Topic starter
06/11/2026 6:38 pm
TL;DR: OpenClaw moved from viral adoption to exposed RCE, poisoned extensions and widespread internet exposure within weeks, according to Admin By Request's analysis, illustrating how agentic AI with broad permissions turns convenience into a governance problem. Access review models break when the tool can act across systems with little friction and weak default controls.
Editorial analysis by NHI Mgmt Group, based on content published by Admin By Request: “OpenClaw Went from Viral AI Agent to Security Crisis in Just Three Weeks”.
By the numbers:
- Koi Security audited all 2,857 skills on ClawHub and found 341 malicious entries.
Key questions
Q: How should teams govern agentic access when AI systems move faster than access reviews?
A: Teams should move governance earlier in the lifecycle and treat issuance, delegation and device trust as the main control points.
Q: What makes browser-mediated local trust dangerous for agent gateways?
A: Browser-mediated local trust is dangerous for agent gateways because a browser session can be replayed, injected into, or abused to make an agent gateway treat untrusted local requests as if they came from a legitimate authenticated user.
Q: How can malicious extension marketplaces compromise AI agents?
A: Malicious extension marketplaces can compromise AI agents by distributing tampered browser extensions that steal session tokens, intercept prompts, alter tool calls, or redirect traffic through attacker-controlled code.
Practitioner guidance
- Inventory agent deployments as privileged software Find every instance of the agent or its former names on endpoints, especially systems where users can connect email, file, terminal and cloud accounts.
- Require authentication before any local gateway is reachable Block or reconfigure instances that accept privileged traffic without authentication, origin validation or rate limiting.
- Treat marketplace skills as untrusted code until verified Review extension provenance, publisher identity and requested permissions before allowing any skill to inherit the agent's access.
Bottom line: Agentic tools can become privileged identities in practice, which means their risk profile depends on how much authority they inherit and how visibly that authority is governed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
OpenClaw shows that agentic AI can fail as a governance model before it fails as software. The core issue is not only that the platform was exposed. It is that the platform's operating model assumed broad delegated authority could be made safe through light-touch trust decisions and optional hardening. Once that assumption breaks, the identity programme is dealing with an actor that behaves like software but is trusted like a user.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when their environment includes internet-exposed AI agent endpoints?
A: Treat those endpoints as part of identity and access governance, not just application hosting. Limit tool permissions, isolate secrets, monitor external reachability, and require ownership for every agent-facing service. Without that, discovery turns a convenience deployment into an open target for credential abuse or remote execution.
👉 Read our full editorial: OpenClaw exposed the trust gap in agentic AI access control