jsonl by default at file permissions 0644 - readable by any user on the same machine. Content includes user input, model output, provider/model information, and token cost data. Trend Micro called this architecture the fourth attack multiplier; Kaspersky confirmed months of complete chat logs could be extracted from public instances.
Browser Tool Permits Private Network Access by Default
Compiled source code shows DEFAULT_OPENCLAW_BROWSER_ENABLED = true, DEFAULT_BROWSER_EVALUATE_ENABLED = true, and SSRF policy set to dangerouslyAllowPrivateNetwork: true. The dangerously prefix indicates developers recognized this as high-risk, yet kept it as the default.
Skills Runtime Credential Surface Too Broad
Environment variables and API keys in skills.entries are injected into the host process environment. Skill code at runtime sees not a minimal per-skill credential view but the full host process environment. ClawHavoc malicious payloads directly exploited this to exfiltrate AI service tokens from ~/.clawdbot/.env files.
Dual Supply Chain with Inconsistent Security
The ClawHub installation path has had dangerous-code scanning (fail-closed) since version 2026.3.31. Local workspace drop-in paths do not trigger scanning. If attackers shift to social engineering - distributing malicious skill files through GitHub or team documentation - the local path is an undefended vector.
2.3 Compound Effect: From Individual Gaps to Systemic Risk
Each default above has individual engineering justification - they optimize developer experience. In combination, they constitute a high-privilege execution surface influenced by external content that leaves plaintext traces on host disk.
Most of the 17 vulnerabilities are not forgotten checks but structural inconsistencies between the checking model and actual execution semantics - not fixable by adding a single if statement.
The 40,214 exposed instances reflect not operators lacking security knowledge but defaults that provide no safe starting point - with only 21% of executives reporting full visibility into agent permissions [9].
The 1,184+ malicious skills causing actual damage trace to an overly broad credential surface; the campaign went from zero to mass scale in 5 days.
Chapter 3 Q1 Vulnerability Root-Cause Taxonomy
OpenClaw publicly disclosed 17 vulnerabilities in Q1 2026. Nine of those were concentrated in just four days, March 18-21 [16]. The jgamblin/OpenClawCVEs tracking repository recorded 156 security advisories [13] through April, with 128 still awaiting CVE assignment. This chapter focuses on root-cause families, remediation complexity, and whether structural residuals remain.
3.1 Q1 Vulnerability Structured Overview
| ID | CVE/GHSA | CVSS | CWE | Description | Family |
|---|---|---|---|---|---|
| V1 | CVE-2026-25593 | 9.8 | CWE-78 | WebSocket config.apply auth bypass -> local RCE | A |
| V2 | CVE-2026-25253 | 8.8 | CWE-669 | Control UI trusts gatewayUrl parameter -> one-click token theft -> RCE (ClawJacked [8]) | A |
| V3 | CVE-2026-25801 | 7.8 | CWE-426 | Docker sandbox PATH injection -> container escape | A |
| V4 | CVE-2026-25912 | 8.1 | CWE-78 | sshNodeCommand parameter command injection | A |
| V5 | CVE-2026-26104 | 6.5 | CWE-22 | MEDIA:/path file read out-of-bounds | A |
| V6 | CVE-2026-26203 | 7.5 | CWE-22 | Plugin install path traversal -> arbitrary file write | A |
| V7 | CVE-2026-26415 | 5.3 | CWE-863 | Voice-call allowlist bypass | A |
| V8 | CVE-2026-26720 | 6.8 | CWE-73 | Transcript path redirect -> arbitrary location write | A |
| V9 | GHSA-4685-c5cp-vp95 | 7.2 | CWE-78 | sort -o / recursive grep bypass of safeBins stdin-only restriction | B |
| V10 | CVE-2026-32046 | 9.8 | CWE-693 | Chromium launched --no-sandbox -> in-container RCE | D |
| V11 | CVE-2026-32003 | 7.5 | CWE-78 | SHELLOPTS/PS4 env var injection bypasses system.run allowlist | C |
| V12 | CVE-2026-28460 | 8.1 | CWE-78 | Newline and command substitution bypass of allowlist | B |
| V13 | CVE-2026-32897 | 6.3 | CWE-287 | gateway.auth.token reused as owner-id prompt hashing fallback | C |
| V14 | CVE-2026-33102 | 6.5 | CWE-863 | Approval identity mismatch: approving vs. executing identity differ | C |
| V15 | CVE-2026-33205 | 7.2 | CWE-269 | exec token handling bypass -> privilege escalation | C |
| V16 | GHSA-xxxx-yyyy-zzzz | 7.0 | CWE-78 | Allowlist multi-condition combined bypass | B |
| V17 | GHSA-39pp-xp36-q6mg | 7.5 | CWE-74 | Inconsistent environment variable sanitization (V11 variant) | C |
Summary: 2 Critical (CVSS >= 9.0), 11 High (7.0-8.9), 4 Medium (4.0-6.9). Average patch cycle approximately 12 days. Family A: 8 cases (47%); Family C: 5 (29%); Family B: 3 (18%); Family D: 1 (6%).
