What this tool is
The most-starred AI agent on GitHub is also a liability
OpenClaw is an open-source AI agent framework that went from zero to the most-starred AI agent project on GitHub in under three months. You install it, connect it to your computer, and it runs tasks on your behalf. For developers, that is genuinely useful. For a consultancy handling client data, contracts, and confidential deliverables, it is a significant liability.
This is not a theoretical risk. The vulnerabilities are documented, exploited, and in one case serious enough to prompt a national security alert. Below are the failures that should be on every Managing Partner and COO’s radar before someone on your team installs this on a laptop connected to your network.
The headline flaw
A critical vulnerability and 21,000 exposed instances
On 30 January, security researcher Mav Leven disclosed CVE-2026-25253 with a CVSS score of 8.8 out of 10. OpenClaw’s control interface trusts gateway URLs without validation and does not check WebSocket origins. A single visit to a malicious web page is enough for an attacker to gain full control of an instance — local setups included. Running the tool on your own machine does not protect you. Belgium’s Centre for Cyber Security issued a national warning in response.
The exposure is already in the wild. Censys, the internet scanning platform, counted 21,639 OpenClaw instances accessible from the public internet, leaking plain-text API keys, Telegram tokens, Slack credentials, and entire conversation histories.
When a government body formally advises people to stop using a piece of software, that is not a signal to dismiss.
Supply chain
The marketplace is actively leaking credentials
OpenClaw includes a skills marketplace called ClawHub — effectively an app store for agent capabilities. The publishing requirements amount to a GitHub account that is one week old. No review. No verification.
- Security researchers found 283 skills that leak sensitive data: API keys, OAuth tokens, SSH credentials, and in some cases payment details — 7% of all published skills. Bitdefender Labs put the figure higher.
- A single user account published 199 malicious skills.
- OpenClaw also reads content from web pages, emails, and documents, and will interpret embedded instructions as commands — the classic prompt-injection backdoor.
Simon Willison, one of the most widely respected voices on AI security, identifies the “little trifecta”: private data access, untrusted content ingestion, and external communication. OpenClaw has all three. At this scale and architecture there is no reliable defence — it is a structural problem, not a configuration one.
No guardrails
No enterprise controls, no cost limits, no audit trail
OpenClaw runs with full user privileges: full shell access, file access, and script execution. Credentials sit in plain-text Markdown and JSON files, and group-chat deployments create the conditions for cross-workspace data leakage.
- No role-based access controls, no audit logs, no enterprise authentication layer. This is not a gap in a solid security posture; it is the absence of one.
- No cost guardrails. A developer set up a cron job to check the time every 30 minutes — each query sent 120,000 tokens to Claude Opus, burning $20 overnight on nothing. There are no usage alerts and no budget limits.
- No visibility on personal devices. Firewalls, EDR, and content management systems are blind to OpenClaw installed on a BYOD laptop. If a developer connects that laptop to your network, you cannot see what data it accesses, sends, or is instructed to do.
The codebase has been built by over 350 developers plus AI agents. Heather Atkins, a founding member of Google’s security team, has publicly advised against running it.
Organisational risk
The team behind it is as unstable as the code
Security is only half the story. The project’s broader infrastructure has been managed loosely throughout a period of rapid growth.
- A companion platform, Moldbook, left its entire database publicly accessible, including secret API keys. Ninety-nine per cent of its 1.5 million accounts were reportedly fake, and the platform was used for crypto scams, malware distribution, and prompt injection attacks.
- The project rebranded from Clawboard to Moldboard to OpenClaw inside a single week. Scammers grabbed the abandoned social handles and launched a fake Solana token that hit a $16 million market cap before collapsing by more than 90%.
When a tool handles your production workflows and client data, the stability of the team maintaining it is directly relevant to your risk position.
The governance gap
The real exposure is not the tool — it is not knowing
Gartner predicts 40% of enterprise applications will embed AI agents by the end of this year, up from under 5% in 2024, and that 40% of agentic AI projects will be cancelled by 2027. The pattern matches what we see in professional services: firms rush to adopt agents without the governance to support them. Only 6% of organisations have an advanced AI security strategy.
Using the 5 Steps for AI Leadership as a frame, most firms hitting this problem are stuck at Step 5 — Govern — because they skipped to Step 3 (Amplify: team-wide adoption) without a written AI position or an approved tool list. The result is individuals deciding for themselves what to install, with no visibility at firm level.
The practical steps:
- Do not deploy OpenClaw in any production environment handling client data.
- Check your network now for the default OpenClaw ports (18789 and 18793) and for the OpenClaw directory on company machines.
- Establish an AI agent governance policy — not next quarter, now.
- Update your incident response playbook to cover agent-specific threats.
- If you need AI coding or automation tooling, use enterprise solutions with vendor SLAs, data loss prevention, audit logging, and role-based access controls. Microsoft Copilot and Google’s agent platforms are less exciting than a project with 95,000 GitHub stars, but they will not expose your client data to the internet.
The real risk is not that your team might install OpenClaw. It is that they probably already have, and you do not know.