Topic starter
02/08/2026 12:01 pm
TL;DR: OpenClaw’s own hardening guidance and the security research around it show that exposed instances, malicious skills, and prompt injection remain practical attack paths for AI agents running with broad user-level access, according to Aikido. The core problem is that agents must process untrusted content to be useful, so the attack surface is intrinsic rather than an edge case.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “Why Trying to Secure OpenClaw is Ridiculous”.
By the numbers:
- Security researcher Paul McCarty identified 386 malicious packages from a single threat actor.
Key questions
Q: What breaks when an AI agent can turn untrusted content into privileged actions?
A: The trust boundary breaks because the agent no longer just reads external text.
Q: Why do broad permissions make agentic AI harder to govern than ordinary automation?
A: Broad permissions turn the agent into a delegated identity that can read, decide, and act across multiple systems in one session.
Q: How do you know if an agent is operating outside its intended boundary?
A: Look for actions that cross from requested read-only work into write, share, or send behaviour without a new consent event or approval event.
Practitioner guidance
- Constrain agent tool scope Limit each agent to the smallest set of tools needed for a specific task, and remove shell execution, browser control, and web fetching unless they are genuinely required.
- Isolate agent execution environments Run agentic workflows on dedicated machines or sandboxes with read-only workspaces and no direct access to production systems or sensitive data.
- Require strong connection controls Use authentication tokens, pairing codes, and localhost binding for all agent connections so exposed network interfaces do not become an entry point.
Bottom line: OpenClaw illustrates that agentic AI security fails most sharply at runtime, where untrusted content and delegated tool use meet in the same execution path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:07 pm
Agentic AI security is becoming a governance problem before it becomes a model problem. The issue in OpenClaw is not that the model is uniquely weak, but that the system must mix untrusted content, delegated authority, and autonomous tool use in one runtime path. That combination creates a control gap that traditional application security does not cleanly address. Practitioners should treat these systems as governed actors, not just software features.
A question worth separating out:
Q: What should organisations do when an agent needs both autonomy and access to sensitive systems?
A: They should limit full autonomy and keep sensitive actions behind explicit approvals, isolated environments, or separate identities. The goal is to preserve usefulness without allowing one compromised input to reach high-risk systems. In practice, the safest pattern is partial delegation with strict containment, not unrestricted background operation.
👉 Read our full editorial: OpenClaw shows why agentic AI security collapses at runtime