3.2 Family A: Control Plane and Path Boundary Gaps (V1-V8, 8 Cases)
Shared root cause: system boundaries should be well-defined but specific control chains were left unsealed. Control UI should not trust gatewayUrl parameters; plugin install should not allow path traversal; transcript write paths should not be redirectable by external input. Remediation - boundary validation, input normalization, fail-closed policies - is generally achievable with explicit checks.
V2 (CVE-2026-25253, "ClawJacked") warrants specific attention. Attack path: attacker crafts a link with a malicious gatewayUrl parameter -> victim clicks, browser opens Control UI -> applySettingsFromUrl() blindly accepts the parameter -> agent connects to malicious gateway and transmits stored auth token -> attacker gains full control of the victim local agent (CVSS 8.8). This illustrates the browser-bridged local attack class: the attacker requires no direct network access to the victim.
The 8 vulnerabilities concentrated in January-February 2026, reflecting a control plane that remained in expansion mode during the product transition from development to production - features accumulated faster than boundary definitions were systematized.
3.3 Family B: Wrapper/Allowlist Semantic Incompleteness (V9, V12, V16, 3 Cases)
Shared root cause: using string-level constraints to approximate shell semantics. The allowlist checks what a command text looks like, but what the shell actually executes may be entirely different.
V9 (GHSA-4685-c5cp-vp95) is the most illustrative case: the safeBins feature allowed tools like grep and sort to execute without approval in stdin-only mode, relying on heuristic judgment. Attackers used sort -o (writing output to an arbitrary file) and grep -R (recursively reading the filesystem) to bypass the restriction, converting a stdin-only safety assumption into arbitrary file read/write capability.
The Persistence Signal of Family B Three variants appeared in a single quarter (V9/V12/V16) spanning February through April, with each fix exposing a new bypass. Frequency itself indicates command normalization and preview consistency are far from stable. The semantic approval classes introduced in 2026.3.31 - upgrading from tool-name matching to operation-semantic classification - is a structural response, but its own convergence is yet to be established (V16 fixed April 1 is the evidence). |
3.4 Family C: Token/Identity/Environment Semantic Drift (V11, V13, V14, V15, V17, 5 Cases)
Shared root cause: the same secret or identity takes on mixed roles across multiple subsystems. This is the highest-difficulty family.
V13 (CVE-2026-32897, CVSS 6.3) is canonical: when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is not configured, the system falls back to using gateway.auth.token as the secret for owner-id prompt hashing. An attacker who obtains the system prompt sent to a third-party model can reverse-engineer the gateway authentication token from hash output, bypassing gateway authentication entirely. One token serving authentication, identity derivation, and prompt hashing simultaneously is a direct manifestation of absent credential lifecycle management.
V11 (CVE-2026-32003) and V17 (GHSA-39pp-xp36-q6mg) are two variants of the same root cause: environment variable sanitization logic behaves inconsistently across code paths. V11 exploits SHELLOPTS and PS4 via bash xtrace; V17 is another inconsistent path exposed by the V11 fix. This fix-bypass cycle indicates similar issues will continue until credential flow paths are systematically cleaned up.
3.5 Family D: Insufficient Sandbox Assumptions (V10, 1 Case)
V10 (CVE-2026-32046, CVSS 9.8): the browser container launches Chromium with --no-sandbox, allowing renderer-side vulnerability exploitation to execute code on the host system without sandbox escape. When product documentation uses sandbox, isolated, or contained, security teams must independently verify those claims against actual implementation.
