The AI Agent Everyone Installed Has a Security Problem

OpenClaw arrived as the kind of project that makes the open-source world feel unstoppable. A self-hosted AI agent that runs on your own machine, reads and writes files, browses the web, sends email and executes code on your behalf, it collected more than 135,000 GitHub stars in a matter of weeks. That popularity is now the problem. Security researchers have spent the past two months pulling the software apart, and what they have found is unsettling.

Wide open by default

Scans of the public internet have turned up tens of thousands of OpenClaw instances reachable by anyone. Estimates vary by researcher and by week, ranging from around 30,000 to figures well above 100,000, but the consistent finding is the dangerous one: the large majority were running with no authentication at all. Reco's analysis found exposed deployments spread across more than fifty countries, with the United States and China hosting the heaviest concentrations.

An exposed agent is not a leaked spreadsheet. It is a program with hands. If a stranger can reach it, they can potentially make it do the same things you can: read your files, run commands, touch any account it has been given keys to. That is what makes an unauthenticated agent on the open web a different class of risk from an ordinary misconfigured server.

The flaws stack up

The exposure was the start. Roughly three weeks after the software went viral, researchers disclosed CVE-2026-25253, a one-click remote code execution flaw in OpenClaw's core. eSecurity Planet described how a single crafted link could trick an instance into handing over its authentication token, which an attacker could then use to run arbitrary commands.

The security firm Cyera went further, chaining four separate weaknesses into an attack it named Claw Chain. Strung together, the flaws let an attacker escape the agent's sandbox, steal credentials, raise privileges and stay resident on the machine. The most severe of them carries a CVSS score of 9.6, near the top of the scale.

Then came the supply chain. Attackers flooded ClawHub, OpenClaw's official plugin registry, with more than a thousand malicious add-ons, by one count close to a fifth of everything in the marketplace. Many delivered a known macOS credential stealer to anyone who installed them. Barracuda has been tracking the campaign, which researchers took to calling ClawHavoc.

Why this keeps happening

None of this means OpenClaw is uniquely bad code. It means agents are a new kind of attack surface, and the tooling around them is younger than the enthusiasm for shipping them. We have seen the pattern in other forms this month, from Google's lawsuit against a network that built phishing sites with Gemini to the steady drip of stolen developer credentials. The throughline is that capable AI tools get adopted faster than anyone hardens them.

If you are running OpenClaw, the immediate advice from researchers is dull and correct. Take it off the public internet, put authentication in front of it, update to a patched build and treat every plugin you did not write as untrusted until proven otherwise. The harder lesson sits above any single project. An agent you can hand real power to is an agent someone else would love to borrow.