The Butler Has the Keys: Can You Trust Products Built on OpenClaw?
Liam R. — Freelance Penetration Tester
There is a question that nobody in the technology industry seems particularly eager to answer right now. Several of the world's largest companies have spent the past few months publicly warning that a piece of software called OpenClaw represents a serious security risk, threatening employees with dismissal for installing it, classifying it as untrusted code, and banning it from government systems. Those same companies have since built, acquired, or announced flagship products that depend on it. The question is straightforward: if the foundations are compromised, what does that mean for everything built on top of them?
What OpenClaw Actually Is
OpenClaw began life in November 2025 as a weekend project by Austrian developer Peter Steinberger, initially called Clawdbot. It is an autonomous AI agent framework: software that does not merely answer questions but acts on your behalf, executing shell commands, reading and writing files, browsing the web, sending emails, managing your calendar, and interacting across your digital life without needing to be prompted for each step. It reached 180,000 GitHub stars within weeks of launch, making it one of the fastest-growing open source projects in history. Within three months, it had been acquired by OpenAI, embraced by NVIDIA, integrated into WeChat by Tencent, and adopted as the foundation of Microsoft's new Scout agent platform.
It had also, in that same period, been the subject of one of the most significant security crises in the open source AI community.
The Scale of the Problem
The vulnerabilities were not subtle. A January 2026 audit found 512 vulnerabilities in OpenClaw, eight at the highest severity level. Security researchers discovered more than 42,000 unique IP addresses hosting exposed OpenClaw control panels across 82 countries, with over 15,000 vulnerable to remote code execution. A separate scan found that 63% of public instances were open to remote attack. One critical vulnerability, CVE-2026-25253 , allowed any website to hijack a local OpenClaw agent via WebSocket manipulation, with no user interaction required, meaning an agent running quietly on your machine could be compromised simply by visiting a malicious page.
The skills ecosystem, the marketplace of plugins that extends OpenClaw's capabilities, proved even more alarming. An audit of the ClawHub registry found 341 malicious skills out of 2,857 reviewed. One of them was the most downloaded skill on the platform. The malicious skills were distributing the Atomic macOS Stealer , quietly exfiltrating files, cryptocurrency wallets, browser passwords, and cloud credentials from the machines of users who believed they were installing productivity tools. By the time the full picture emerged, the malicious skill count had climbed past 820.
Cisco Talos described OpenClaw as "groundbreaking" and simultaneously "an absolute nightmare from a security perspective." A security researcher found the critical remote code execution vulnerability in one hour and forty minutes of analysis. One widely shared observation from the security community was blunt: OpenClaw is "basically a bunch of coding-illiterate people installing AI and giving it access to their personal email, Telegram, Discord, and WhatsApp, compromising their operational security for the illusion of a personal assistant."
The Industry's Response: Warnings First, Products Second
What followed is where the story becomes genuinely uncomfortable for the companies involved.
Microsoft is the starkest example. In February 2026, Satya Nadella described OpenClaw as a "virus"-like security risk. Microsoft Threat Intelligence confirmed a supply chain attack in which the Cline CLI package silently installed OpenClaw on approximately 8,000 machines for eight hours, and formally classified OpenClaw as "untrusted code execution." Three months later, at BUILD 2026, Nadella announced Microsoft Scout, a flagship autonomous AI agent for Microsoft 365, built on OpenClaw. An internal strategy document leaked to 404 Media revealed that the explicit goal of phase one was to "make users addicted", with security and compliance listed as things to be "sorted out later."
Meta banned OpenClaw from all company devices in February 2026, with an unnamed manager warning staff that installation would result in termination. This was particularly striking because Mark Zuckerberg had been personally experimenting with OpenClaw and had reportedly attempted to recruit its creator. Meta then acquired Moltbook, a social network built on OpenClaw, and proceeded to integrate OpenClaw-compatible infrastructure across its platforms.
The Chinese government banned OpenClaw from all government systems in March 2026, citing security risks, while simultaneously local governments in technology and manufacturing hubs began offering grants to startups building OpenClaw applications. Tencent, operating under Chinese jurisdiction, launched a full suite of OpenClaw-compatible products integrated with WeChat, bringing the framework to hundreds of millions of users.