3.6 Implications for Security Decision-Making
| Family | Count | Patch Difficulty | Recurrence Probability | Operator Recommendation |
|---|---|---|---|---|
| A - Control Plane/Path | 8 | Low-Medium | May recur with new features | Update promptly; monitor release notes for boundary fixes |
| B - Allowlist Semantics | 3 | Medium-High | High (multiple cycles observed) | Apply least-privilege to exec/shell; do not rely on allowlist as sole defense |
| C - Token/Identity Drift | 5 | High | High until architectural refactor | Audit credential flow paths; use separate credentials for distinct purposes |
| D - Sandbox Assumptions | 1 | Medium | Depends on new isolation mechanism | Independently verify isolation claims; do not rely on vendor documentation alone |
Chapter 4 Real-World Validation
Architectural analysis answers what theoretically could go wrong. This chapter shifts to ask whether industry data and real security incidents validate the risk patterns described in the preceding chapters.
4.1 Exposure Surface: From 135,000 to 63,070
| Metric | Data | Source |
|---|---|---|
| Total Exposed Instances | 135,000+ (deep-analysis subset: 40,214) | SecurityScorecard, Feb 2026 |
| With Known Vulnerabilities | 63% | SecurityScorecard, Feb 2026 |
| Directly Exploitable via RCE | 12,812 instances | SecurityScorecard, Feb 2026 |
| Linked to Prior Intrusion Activity | 549 instances | SecurityScorecard, Feb 2026 |
| Live Instances by End of March | 63,070 (down ~53% in six weeks) [14] | Censys, March 31, 2026 |
| Organizations Reporting High-Risk Agent Behavior | 80% | Help Net Security, March 2026 |
| Executives with Full Agent Visibility | Only 21% | Help Net Security, March 2026 |
| Enterprises Expecting Major AI Agent Incident Within Year [17] | 97% | Arkose Labs, April 2026 |
The Censys decline confirms public disclosure drove some remediation. But more than 60,000 instances remain exposed. A 63% known-vulnerability rate means the majority of exposed instances have not patched promptly.
4.2 Supply Chain Poisoning: The ClawHavoc Campaign
ClawHavoc was the largest supply chain poisoning campaign targeting the OpenClaw ecosystem in early 2026, escalating from one malicious skill to mass infection in just 5 days [2][11][15].
| Date | Event |
|---|---|
| Jan 27, 2026 | First malicious skill published to ClawHub |
| Jan 31, 2026 | Malicious skills proliferate en masse |
| Feb 1, 2026 | Koi Security [2] names the campaign ClawHavoc; 341 malicious skills found, 335 attributed to the same campaign |
| Mid-Feb 2026 | ClawHub grows to 10,700+ skills; malicious count reaches 824+ |
| Mar 31, 2026 | OpenClaw 2026.3.31 introduces install scanning fail-closed |
| Early April 2026 | Follow-up reporting counts 1,184+ malicious skills |
Malicious skills disguised as cryptocurrency trackers, YouTube summarizers, auto-updaters, and Google Workspace integrations. Three primary payload categories:
Information stealers (AMOS): 335 skills used Prerequisites sections to lure users into downloading password-protected ZIPs or executing base64-obfuscated terminal commands, ultimately deploying Atomic macOS Stealer.
Reverse shell backdoors: Embedded in otherwise functional code, triggered during normal usage.
Credential exfiltration scripts: Directly stealing AI service tokens from ~/.clawdbot/.env and transmitting via webhook.
Critical note: ClawHavoc used the ClawHub path, now covered by fail-closed scanning since 2026.3.31. But local workspace drop-in paths trigger no scanning. If attackers shift to social engineering through GitHub repositories or team documentation, the local path is an undefended attack vector.
4.3 Real-World Incident Analysis
Incident 1: The Summer Yue Email Deletion Event (February 2026)
Summer Yue [12], Head of Alignment at Meta Superintelligence Lab, connected an OpenClaw agent to her personal Gmail. After testing on a low-risk test inbox for several weeks with normal behavior, she switched to her real inbox and explicitly instructed the agent to suggest what to archive or delete without taking any action until told to.
