OpenClaw exposures expose the identity gap in agentic AI security

At a glance

What this is: SecurityScorecard’s STRIKE research says exposed OpenClaw deployments create a practical identity and access problem, with tens of thousands of instances found and 35.4% flagged vulnerable.

Why it matters: IAM, PAM, and NHI teams need to treat agentic tools as additional identities with real privilege, because exposed access can become infrastructure abuse before anyone notices.

By the numbers:

• 35.4% of observed OpenClaw deployments were flagged as vulnerable at time of writing.

Context

OpenClaw exposures matter because they turn an agentic AI deployment into an identity and access problem before they become a model or autonomy problem. When a tool can act across email, APIs, cloud services, and internal resources, any exposed interface inherits the privilege of that environment.

SecurityScorecard’s research frames the issue clearly: the immediate risk is not that agents think independently, but that they are deployed with reachable infrastructure and broad permissions. That is a familiar failure mode for IAM and NHI governance, now expressed through agentic software that can move faster than review cycles.

For practitioners, the central question is how much authority an agent holds at the point of exposure. If a compromised deployment can read secrets, modify files, or invoke connected services, the blast radius is determined by identity design, not by the label attached to the tool.

Key questions

Q: What breaks when AI agents are given broad inherited permissions?

A: Broad inherited permissions break the assumption that access is tied to a narrow business need. The result is larger blast radius, weaker accountability, and faster propagation of mistakes or abuse across connected systems. A single compromised or misconfigured agent can then touch far more data and workflows than the original task required.

Q: Why do exposed agentic AI deployments create more risk than ordinary web services?

A: They create more risk because the service is not just serving traffic, it is acting across systems on behalf of users or workflows. That means an attacker can pivot from one weakness into email, cloud, internal tools, and data access in a single compromise. The exposure surface is identity plus infrastructure, not code alone.

Q: How do security teams know whether an agent gateway is overexposed?

A: Look for methods that reveal configuration, session content, or connected infrastructure from the same control plane that processes user commands. If a single unauthenticated or weakly authenticated route can expose keys, history, or node maps, the gateway is overexposed. Logging should also show whether clients can probe version boundaries, impersonate roles, or enumerate methods without being blocked.

Q: Should organisations treat AI as an application or as an identity?

A: Treat it as an identity when the AI can access data, invoke tools, or participate in workflows that affect business systems. That framing makes least privilege, just-in-time access, and lifecycle governance relevant. If you keep treating it only as an application, you will miss the access and delegation behaviours that actually create risk.

Technical breakdown

Why exposed agentic deployments become identity gateways

OpenClaw-style systems are not just applications with an API surface. They are execution layers that can receive instructions, interact with services, and act on behalf of a user or workflow. If the deployment is reachable and misconfigured, an attacker does not need to compromise every downstream system. One exposed service with legitimate permissions can become the entry point to email, cloud consoles, internal resources, and automation paths. That is why the security question is identity scope, not only network exposure.

Practical implication: Treat each deployed agent as an access-bearing identity and inventory where it can reach before allowing production connectivity.

How remote code execution turns agent access into operational control

Remote code execution on an exposed agentic service is more than a server compromise. In this context, RCE can let an attacker issue commands in the same execution environment that already holds credentials, session state, or integration tokens. The attacker then inherits whatever authority the agent has been granted. If that authority includes cloud actions, file changes, or service calls, the compromise becomes an operational pivot rather than a single-host incident.

Practical implication: Assume any RCE on an agent host can inherit identity context and isolate agent runtimes from sensitive credentials and control planes.

Why broad permissions turn agent misuse into lateral movement

Agentic tools are designed to cross systems, which means broad permissions are inherently dangerous when trust breaks. If the agent can modify infrastructure, respond to messages, and call APIs, an attacker can use the same pathways to blend into normal activity. That creates a subtle version of lateral movement: the adversary is not forcing a new path through the network so much as using an already-authorised path that was never scoped tightly enough for abuse resistance.

Practical implication: Limit the agent’s reachable systems and remove unused privileges so legitimate workflows cannot become abuse paths.

Threat narrative

Attacker objective: The attacker wants a single exposed agentic service that already holds usable authority, then uses it to control infrastructure and abuse connected systems.

