February 9, 2026 - Bitsight researchers found thousands of exposed OpenClaw AI instances. Here's what the risks are, how attackers exploit them, and what security teams should do

February 23, 2026 - Multiple hacking groups have taken advantage of severe vulnerabilities to steal API keys, extract persistent memory data, and push information-stealing malware instead of leaving the platform’s expanding user base unharmed. Security analysts have linked more than 30,000 compromised instances to campaigns that intercept messages and deploy malicious payloads through channels such as Telegram...

May 27, 2026 - Earlier this month, researchers discovered over 1,000 malicious skills in OpenClaw's community marketplace (ClawHub) —fake plugins masquerading as crypto tools and productivity integrations that instead deployed info-stealers and backdoors.

February 9, 2026 - The exposed AI agents could enable threat actors to gain full access to potentially sensitive systems the OpenClaw instance is able to interact with. SecurityScorecard found that type of activity is already occurring. The firm correlated 549 exposed instances with prior breach activity, and 1493 with known vulnerabilities.

April 1, 2026 - Any website could steal your authentication token and run arbitrary code on your machine through a single malicious link. The vulnerability was patched in version 2026.1.29. Before that patch landed, Censys found over 21,000 OpenClaw instances ...

February 22, 2026 - Flare analysts have observed over 30,000 compromised OpenClaw instances used to steal API keys, intercept messages, and distribute info-stealing malware via Telegram and other malicious communication channels.

February 10, 2026 - These scripts — which mimicked trading bots, financial assistants, OpenClaw skill management systems, and content services — packaged a stealer under the guise of a necessary utility called “AuthTool”. Once installed, the malware would exfiltrate files, crypto-wallet browser extensions, seed phrases, macOS Keychain data, browser passwords, cloud service credentials, and much more. To get the stealer onto the system, attackers used the ClickFix technique, where victims essentially infect themselves by following an “installation guide” and manually running the malicious software. A security audit conducted in late January 2026 — back when OpenClaw was still known as Clawdbot — identified a full 512 vulnerabilities, eight of which were classified as critical.

March 2, 2026 - A high-severity vulnerability called ClawJacked in OpenClaw allowed malicious websites to brute-force and take control of local AI agent instances. Oasis Security discovered the flaw, which enabled silent data theft.

February 26, 2026 - This article explores the critical security failures of the OpenClaw agentic AI, which allowed sensitive data to leak across user sessions and IM channels. It examines how architectural weaknesses in the Control UI and session management created direct paths for prompt injection and unauthorized tool use. Finally, it outlines the essential hardening steps and systematic red-teaming strategies required to transform a vulnerable "fun bot" into a secure enterprise assistant.

1 week ago - In early 2026, research by Illumio found that more than 4,500 incorrectly configured installations, leaving passwords, API keys, and private data exposed to theft. These exposures mean that anyone on the internet could potentially send commands ...

May 15, 2026 - Cybersecurity researchers have ... collectively dubbed Claw Chain by Cyera, can permit an attacker to establish a foothold, expose sensitive data, and plant backdoors....

April 3, 2026 - The word ‘privilege escalation’ undersells this: the outcome is full instance takeover.” · While fixed, the vulnerability means that thousands of instances may have been compromised without users having the slightest idea.

March 1, 2026 - Security researchers have disclosed a high-severity vulnerability dubbed "ClawJacked" in the popular AI agent OpenClaw that allowed a malicious website to silently bruteforce access to a locally running instance and take control over it.

March 24, 2026 - DepthFirst researcher Mav Levin discovered CVE-2026-25253, a one-click remote code execution vulnerability that could compromise any OpenClaw instance in milliseconds. Simply visiting a malicious webpage was enough to trigger the attack chain, which exploited missing WebSocket origin validation to steal authentication tokens, disable sandboxing via the API, and achieve full host compromise.

February 10, 2026 - Parsing any malicious external input — such as a website, in this example — can lead to the easy takeover of a user's OpenClaw instance. Source: HiddenLayer · The attack underscores one of the three capabilities that make agentic AI assistants so potentially dangerous, known as the lethal trifecta. In this case, the exposure to untrusted content in summarizing a Web page, combined with two other facets of the trifecta — access to private data and the ability to externally communicate — puts user's data at risk.

February 17, 2026 - Infostealer malware stole OpenClaw AI agent files including tokens and keys, while exposed instances and malicious skills expand security risks.

February 1, 2026 - The OpenClaw team quickly addressed and fixed the issue I reported. Here’s the GitHub Advisory. I found there was another person who found and reported the same bug. The patch adds a gateway URL confirmation modal, removing the auto-connect-without-prompt behavior. All versions up to v2026.1.24-1 are vulnerable.

Recent reporting describes multiple threat actors exploiting OpenClaw deployments to steal API keys and deliver malicious payloads, while parallel research and advisories show a broader pattern: this is not one bug, but an ecosystem-level security ...

February 19, 2026 - The safest guidance is to avoid installing and running OpenClaw with primary work or personal accounts and to avoid running it on a device that contains sensitive data. In its current form, assume the runtime can be influenced by untrusted input, its state can be modified, and the host system can be exposed through the agent.