OpenClaw security guide

OpenClaw security: what went wrong in 2026 and how to harden your agent

Q: How do I check my OpenClaw installation?

Update to the current release, run openclaw security audit --deep, review which skills are installed and which tools they can use, and confirm the gateway is not reachable from the internet.

OpenClaw gives an AI agent your messages, your files and a shell, which is what makes it useful and what made it 2026's most visible AI agent security story: a one-click token theft bug, hundreds of malicious skills on ClawHub, and gateways left open on the internet. This guide covers what happened, how to harden an installation, and how to keep untrusted pages and files away from the agent.

Updated October 22, 2026

Download Veridicus Scan Read OpenClaw security docs

OpenClaw security in 2026

The incidents that shaped OpenClaw security

Three kinds of problems account for most OpenClaw security news this year. None of them needs a sophisticated attacker: each one turns a convenience into access.

CVE-2026-25253: one-click token theft

The Control UI accepted a gatewayUrl from the address bar and connected to it automatically, sending the gateway token along. One click on a crafted link let an attacker take over the gateway, even one listening only on localhost. Versions up to 2026.1.28 are affected; 2026.1.29 fixes it (GitHub advisory).

ClawHavoc: malicious skills on ClawHub

In February 2026 Koi Security audited all 2,857 ClawHub skills and found 341 malicious ones, 335 from a single campaign. Most told users to install a fake "prerequisite", which ran a script that installed the Atomic macOS Stealer (The Hacker News). It is the ClickFix pattern applied to agent add-ons.

Gateways exposed to the internet

Security firms repeatedly found OpenClaw gateways reachable from the internet, some leaking API keys and chat history (Immersive Labs). A gateway that anyone can reach turns every other weakness into a remote one.

Short answer

Is OpenClaw safe to use?

It can be run safely, but not with the defaults many people used in early 2026. Keep it updated, keep the gateway on your own machine or behind authentication, give the agent only the tools a task needs, treat skills as untrusted code, and assume that any page, email or document the agent reads may contain instructions meant for it. The last point is the one updates cannot fix: it is indirect prompt injection, and it applies to every tool-using agent.

The actual risk model

The sender is not the only threat surface. The content itself is a threat surface.

If OpenClaw can read a page, document, attachment, or pasted block of text, then that content can attempt to steer the model. Once tools are available, the problem moves from “bad text” to “bad text with agency.”

Inbound message

Who can trigger the bot

Pairing, allowlists, and mention gating reduce who gets to talk to the agent in the first place.

External content

What the agent is asked to read

Fetched pages, suspicious files, and pasted instructions can all carry adversarial content even when the human sender is trusted.

Tool blast radius

What the agent can do after it reads it

The wider the tool surface, the more damaging a successful prompt-injection path becomes.

Why Veridicus Scan belongs in the loop

Put Veridicus Scan in front of OpenClaw, not beside it.

Veridicus Scan is not a replacement for OpenClaw’s own security controls. It is the product that gives you a local review step before those controls ever need to react. Scan the content, read the report, then decide whether it should enter the OpenClaw workflow at all.

Scan first

Check suspicious HTTPS pages before they are fetched or pasted into the agent flow
Inspect PDFs, DOCX files, and HTML files before upload or sharing
Review redirect boundaries, hidden channels, metadata, and parser-visible drift

Decide second

Read the risk score, findings, guidance, and coverage notes
Use the report to decide whether the content should be trusted, edited, or blocked
Export a PDF or JSON report when the decision needs to be shared

Only then feed the agent

Pass only the content you mean to trust into OpenClaw
Keep broad tool access off unless the agent genuinely needs it
Use the local MCP path for tighter automation only when you need it

Get Veridicus Scan See what the app covers

Hardening checklist

Use OpenClaw’s security model and add a scan step before risky content enters the system.

OpenClaw already documents the hardening basics. The gap is usually at the content boundary, which is why the pre-scan step matters so much when web and file inputs are involved.

Lock down who can trigger the bot

Keep DMs paired or allowlisted, and prefer mention gating instead of always-on group behavior.

Keep high-risk tools narrow

Do not expose exec, browser, web_fetch, or web_search broadly if the agent reads untrusted content.

Use sandboxing and the security audit

Run openclaw security audit --deep and keep sandboxing on where the model can otherwise reach sensitive local tools or files.

Scan URLs and files before they enter the workflow

Use Veridicus Scan on suspicious pages and documents before they become prompt context, uploaded content, or agent-readable attachments.

Stay on a patched release and keep the gateway private

Update past 2026.1.29 at minimum, bind the gateway to localhost or put it behind authentication, and do not open links to your Control UI from messages or web pages.

Treat skills as code you are about to run

Install skills only from authors you trust, read what they ask you to install, and never paste a command from a skill's description. A "prerequisite" you must paste into Terminal is the ClawHavoc lure.

What to scan first

The highest-value OpenClaw inputs to inspect before the agent sees them.

This list stays grounded in the actual Veridicus Scan surface. The app is strongest when you use it on web pages and documents before they cross the agent boundary.

Suspicious URLs

Use strict redirect handling when the destination boundary matters and you do not want a tool-enabled flow to follow the wrong page.

PDF, DOCX, and HTML files

Inspect hidden styles, metadata anomalies, parser-visible content, and export a report before the file is uploaded into an agent workflow.

Local automation paths

If you need repeatable local workflows, use Veridicus Scan’s premium MCP path as the scan step rather than letting unreviewed content jump straight into agent execution.

FAQ

OpenClaw security questions

What is CVE-2026-25253?

A high-severity OpenClaw vulnerability: the Control UI took a gateway address from the link you opened and sent your gateway token to it, giving the attacker control of the gateway. It affects versions up to 2026.1.28 and is fixed in 2026.1.29.

What were the malicious ClawHub skills?

Skills uploaded to ClawHub that posed as useful tools but told users to install a fake prerequisite, which installed information-stealing malware. Koi Security found 341 of them in February 2026, most from a campaign called ClawHavoc.

How do I check my OpenClaw installation?

Update to the current release, run openclaw security audit --deep, review which skills are installed and which tools they can use, and confirm the gateway is not reachable from the internet.

Can OpenClaw be prompt-injected?

Yes. Any agent that reads web pages, emails or documents can meet text written to instruct it. Limit the tools it can use, require approval for commands, and check suspicious content before the agent reads it.

Build the safer stack

Set up OpenClaw, then add Veridicus Scan at the content boundary.

Use OpenClaw for the agent runtime and Veridicus Scan for the intake decision whenever URLs, documents, or pasted material should be treated as untrusted.

Download Veridicus Scan Read the macOS setup guide