Loading story…
Cloud providers began rapidly shipping OpenClaw-as-a-service deployments despite warnings that the AI agent platform is “demonstrably insecure.” OpenClaw is designed to act on users’ behalf across online services (e.g., email and calendars) by taking user credentials and executing instructions via messaging apps such as Telegram or WhatsApp; this model increases blast radius if the platform is compromised. Tencent Cloud, DigitalOcean, and Alibaba Cloud published quick-deploy options (including one-click installers and low-cost small-server templates), effectively lowering the barrier to running OpenClaw in hosted environments.
Separately, CVE-2026-24763 describes an authenticated command injection condition tied to OpenClaw’s Docker execution behavior via manipulation of the PATH environment variable, indicating a concrete exploitation avenue beyond general “insecure by design” concerns. In combination, the rapid commoditization of hosted OpenClaw deployments and the presence of a command-injection class vulnerability heighten the likelihood of real-world abuse, particularly where OpenClaw instances are granted broad credentials and automation permissions.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Trend Micro released research examining the security implications of OpenClaw and agentic assistants, adding industry analysis to concerns around the platform's risk profile. The publication marks a further technical and security-focused response to OpenClaw adoption.
Gartner issued strong guidance warning that OpenClaw poses unacceptable cybersecurity risk because of issues such as plaintext credential storage and lack of authentication by default. The firm advised enterprises to block OpenClaw traffic and downloads or restrict it to isolated nonproduction environments with disposable credentials.
Multiple providers, including Tencent Cloud, DigitalOcean, and Alibaba Cloud, introduced OpenClaw deployment options or hosted-style installation offerings. These services made it easier for users to deploy the AI agent platform in the cloud.
A CVE entry was published for CVE-2026-24763, describing an authenticated command injection issue in OpenClaw Docker execution via the PATH environment variable. The reference also notes the related repository had been linked to multiple CVEs.
The repository described as "Multi-AI documentation for OpenClaw" was created, according to the metadata shown in the reference. This is the earliest concrete event tied to the CVE-related material.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourcego.theregister.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**OpenClaw** (formerly *Clawdbot/Moltbot*) is rapidly spreading as an open-source “sovereign agent” that runs locally and can be granted high-privilege access to a user’s machine (including terminal/code execution), shifting AI from a passive chatbot to an active operator on endpoints. Trend Micro warns this model materially expands the attack surface by combining agent **access to files/commands**, **untrusted inputs** (e.g., messages/web/email), and **exfiltration paths**, and adds a fourth compounding risk—**persistence** via retained memory/state—creating conditions where prompt/instruction manipulation could translate into real system actions and data loss. Adoption is accelerating in China, where Shenzhen’s Longgang district proposed subsidies and an ecosystem to support OpenClaw-driven “one-person companies,” even as regulators and state media flag **data security and privacy** concerns tied to the tool’s ability to access personal and enterprise data. The reporting notes OpenClaw’s plug-in model support (including OpenAI, Anthropic, and Chinese model providers) and highlights official scrutiny amid China’s tightened data-privacy and export-control posture, underscoring that the primary risk is not a single vulnerability but the **operational security implications of deploying locally empowered AI agents** at scale.
Jun 29, 2026
**OpenClaw** emerged as a rapidly adopted open-source, self-hosted AI agent that runs locally, connects to messaging platforms such as WhatsApp, Telegram, Slack, Discord, and Teams, and can autonomously execute tasks including file access, browser control, API queries, scheduling, and script execution. Reporting describes its unusually fast rise in popularity, driven by persistent memory, a plugin ecosystem, and broad cross-platform integrations, while a related *PyPI* package, `openclaw-py`, advertises a Python/Flet rewrite with multi-channel gateway support, built-in tools, MCP integration, and an OpenAI-compatible API. Separate coverage also highlights how OpenClaw became a major public and policy phenomenon in China, where enthusiasm for its productivity gains was accompanied by concerns over privacy, regulation, and a fast-growing service market around installation and support. Security concerns around the OpenClaw ecosystem intensified after **Qihoo 360** reportedly bundled a live wildcard TLS private key for `*.myclaw.360.cn` inside the public installer of its OpenClaw-based AI assistant, exposing users to potential **man-in-the-middle interception, server impersonation, credential theft, and AI session hijacking** across the `myclaw.360.cn` domain space. That incident is directly tied to a customized wrapper built on top of OpenClaw and shows how the platform's rapid commercialization can introduce serious operational security failures. A separate report on a fake fitness tracker manipulating chatbot recommendations through **generative engine optimization (GEO)** is not about OpenClaw and reflects a different AI trust and content-poisoning issue.
Jun 29, 2026
Security researchers and media reports warned that the open-source AI agent **OpenClaw** (formerly *Moltbot/Clawdbot*) can be abused via its *ClawHub* “skills” ecosystem, with findings that **~7.1% of marketplace skills** contributed to exposure of **API keys, credentials, and credit card data** due to problematic `SKILL.md` instructions. Snyk highlighted a particularly severe example, **buy-anything skill v2.0.0**, which performs credit-card “tokenization” in a way that can be used to **pilfer financial details** before prompting users to provide card information. Additional research described **indirect prompt-injection** risk: a malicious Google document can coerce OpenClaw into integrating a new **Telegram bot**, enabling follow-on actions such as **file exfiltration** and deployment of a **Sliver** command-and-control beacon for persistence, with potential for **privilege escalation, lateral movement, and ransomware execution**. Separately, one report noted OpenClaw’s move to scan skills with **VirusTotal**, but also emphasized that signature-based scanning is not a complete mitigation for **prompt-injection** and other logic-level abuses; other items in the same news roundup (e.g., telecom “Salt Typhoon” oversight) were unrelated to OpenClaw’s vulnerabilities.
Jun 29, 2026