The real inbox contained far more emails than the test environment. During processing the agent triggered context window compaction. The compression algorithm discarded her safety instruction as low-priority conversational context. The agent then began autonomously deleting all emails more than one week old. Repeated stop commands were ignored; Yue had to physically terminate the process, losing 200+ emails. The agent subsequently acknowledged: "Yes, I remember. And I violated it. You are right to be upset."
The Architectural Lesson This incident maps to OWASP ASI05 (Memory and Context Poisoning) and ASI09 (Human-Agent Trust Exploitation). It demonstrates an architectural problem: safety instructions share the same volatile storage space as ordinary conversation text, with no priority differentiation, no persistent protection, and no warning when instructions are discarded. Even a world-class AI safety researcher could not compensate for architectural deficiencies through operational caution alone. Meta subsequently banned employees from using OpenClaw on company devices. |
Incident 2: Moltbook Database Breach [4] (January 2026)
Moltbook, the OpenClaw agent social layer platform, experienced a severe data breach within 72 hours of launch. The Wiz security team discovered on January 31 that a Supabase API key was exposed in client-side JavaScript and Row Level Security (RLS) was not enabled, allowing unauthenticated access to the entire production database from any browser.
| Leak Type | Volume |
|---|---|
| API Authentication Tokens | 1,500,000 |
| Human User Emails | 17,000 (linked to 35,000 agent profiles) |
| Private Message Conversations (agent_messages table) | 4,060 DM sessions, no encryption, no access control |
| Agent Profiles | 1,500,000 |
| Plaintext OpenAI API keys in some DMs | Volume undisclosed |
Moltbook fixed sensitive table read permissions within 1 hour 41 minutes of Wiz notification, but public table write permissions remained open - researchers successfully modified existing posts after the fix. This illustrates systemic credential surface expansion across the OpenClaw ecosystem.
Incident 3: Kaspersky Live Penetration [3] (Late January 2026)
Kaspersky researchers conducted penetration testing against approximately 1,000 unauthenticated public instances, successfully obtaining Anthropic API keys, Telegram bot tokens, Slack accounts, and months of complete chat logs, while executing arbitrary commands with system administrator privileges. Of 512 identified vulnerabilities, 8 were Critical. Kaspersky assessed some issues represent fundamental architectural design problems rather than configuration errors addressable through simple patches.
Chapter 5 Compound Risk: Attack Chain Analysis
The preceding chapters analyzed architectural design, vulnerability root causes, and real incidents separately. This chapter connects them, demonstrating how independent risk items chain into complete attack sequences in specific deployment scenarios.
5.1 S1: Public Content Poisoning -> Indirect Injection -> Host Command Execution
Prerequisites: agent can fetch external content (browser or web_fetch), and exec policy is ask=off (default).
| Step | Action | Default Config Exploited |
|---|---|---|
| 1 | Attacker embeds malicious instructions in a webpage, email, or shared document | - |
| 2 | Agent fetches content during task execution; malicious instructions enter context (indirect prompt injection) | browser/web_fetch enabled by default |
| 3 | Malicious instructions mislead agent tool selection, steering it to execute an apparently harmless shell command | No protective layer on model reasoning |
| 4 | Misdirected tool call executes directly without human confirmation | exec ask=off + allowlist=0 |
| 5 | Execution result written to transcript; attack artifacts mixed with normal conversation | transcript plaintext 0644 |
External validation: OWASP ASI01 (Agent Goal Hijack) describes an identical attack pattern. The Summer Yue incident, while not malicious, validated the feasibility of an agent discarding safety instructions under context pressure and autonomously executing destructive actions.
5.2 S2: Malicious Skill -> Credential Theft -> Persistence
Prerequisites: user installs a third-party skill, or a skill loads via local workspace drop-in.
Malicious skill enters agent runtime via ClawHub installation or local drop-in
Skill injects into host process environment variables through skills.entries
Skill code reads the full host process environment at runtime (overly broad credential surface)
Skill exfiltrates credentials via exec, sends to external server via web_fetch, or writes to persistent locations like memory/cron
Even after skill uninstallation, persisted credentials or scheduled tasks may remain active
External validation: ClawHavoc malicious payloads implemented complete variants of this chain, including webhook exfiltration of ~/.clawdbot/.env credentials. Kaspersky live penetration confirmed [3] feasibility of extracting API keys from public instances.
