Self-Hosting Security

OpenClaw Security Risks: RCE and Malicious Skills

By Steve Price Published: February 14, 2026 Updated: July 4, 2026 ~12 min read

OpenClaw – the self‑hosted AI agent that connects large language models to your browser, inbox and chat apps – has become one of 2026's most visible open-source AI agent projects. That growth has collided with a more practical security question: what happens when a local agent has browser, filesystem and command-line access?

Public reporting in early 2026 described a critical gateway vulnerability (CVE‑2026‑25253), scans of thousands of exposed OpenClaw-style installations, and malicious ClawHub “skills” designed to steal credentials or push users into running malware.

For anyone running OpenClaw or its forks (Clawdbot, Moltbot) on a home server, VPS or small office network – including DoVPN readers who self‑host VPNs and media stacks – this is a wake‑up call. Local does not automatically mean safe.

Why OpenClaw's attack surface is unusually broad

OpenClaw’s appeal is clear. It runs where you choose – laptop, homelab, or VPS – and connects AI models like Claude and GPT‑4 to browsers and messaging apps so agents can actually do things: fill forms, check flights, manage email, post to social feeds, and more.

OpenClaw's promise is convenient because the agent can coordinate across the same accounts and tools you already use. That is also the risk: a compromised agent can sit close to browser sessions, API keys, local files, calendars and messaging accounts.

The practical threat model

• Agent skills can include executable code, not just static prompts or harmless templates.
• Gateways exposed on public IP addresses create an internet-facing administration surface.
• Prompt injection becomes more serious when the model can use tools against your real machine.

That kind of virality is rare – and it attracted not just power users and indie hackers, but also security researchers and opportunistic attackers.

CVE‑2026‑25253: a one‑click RCE in the OpenClaw gateway

The first major red flag was a critical remote‑code‑execution (RCE) vulnerability in the OpenClaw gateway, assigned CVE‑2026‑25253.

Public security coverage describes the bug as follows:

• The flaw affects the OpenClaw gateway path and can let a malicious link or WebSocket flow expose authentication material.
• Successful exploitation can let an attacker control the privileged agent host.
• Version 2026.1.29 is described in public reporting as the first patched release for CVE‑2026‑25253.

In practice, that means an exposed OpenClaw gateway – especially one bound to a public IP without extra access controls – can be turned into a foothold for an attacker who then controls the same machine that stores your AI agent’s memory, browser sessions, and often API keys for providers like OpenAI, Anthropic or Google.

17,500+ exposed installations: what scanning revealed

Even before CVE‑2026‑25253 became public, security teams were asking a simple question: how many OpenClaw‑style agents are sitting on the public internet?

The most important figure is not a precise port count or country split; it is the scale of misconfiguration. Public reporting cited scans finding more than 17,500 vulnerable or exposed OpenClaw-style installations.

• Exposed gateways are dangerous even when the project itself is patched.
• Reverse proxies and non-default ports do not remove the need for authentication and network access control.
• A gateway running on a cloud VPS can expose API keys and browser sessions that were meant to stay local.

In other words: most OpenClaw deployments are not quietly humming away on a Raspberry Pi behind a simple home router. They are internet‑facing servers in data centres, directly accessible to anyone who can guess or scan the right port.

ClawHub malware: agent skills became a supply-chain risk

At the same time as gateway vulnerabilities were surfacing, another problem appeared in the OpenClaw ecosystem: malicious third‑party skills.

ClawHub, a marketplace designed to make it easy to install community-built OpenClaw skills, has already seen multiple malicious-skill waves. Early reporting identified at least 14 malicious skills uploaded over a short January window; later reporting described additional malicious skills, including macOS infostealers.

Key findings from that audit:

• Some malicious skills used fake setup instructions to trick users into running terminal commands.
• Some targeted browser and cryptocurrency wallet data on Windows.
• Others delivered macOS infostealers such as AMOS.
• Skills disguised as crypto tools, trading helpers or utility packages are especially risky because they ask for broad local access.

Hardening OpenClaw: concrete steps you can take today

Security teams have converged on a practical hardening checklist for OpenClaw and similar self‑hosted AI agents.

1. Patch now – and rotate secrets

• Upgrade OpenClaw to at least version 2026.1.29 or the latest release.
• Rotate all secrets: gateway tokens, provider API keys (OpenAI, Anthropic), and chat integration credentials.

2. Keep the gateway off the public internet

The single biggest risk factor is direct public exposure.

• Bind the OpenClaw gateway to localhost only (127.0.0.1) wherever possible.
• If using a reverse proxy, ensure strict access controls and IP filtering.

3. Use Zero‑Trust tunnels instead of raw port‑forwarding

If you need remote access, use secure tunnelling instead of opening firewall ports.

Option A: Tailscale

Place the OpenClaw host on a Tailscale tailnet and expose its local gateway port only on the Tailscale interface. Use ACLs to restrict access to specific trusted devices.

Option B: Cloudflare Zero Trust

Run OpenClaw behind Cloudflare Tunnel with a Zero Trust access policy that requires strong authentication (like an email OTP or SSO) before ever reaching the OpenClaw interface.

4. Lock down file permissions

• Run the gateway under a dedicated, non‑privileged OS user.
• Set strict directory permissions (700) for the ~/.openclaw configuration folder.
• Use sandboxing (containers, VMs) for browser automation tools.

Conclusion

There is real power in self‑hosted AI that can coordinate your digital life. But as with self-hosted VPNs, torrent clients or password managers, the security bar has to rise as quickly as the hype.

OpenClaw is forcing that conversation into the mainstream. The question for 2026 is whether its community – and self‑hosters more broadly – can turn this first major security shock into a better hardened, more trustworthy wave of DIY AI.

Sources and further reading

• TechRadar: OpenClaw security risks
• Tom's Hardware: malicious OpenClaw skills on ClawHub
• TechRadar: additional malicious OpenClaw skills
• TechRadar: Moltbook exposed tokens and messages