February 9, 2026 - Bitsight researchers found thousands of exposed OpenClaw AI instances. Here's what the risks are, how attackers exploit them, and what security teams should do

BitSight identified over 30,000 exposed OpenClaw instances, many without proper authentication, while a large percentage were vulnerable to remote code execution. This means attackers could potentially take full control of the host machine, access connected services, steal credentials, and abuse the agent’s permissions.

February 23, 2026 - Multiple hacking groups have taken advantage of severe vulnerabilities to steal API keys, extract persistent memory data, and push information-stealing malware instead of leaving the platform’s expanding user base unharmed. Security analysts have linked more than 30,000 compromised instances to campaigns that intercept messages and deploy malicious payloads through channels such as Telegram...

April 1, 2026 - Any website could steal your authentication token and run arbitrary code on your machine through a single malicious link. The vulnerability was patched in version 2026.1.29. Before that patch landed, Censys found over 21,000 OpenClaw instances ...

March 2, 2026 - A high-severity vulnerability called ClawJacked in OpenClaw allowed malicious websites to brute-force and take control of local AI agent instances. Oasis Security discovered the flaw, which enabled silent data theft.

May 7, 2026 - Within weeks: a critical RCE ... Atomic macOS Stealer · ClawJacked: a separate vulnerability allowing malicious websites to silently hijack any OpenClaw instance and steal credentials...

February 10, 2026 - These scripts — which mimicked trading bots, financial assistants, OpenClaw skill management systems, and content services — packaged a stealer under the guise of a necessary utility called “AuthTool”. Once installed, the malware would exfiltrate files, crypto-wallet browser extensions, seed phrases, macOS Keychain data, browser passwords, cloud service credentials, and much more. To get the stealer onto the system, attackers used the ClickFix technique, where victims essentially infect themselves by following an “installation guide” and manually running the malicious software. A security audit conducted in late January 2026 — back when OpenClaw was still known as Clawdbot — identified a full 512 vulnerabilities, eight of which were classified as critical.

May 27, 2026 - Earlier this month, researchers discovered over 1,000 malicious skills in OpenClaw's community marketplace (ClawHub) —fake plugins masquerading as crypto tools and productivity integrations that instead deployed info-stealers and backdoors.

February 9, 2026 - The exposed AI agents could enable threat actors to gain full access to potentially sensitive systems the OpenClaw instance is able to interact with. SecurityScorecard found that type of activity is already occurring. The firm correlated 549 exposed instances with prior breach activity, and 1493 with known vulnerabilities.

May 15, 2026 - Cybersecurity researchers have ... collectively dubbed Claw Chain by Cyera, can permit an attacker to establish a foothold, expose sensitive data, and plant backdoors....

June 18, 2026 - This exploit allows an attacker to gain access to all OpenClaw-integrated services and credentials via a full system compromise with user level privileges. The end goal by an attacker is the likely exfiltration of persistent memory containing ...

March 24, 2026 - DepthFirst researcher Mav Levin discovered CVE-2026-25253, a one-click remote code execution vulnerability that could compromise any OpenClaw instance in milliseconds. Simply visiting a malicious webpage was enough to trigger the attack chain, which exploited missing WebSocket origin validation to steal authentication tokens, disable sandboxing via the API, and achieve full host compromise.

February 17, 2026 - Infostealer malware stole OpenClaw AI agent files including tokens and keys, while exposed instances and malicious skills expand security risks.

July 22, 2026 - In early 2026, research by Illumio found that more than 4,500 incorrectly configured installations, leaving passwords, API keys, and private data exposed to theft. These exposures mean that anyone on the internet could potentially send commands ...

February 10, 2026 - Parsing any malicious external input — such as a website, in this example — can lead to the easy takeover of a user's OpenClaw instance. Source: HiddenLayer · The attack underscores one of the three capabilities that make agentic AI assistants so potentially dangerous, known as the lethal trifecta. In this case, the exposure to untrusted content in summarizing a Web page, combined with two other facets of the trifecta — access to private data and the ability to externally communicate — puts user's data at risk.

February 1, 2026 - The OpenClaw team quickly addressed and fixed the issue I reported. Here’s the GitHub Advisory. I found there was another person who found and reported the same bug. The patch adds a gateway URL confirmation modal, removing the auto-connect-without-prompt behavior. All versions up to v2026.1.24-1 are vulnerable.

April 3, 2026 - The word ‘privilege escalation’ undersells this: the outcome is full instance takeover.” · While fixed, the vulnerability means that thousands of instances may have been compromised without users having the slightest idea.

2 weeks ago - This is one of the most common OpenClaw vulnerabilities, especially when used in business workflows. If an OpenClaw instance is misconfigured or exposed, it can be exploited by hackers.

March 26, 2026 - An agent might expose sensitive data, misinterpret instructions, or take unintended actions on behalf of a user. However, the risks extend far beyond this. OpenClaw also introduces significant adversarial risks—ways the system itself can be ...