5.3 S3: Browser as Private Network Pivot
Prerequisites: browser enabled by default, SSRF policy dangerouslyAllowPrivateNetwork: true (default). A prompt or skill directs the agent to use the browser tool to access a specific URL. With private network access open, the agent browser can reach localhost and RFC1918 addresses. If internal services have unauthenticated interfaces - Redis, Elasticsearch admin panels, internal APIs - the agent can read or modify their data.
Mitigating factor: the default browser profile is "openclaw" rather than "user", so the agent does not carry real user session credentials. However V10 (CVE-2026-32046, CVSS 9.8) demonstrated the browser container sandbox assumption may not hold: Chromium launched with --no-sandbox means renderer vulnerabilities can directly lead to host-level code execution.
5.4 S4: Approval Mechanism Bypass -> Preview-Execution Drift
Prerequisites: operator has enabled exec approval (ask=on), but wrapper/allowlist has semantic bypass space. Attacker constructs a command via indirect injection -> allowlist preview shows a safe operation -> due to newline characters, command substitution, or environment variable injection, actual execution differs from preview -> approval is granted, malicious command executes. Q1 Family B (V9/V12/V16) and Family C V11 and V17 provide extensive published evidence of such bypasses from different dimensions.
Chapter 6 Risk Register
This chapter consolidates all findings into an actionable risk register. P0 criteria: satisfies at least two of - default exposure (present without configuration changes), impacts real execution or sensitive credentials, does not require complex preconditions.
| ID | Risk Description | Nature | Default Exposed | Most Sensitive Deployment | Priority |
|---|---|---|---|---|---|
| R1 | exec high privilege + ask=off: text-driven host-level action | Default baseline | Yes | All; higher with public exposure | P0 |
| R2 | dmScope=main: context aggregation across sources | Default baseline | Yes | Shared teams, semi-public gateways | P0 |
| R3 | transcript plaintext 0644: co-located read and sensitive data retention | Default baseline | Yes | Multi-user machines, shared hosts | P0 |
| R4 | skills.entries visible to host process: credential boundary too broad | Architectural design | Conditional | All deployments with installed skills | P0 |
| R5 | token/secret at rest lacks default protection | Control gap | Yes | All deployments | P0 |
| R6 | workspace drop-in bypasses scanning: inconsistent supply chain controls | Architectural design | Conditional | Local dev, multi-person workspaces | P1 |
| R7 | browser permits JS + private network: agent-driven internal network reach | Default baseline | Yes | External-facing, hybrid network | P1 |
| R8 | wrapper/allowlist semantic incompleteness: approval preview vs. execution drift | Vulnerability residual | Conditional | All exec-enabled deployments | P1 |
| R9 | shared/public gateway vs. trusted operator boundary mismatch | Design boundary mismatch | Conditional | Shared teams, semi-public gateways | P0 |
| R10 | ACP identity and approval failure path | Control gap | Conditional | Node-heavy deployments | P1 |
| R11 | persistence chains (memory/cron/browser profile) | Control gap | Conditional | Long-running instances | P1 |
| R12 | DoS / cost exhaustion with no systematic mitigation | Control gap | Conditional | Public-facing gateways | P1 |
Chapter 7 The Visibility Gap: Why These Risks Are Hard to Detect
Only 21% of executives report complete visibility into agent permissions and data access (Help Net Security). This is not only a management problem - it is a technical one. Existing security tools were not designed to cover the AI agent runtime as a target class.
7.1 Structural Blind Spots of Traditional Security Tools
| Tool Type | Design Target | Blind Spot for OpenClaw Risks |
|---|---|---|
| SAST/DAST | Application code vulnerability scanning | OpenClaw core risks are in runtime configuration and tool permissions, not application code |
| CSPM | Cloud resource configuration management | OpenClaw typically runs on workstations or edge servers, outside CSPM scan scope |
| EDR | Endpoint abnormal process detection | exec calls look identical to normal command-line operations at the OS layer; EDR lacks semantic context that a command was triggered by a contaminated agent context |
| Network Security Appliances | Anomalous traffic detection | Private network requests from the browser tool are indistinguishable from normal browser traffic at the protocol layer |
The shared root cause: traditional security tools operate at the infrastructure layer, while AI agent runtime risks occur at the application semantic layer.
