Notifications
Clear all
Topic starter
02/08/2026 9:46 am
TL;DR: OpenClaw combines persistent memory, shell access, third-party skills, and messaging integrations, creating a broad attack surface where prompt injection, malicious marketplace packages, exposed instances, and authentication bypasses can yield real system control, according to Akto. Existing security models assume software follows human-initiated decisions, but agentic workflows violate that premise and require continuous discovery, runtime guardrails, and posture management.
NHIMG editorial — based on content published by Akto: OpenClaw AI Agent Security Risks: Technical Deep Dive and Modern Defenses
By the numbers:
- A preliminary audit revealed 341 malicious skills that were part of a single coordinated operation, while the follow-on analysis revealed a small number of publisher accounts responsible for more than 1,100 malicious packages on ClawHub.
Questions worth separating out
A: The separation between input handling and execution breaks down.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: What do security teams get wrong about skill marketplaces?
A: They often treat marketplaces as convenience layers rather than supply chain entry points.
Practitioner guidance
- Map agent permissions to identity ownership Inventory every OpenClaw-style deployment, its operators, the accounts it can use, and the tools it can call.
- Block untrusted content from executable context Separate email, document, and web content from the instructions the agent is allowed to execute.
- Treat skills as third-party code with access risk Approve marketplace skills through the same review path you would use for external software, including payload inspection, publisher trust checks, and least-privilege scoping for credentials and data.
What's in the full article
Akto's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of how OpenClaw's permission scopes, child sessions, and shared state can widen blast radius
- Detailed examples of the malicious skill patterns used in ClawHub supply chain abuse and how they were disguised
- Specific vulnerability notes for the exposed instance and authentication bypass issues, including CVE references
- Hands-on hardening guidance for binding the agent to localhost, restricting network access, and narrowing tokens
👉 Read Akto's analysis of OpenClaw agent security risks and defenses →
OpenClaw security risks: are your agent identity controls keeping up?
Explore further
02/08/2026 12:39 pm
OpenClaw exposes an identity governance gap, not just an application vulnerability set. The article makes clear that the agent can read, decide, and act across email, shell, web, and connected tools, which means its permissions behave like a non-human identity with operational authority. That shifts the governance question from isolated app hardening to lifecycle control, privilege scope, and tool trust across the whole execution chain. Practitioners should treat the agent as an identity object with measurable blast radius.
A few things that frame the scale:
- More than 40,000 instances of OpenClaw were scanned using Bitsight's technology, and 63% were found to be open to remote attack, with many being unauthenticated, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How should organisations govern exposed AI agent instances?
A: They should govern them like privileged control planes, not ordinary web apps. Any remotely reachable instance should be assumed to expose the same permissions as the owner unless strong authentication, network restriction, and scoped tool access are enforced. Exposure review must cover the control UI, token handling, and the agent's ability to run commands or access files.
👉 Read our full editorial: OpenClaw agent security risks show where identity models break
