OpenClaw Security: CVEs and Exposed Instances Shadow Fast Growth

A viral agent with a growing attack surface

OpenClaw has become one of open source's biggest success stories. GitHub has described it as the fastest-growing project in the platform's history and has profiled the maintainers working to build and secure it 5. That growth has drawn attackers along with users. Within roughly three weeks of its rise, the autonomous AI agent faced several problems at once: a critical remote code execution flaw, a poisoning campaign in its skills marketplace, and architectural weaknesses that make both worse 2.

The project's own response has been fast. The harder question is whether that speed matters when so many deployments are old, exposed or badly configured.

The CVE timeline

The most serious flaw is CVE-2026-25253, a one-click RCE chain rated CVSS 8.8. It can be exploited even against instances bound only to localhost 2. Accounts of how it was found differ.

• Depthfirst account: SecurityWeek says Depthfirst disclosed the bug on February 1, after OpenClaw had already shipped a fix in version 2026.1.29 on January 29 1.
• Ethiack account: Valletta Software credits Ethiack, whose autonomous AI pentester Hackian found a one-click account-takeover-to-RCE chain against a live OpenClaw Gateway in under two hours with no human guidance 4. In that account, the issue was reported on January 26 and patched in the main branch on January 28 4.

The dates fit together if the January 28 commit preceded the January 29 tagged release. It is less clear whether these were independent discoveries of the same bug or overlapping findings, since the reports name different researchers.

The first fix was also incomplete. According to SecurityWeek, Depthfirst and Snyk found that the Docker sandbox could still be bypassed (CVE-2026-24763), which was fixed in version 2026.1.30 1. An earlier issue, CVE-2026-25157, had been patched on January 25 1. As of version 2026.2.17, SecurityWeek reported no known unfixed CVEs 1.

A broader audit points to a deeper backlog. Firecrawl cites a January 2026 audit that found 512 vulnerabilities, eight of them at the highest severity 3.

The exposure problem

Patches only help those who install them. SecurityWeek notes that a large number of older versions remain in use. Anything below 2026.1.30 is vulnerable to at least some of these CVEs, and attackers are still exploiting them 1.

The internet-exposure figures vary, but every count is large:

• Conscia: more than 30,000 internet-facing instances found by Censys, Bitsight and Hunt.io, many without authentication 2.
• Firecrawl: a Bitsight scan of over 40,000 public instances that found 63% open to remote attack, plus a Shodan search showing nearly 1,000 instances requiring no login at all 3.

The gap between these numbers probably reflects different scan dates and methods, not a contradiction. The direction is the same in each: the exposed population is in the tens of thousands.

Valletta's point about the Gateway Control UI matters here. A self-hosted, nominally "private" instance is still at risk if that interface can be reached 4. Conscia also reports that Bitdefender telemetry has found OpenClaw on corporate endpoints, effectively a new form of shadow IT inside enterprises 2.

Poisoned skills

The skills marketplace may be the more durable threat. Conscia describes the ClawHavoc campaign, which initially seeded 341 malicious skills into ClawHub, about 12% of the registry. Most of them delivered the Atomic macOS Stealer. Later scans put the figure above 800 malicious skills, roughly a fifth of the registry 2.

This is a supply-chain problem. Fixing a CVE does not solve it, because it targets the trust users place in third-party extensions.

Hardening and new tooling

Tooling to help users is starting to appear. SecurityWeek reports the debut of SecureClaw, an open source security tool, as OpenClaw moves to an OpenAI-backed foundation 1. Firecrawl points to SecureClaw and ClawSec for automated skill vetting 3. Its other recommendations include:

• Bind the gateway to loopback and use token-based authentication.
• Route untrusted content through a read-only agent and require approval for high-risk actions.
• Scope sessions per channel peer.
• Restrict filesystem access to the workspace.
• Isolate browser use.
• Restore a known-good configuration file after every restart 3.

Valletta's priorities cover similar ground: least-privilege tool access, prompt-injection defenses, full audit logging and network isolation 4.

The takeaway

The maintainers' patch cadence holds up well, and SecurityWeek explicitly declines to fault their recent efforts 1. But OpenClaw's risk now comes mainly from its ecosystem rather than its codebase. That includes outdated installs, exposed gateways, a contaminated marketplace and deployments IT teams don't know about.

An agent with direct API and tool access has a much larger blast radius than a chatbot 4. Its popularity also makes it an efficient target. For organizations, the practical response is to treat OpenClaw as privileged infrastructure: inventory it, patch it, isolate it and vet every skill. A clean CVE list does not make an OpenClaw deployment safe.