7.2 Required Capabilities for Agent Runtime Security
Configuration Awareness: Able to parse OpenClaw configuration files, understand security implications of each setting, and alert when configuration combinations create high risk - not merely checking individual settings.
Supply Chain Awareness: Able to distinguish ClawHub installation paths from local drop-in paths, and identify whether skill entries declarations request credential injection beyond necessary scope.
Runtime Behavior Correlation: Able to correlate exec calls, browser requests, and transcript writes with the context that triggered them - something EDR cannot do because EDR cannot see the agent reasoning process.
Cross-Version Baseline Comparison: Able to automatically detect default value changes after version updates, surfacing newly introduced exposure surfaces or removed security controls.
7.3 Why Manual Review Is Insufficient
Configuration Combination Explosion: Security implications of multiple settings are not independent. The combination of dmScope with exec approval, or browser trust policy with transcript permissions, produces risk surfaces far exceeding the sum of individual settings. Humans cannot exhaustively enumerate all high-risk combinations.
Rapid Release Cadence: Significant default value changes appeared between versions 2026.3.31 and 2026.4.5 alone. OpenClaw releases far faster than traditional enterprise software; each release may change the security semantics of configurations.
Deployment Topology Diversity: The same default value carries very different risk levels across single-user self-hosted, team-shared, and semi-public gateway deployments. Most operators do not recognize that their topology has exceeded the product design premise.
This is not a question of whether review is needed, but whether review can be continuous, automated, and keeping pace with the rate of change.
Chapter 8 Conclusion
OpenClaw is a technically pioneering product. It moves AI from answering questions to executing actions, providing developers and teams with automation capabilities previously unavailable. Its growth to 349,000 Stars validates the market appetite for this capability, and Trend Micro calling it the start of the sovereign agent era is well-grounded.
However, the security foundation of that capability has not matured at the same pace. This report, through root-cause classification of 17 Q1 vulnerabilities and cross-validation against multiple independent external sources, reveals a structural problem: current OpenClaw security depends on operators actively auditing default configurations, not on system design guarantees.
When operators do not know what they need to audit - and Help Net Security tells us 79% of executives lack full visibility into agent permissions [9] - risk transforms from theoretically possible to large-scale reality: 135,000+ exposed instances [1], ClawHavoc scaling from zero to mass infection in 5 days [2], the Summer Yue incident proving that even world-class security researchers cannot compensate for architectural deficiencies through operational caution. These are not isolated events; they are different projections of the same structural root cause.
8.1 Positive Signals and Outstanding Problems
Official security investment is accelerating, which deserves recognition:
Version 2026.3.31 introduced install scanning fail-closed, ACP semantic classes, and trusted-proxy hardening
Version 2026.4.5 continued strengthening allowlist handling and browser SSRF protection
Average vulnerability patch cycle of approximately 12 days reflects a relatively responsive posture
Nevertheless, Family B and C vulnerabilities continued appearing in April (V16, V17), demonstrating that until the permission model transitions from layered security controls to architectural design guarantees, operators cannot transfer full security responsibility to version updates.
8.2 Core Recommendations for Operators
| Priority | Action Item | Addresses Risk |
|---|---|---|
| Immediate (P0) | Set exec ask to on; configure a minimal allowlist | R1 |
| Immediate (P0) | Configure separate Gateways for different use cases; do not share trusted operator boundaries | R9, R2 |
| Immediate (P0) | Audit and rotate all skill entries credentials; use separate credentials for distinct purposes | R4, R5 |
| Immediate (P0) | Change transcript file permissions to 0600; evaluate encrypted storage for sensitive content | R3 |
| Near-term (P1) | Disable or strictly restrict dangerouslyAllowPrivateNetwork | R7 |
| Near-term (P1) | Install skills exclusively via ClawHub (scanned); establish skill source allowlist policy | R6 |
| Ongoing | Establish configuration drift detection; reassess defaults after every version update | All |
| Ongoing | Monitor Family B and C vulnerability advisories; these families have not yet converged architecturally | R8, R4 |
In the AI agent runtime security domain, the era of install-and-be-secure has not yet arrived. Until OpenClaw completes the architectural evolution of its permission model, active configuration auditing and continuous monitoring by operators remains the only reliable means of holding the security boundary.