NVIDIA took a more considered approach. Rather than simply adopting OpenClaw uncritically, Jensen Huang, who called it "probably the single most important release of software, probably ever", built NemoClaw, a governance and sandboxing layer designed to make OpenClaw deployable in enterprise settings. The existence of NemoClaw is itself an acknowledgement that OpenClaw in its default state is not enterprise-ready.
The Dutch data protection authority warned organisations against deploying OpenClaw on systems handling sensitive data in February 2026, citing GDPR enforcement powers. The warning appears to have had limited effect on adoption.
In Fairness: The Remediation Is Real
A balanced assessment requires acknowledging that OpenClaw's response to its security crisis has been substantive. Patches for critical vulnerabilities were released within 72 hours of disclosure. A major security-focused update in February 2026 fixed more than 40 vulnerabilities and introduced defence-in-depth measures, including strict SSRF policies, authenticated defaults, and structured handling of untrusted browser output. By March 2026, the project was shipping releases at roughly one every two days, each carrying security patches alongside new features. The May 2026 security roadmap introduced filesystem safeguards, network egress controls, and enhanced plugin integrity checks. The ClawHub registry now runs automated security scanning across thousands of skills daily.
One assessment put it fairly: "The problem is not that OpenClaw is uniquely bad software. The OpenClaw team has shipped rapid security improvements at a pace that shows genuine commitment to fixing these issues. The deeper problem is that any powerful, always-on AI agent with access to your email, calendar, files, and messaging requires infrastructure-level security thinking, not just an app install."
The Question Nobody Is Answering
Which brings us back to the central problem. When a company builds a product on a dependency, the security posture of that product is partly determined by the security posture of everything beneath it. Microsoft Scout, running on OpenClaw, inherits OpenClaw's attack surface. The same is true of Meta's acquisitions, Tencent's WeChat integrations, and the hundreds of enterprise products being built by the ecosystem of companies now racing to deploy OpenClaw in production environments.
The governance layers help. NVIDIA's NemoClaw, properly implemented, reduces the risk. But governance layers require correct configuration, ongoing maintenance, and competent deployment, none of which can be assumed at enterprise scale. The ClawHub audit that found malicious skills still being downloaded by thousands of users is a reminder that the gap between a security improvement being shipped and a security improvement being universally applied is wide, and exploitable.
There is also a structural concern that goes beyond any specific vulnerability. OpenClaw is, by design, an always-on agent with persistent access to your accounts, files, and communications, acting autonomously on your behalf. That architecture means that a compromise is not a one-time event. An attacker who gains access to an OpenClaw agent does not just see what you did in a browser session. They see everything the agent can touch, can act as you in your name, and may do so for as long as the compromise goes undetected.
The liability question, raised acutely by several enterprise IT professionals following the Scout announcement, remains unanswered. When an autonomous agent built on a framework with a documented history of critical vulnerabilities pays a fraudulent invoice, sends a damaging email, or leaks confidential documents, who is responsible? Microsoft's terms of service will not point to Redmond. The enterprise customer will bear the consequence.
The Deeper Pattern
OpenClaw is, in one sense, simply the latest instance of a recurring dynamic in the technology industry: a powerful new capability emerges, the competitive pressure to deploy it outpaces the maturity of the underlying security, and the consequences fall on users and organisations rather than on the companies that moved too fast.
What is different this time is the degree of self-awareness on display. These are not companies that failed to notice the security risks. They identified them, documented them, warned their own employees about them, and deployed anyway, because the alternative was ceding ground to competitors who were doing the same thing. Microsoft classified OpenClaw as untrusted code execution in February and shipped a product built on it in June. Meta banned it under threat of dismissal and then acquired a company that had built its entire platform on it. The Chinese government banned it from state systems while subsidising its commercial adoption.
That is not a failure of knowledge. It is a failure of judgment, driven by competitive panic. And it is worth asking, clearly and directly, whether the products that have emerged from that panic deserve the trust that millions of enterprise users are about to place in them. The security researcher who found the critical OpenClaw vulnerability in under two hours offered perhaps the most useful framing: "The butler is brilliant. Just make sure he remembers to lock the door."
Right now, the door is ajar. The question is whether the companies who handed the butler the keys bothered with background checks.
4 reactions · 0 comments