Loading story…
OpenClaw launched OpenClaw Enterprise (OCE), an open-source, vendor-neutral platform for centrally deploying and managing persistent AI agents in enterprise environments. Its OpenClaw Control Plane (OCC) is designed as a Kubernetes-like management layer that runs on an organization’s own Kubernetes infrastructure and governs agent deployment, isolation, permissions, credentials, configuration, and change records. Nvidia and Red Hat are among the companies supporting the enterprise push.
OCE remains pre-1.0 and is intended only for internal pilots while authentication and other security-relevant capabilities are completed. OpenClaw’s proposed security model combines workload isolation, sandboxing, granular permissions, and LLM-assisted review; CISOs evaluating the platform should treat it as an early-stage agent-management control plane and validate identity, credential handling, tenancy isolation, auditability, and policy enforcement before production deployment.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Austrian developer Peter Steinberger created OpenClaw, which later grew rapidly.
Snyk research reported that more than 280 OpenClaw and ClawHub skills exposed API keys and personally identifiable information, identifying a credential- and data-leakage risk in the skills ecosystem.
OpenAI, which initially housed the OpenClaw Enterprise effort, transferred the project to the independent OpenClaw Foundation. Red Hat and Nvidia contributed to its development, while OpenAI and Red Hat began internal testing.
OpenClaw introduced OpenClaw Enterprise, an open-source, vendor-neutral platform centered on the OpenClaw Control Plane for governing and managing persistent enterprise AI agents.
Zenity researchers demonstrated that indirect prompt injection in content processed by OpenClaw could induce it to create an attacker-controlled Telegram integration, creating a persistent external control channel. The proof of concept further used SOUL.md modification and a recurring Windows scheduled task for persistence, and showed escalation to execution of a Sliver C2 beacon on the host.
The original OpenClaw was reportedly susceptible to indirect prompt injection that could give attackers persistent control. Its central agent-customization hub had also reportedly hosted malicious payloads, prompting security concerns ahead of OpenClaw Enterprise.
OpenAI hired OpenClaw creator Peter Steinberger following the project's rapid growth.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
thenewstack.io
Open sourceopenclaw.ai
Open sourcesnyk.io
Open sourcelabs.zenity.io
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nvidia is reportedly preparing an **open-source AI agent platform**—described as a direct competitor to **OpenClaw**—and has been pitching the project (reportedly called *NemoClaw*) to potential corporate partners ahead of its upcoming developer conference. Reported companies in discussions include **Salesforce, Cisco, Google, Adobe, and CrowdStrike**, though the nature of any partnerships and associated benefits remains unclear. Separately, Minisforum announced an upcoming NAS positioned to run local LLM workloads and ship with **OpenClaw pre-installed**, highlighting growing interest in “always-on” personal/edge agent frameworks and local AI execution on consumer hardware. An unrelated Intel announcement covered **Bartlett Lake** P-core-only CPUs for embedded/edge use on **LGA 1700**, but did not address OpenClaw, Nvidia’s reported platform, or AI agent ecosystems.
Jun 29, 2026
OpenClaw released version `2026.8.1`, branded **OpenClaw 2.0**, for its open-source AI-agent automation platform. The update moves sessions and transcripts into SQLite, adds credential discovery and validation during setup, and introduces masked credential prompts, destination-restricted secret substitution, shared team credential management, and optional 1Password brokering. It also strengthens plugin provenance and capability-consent checks, session permission modes, workspace filesystem restrictions, automation approvals, model allowlists, redacted configuration history, and protections against private prompt-context disclosure. The release adds shared cloud sessions with role-based collaboration controls, although OpenClaw cautions these are not tenant isolation or a security boundary. Incognito sessions avoid standard disk transcripts and memory but remain accessible to the model provider, tools, and Gateway operator; an unencrypted transcript snapshot may also reside in the browser profile for startup performance. Operators should validate reported Gateway health because setup can finish without a reachable Gateway when service startup is skipped, and should roll out the extensive update in stages where production deployments handle credentials, plugins, integrations, or cloud workers.
Sep 3, 2026
Sophos Red Team reported that its **OpenClaw** agentic AI system successfully conducted a controlled, noisy penetration test against a legacy on-premises production network under strict safety controls. The team said it limited prompt injection, data exfiltration, and destructive behavior through tightly managed ingress and egress controls, custom in-house skills, and a lightweight human approval process rather than exposing the agent to public external skills. During the exercise, OpenClaw remained within its configured boundaries and produced a detailed audit trail that simplified reporting. The test significantly accelerated offensive security work, cutting Active Directory reconnaissance from roughly three days to three hours and generating **23 actionable findings** on the internal network. Sophos said the agent also demonstrated autonomy by proposing an alternate attack path that used an authorized EC2 GPU instance to crack a captured hash, showing how AI systems can extend operator capabilities while still requiring oversight. The company concluded that agentic AI already presents meaningful security implications and is likely to become an important tool for defenders that can deploy it safely.
Jun 29, 2026