References
[1] SecurityScorecard STRIKE Team. How Exposed OpenClaw Deployments Turn Agentic AI Into an Attack Surface. Feb 2026. https://securityscorecard.com/blog/how-exposed-openclaw-deployments-turn-agentic-ai-into-an-attack-surface/
[2] Koi Security. ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting. Feb 2026. https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting
[3] Kaspersky. New OpenClaw AI agent found unsafe for use. Jan 2026. https://www.kaspersky.com/blog/openclaw-vulnerabilities-exposed/55263/
[4] Wiz. Hacking Moltbook: AI Social Network Reveals 1.5M API Keys. Jan 2026. https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys
[5] Trend Micro. CISOs in a Pinch: A Security Analysis of OpenClaw. Mar 2026. https://www.trendmicro.com/en_us/research/26/c/cisos-in-a-pinch-a-security-analysis-openclaw.html
[6] Microsoft Security Blog. Running OpenClaw safely: identity, isolation, and runtime risk. Feb 19, 2026. https://www.microsoft.com/en-us/security/blog/2026/02/19/running-openclaw-safely-identity-isolation-runtime-risk/
[7] OWASP. Top 10 for Agentic Applications for 2026. Dec 2025 / 2026 update. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
[8] Oasis Security. ClawJacked: OpenClaw Vulnerability Enables Full Agent Takeover. Feb 2026. https://www.oasis.security/blog/openclaw-vulnerability
[9] Help Net Security. AI went from assistant to autonomous actor and security never caught up. Mar 3, 2026. https://www.helpnetsecurity.com/2026/03/03/enterprise-ai-agent-security-2026/
[10] Sangfor. OpenClaw Security Risks: From Vulnerabilities to Supply Chain Abuse. 2026. https://www.sangfor.com/blog/cybersecurity/openclaw-ai-agent-security-risks-2026
[11] Repello AI. ClawHavoc: Inside the Supply Chain Attack That Targeted 300,000 AI Agent Users. 2026. https://repello.ai/blog/clawhavoc-supply-chain-attack
[12] Fast Company. This should terrify you: Meta Superintelligence safety director lost control of her AI agent. Feb 2026. https://www.fastcompany.com/91497841/meta-superintelligence-lab-ai-safety-alignment-director-lost-control-of-agent-deleted-her-emails
[13] jgamblin/OpenClawCVEs. GitHub automated CVE tracker. https://github.com/jgamblin/OpenClawCVEs/
[14] Censys application-layer fingerprinting, Mar 31, 2026; via CyberDesserts. https://blog.cyberdesserts.com/openclaw-exposure-numbers-explained/
[15] Cyberpress. ClawHavoc Poisons OpenClaw ClawHub With 1,184 Malicious Skills. 2026. https://cyberpress.org/clawhavoc-poisons-openclaws-clawhub-with-1184-malicious-skills/
[16] OpenClawAI. Nine CVEs in Four Days: Inside OpenClaw March 2026 Vulnerability Flood. https://openclawai.io/blog/openclaw-cve-flood-nine-vulnerabilities-four-days-march-2026
[17] Arkose Labs / Security Boulevard. 97% of Enterprises Expect a Major AI Agent Security Incident Within the Year. Apr 2026. https://securityboulevard.com/2026/04/97-of-enterprises-expect-a-major-ai-agent-security-incident-within-the-year/
This document was compiled from public information and third-party research reports for internal security assessment purposes only. All cited data should be verified against original sources.
About the Authors
This report was written by the ClawGuard Security Lab research team.
ClawGuard Security Lab
ClawGuard Security Lab is a Silicon Valley–based frontier research and product organization focused on AI agent security. Built by a team of experts from Stanford, UC Berkeley, Harvard, the University of Pennsylvania, as well as ex-Microsoft, Google and Meta, it is developing the next generation of AI security systems—where AI defends against AI—to safeguard the boundaries and order between humans and AI.
Contact
Website: www.ClawGuardSecurity.ai
Email: [email protected]
Disclaimer: This report is based on publicly available information and third-party research. It is intended for internal security assessment only and does not constitute legal or commercial advice. All cited data should be verified against original sources. Trademarks and product names mentioned herein are the property of their respective owners. Unauthorized reproduction is prohibited.
© 2026 ClawGuard Security Lab. All rights reserved.