1. Entry occurs through exposed OpenClaw instances that attackers can discover at scale and reach over the public internet.
2. Credential or execution abuse follows when a malicious request triggers remote code execution inside an agent environment that already has access.
3. Escalation happens as the attacker inherits the agent’s permissions to email, APIs, cloud services, and internal resources.
4. Impact follows through infrastructure misuse, botnet creation, cryptocurrency mining, or broader data access using the agent’s legitimate authority.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic exposure is an identity design problem before it is an AI problem: The article shows that OpenClaw risk comes from reachable services with real authority, not from autonomy narratives. That means the security boundary is where the agent can act, what it can reach, and how much privilege it carries. Practitioners should read this as a governance failure in exposed access, not as a debate about model intelligence.

Ephemeral tool behaviour does not remove the need for lifecycle control: When an agent can deploy services, modify files, and call APIs, its privileges behave like any other non-human identity lifecycle. The problem is that many programmes still treat the agent as software, not as an identity subject that can be inventoried, constrained, and revoked. The practical consequence is that access assumptions outlive the deployment review that should have limited them.

Identity blast radius is now the primary security variable: SecurityScorecard’s findings reinforce that an exposed agent becomes more dangerous in proportion to the permissions already attached to it. A narrow runtime can still be abused, but broad permissions let one compromise spread across cloud, messaging, and internal control planes. The field should stop measuring agent risk only by exposure count and start measuring how far one compromised identity can move.

OpenClaw illustrates the decline of implicit trust in agentic systems: Traditional security models assume a service can be reached, reviewed, and corrected before abuse becomes systemic. That assumption fails when agentic tools are adopted quickly, exposed publicly, and left with broad integration rights. The implication is that agent identity, isolation, and permission boundaries must be treated as first-order controls, not post-deployment hardening.

Named concept, identity blast radius: This is the distance an attacker can travel once an agentic service is compromised, measured by the number of systems, credentials, and workflows already inside the agent’s authority. The article shows that blast radius is what determines whether exposure becomes inconvenience or operational damage. Practitioners should govern agents by the blast radius they create, not by the novelty of the interface.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Identity blast radius is becoming the practical unit of agent risk: security teams should evaluate exposed agentic systems by how far one compromise can travel through connected services, not just by whether the tool is reachable. The control question is whether the agent can touch email, cloud services, or internal resources that should never share the same trust boundary.

OpenClaw-style deployments expose a broader governance gap in how organisations classify non-human actors. If a system can modify infrastructure and call APIs on behalf of users, the environment is already depending on identity controls that were built for bounded services, not for semi-autonomous workflows.

The growth signal matters as much as the vulnerability itself. Security leaders increasingly expect AI to run major portions of infrastructure autonomously within three years, and that shift means agent access design, isolation, and revocation will move from edge cases to baseline operational requirements according to the 2026 Infrastructure Identity Survey

For practitioners

• Inventory every exposed agentic deployment Track where OpenClaw or similar tools are running, what interfaces are public, and which teams own the deployment. Include third-party and developer-managed instances that may sit outside formal review.
• Reduce agent privilege to the minimum viable scope Strip email, API, cloud, and file permissions that are not required for the specific task set. Review whether the agent can modify infrastructure or reach internal resources that are not essential to its function.
• Isolate agent runtimes from sensitive credentials Run agents in segmented environments so a compromise does not immediately expose secrets, tokens, or control-plane access. Use network segmentation and separate execution boundaries to contain misuse.
• Treat agent exposure as a revocation trigger If an exposed deployment is found vulnerable, remove access paths before expanding use. Revoke or rotate the credentials and integrations attached to the agent, then reassess whether the workflow belongs in production at all.

Key takeaways

• Exposed agentic AI deployments create an identity and access problem because they inherit whatever permissions the agent already has.
• The article’s evidence points to scale and urgency, with more than 40,000 exposed instances found in the first 24 hours and 35.4% flagged vulnerable.
• Containment depends on scope reduction, segmentation, and revocation, not on assuming an AI label makes the deployment safer.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Remote Code Exploit: A remote code exploit is an attack path that can be triggered over the network without local access to the target device. In this article, the emphasis is not code execution but the ease of exploiting a remotely reachable authentication flaw to gain unauthorized access.
• Privilege Scope: Privilege scope is the set of actions, data, and tools an identity is allowed to use. For AI agents, scope must be defined around the task and the acceptable blast radius, because broad or persistent privileges can turn a small mistake into a production-level incident.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.