OpenClaw security risks: are your agent identity controls keeping up?

TL;DR: OpenClaw combines persistent memory, shell access, third-party skills, and messaging integrations, creating a broad attack surface where prompt injection, malicious marketplace packages, exposed instances, and authentication bypasses can yield real system control, according to Akto. Existing security models assume software follows human-initiated decisions, but agentic workflows violate that premise and require continuous discovery, runtime guardrails, and posture management.

NHIMG editorial — based on content published by Akto: OpenClaw AI Agent Security Risks: Technical Deep Dive and Modern Defenses

By the numbers:

• A preliminary audit revealed 341 malicious skills that were part of a single coordinated operation, while the follow-on analysis revealed a small number of publisher accounts responsible for more than 1,100 malicious packages on ClawHub.

Questions worth separating out

Q: What breaks when an autonomous assistant can read untrusted content and execute tools in the same session?

A: The separation between input handling and execution breaks down.

Q: Why do AI agents create new risk in non-human identity management?

A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.

Q: What do security teams get wrong about skill marketplaces?

A: They often treat marketplaces as convenience layers rather than supply chain entry points.

Practitioner guidance

• Map agent permissions to identity ownership Inventory every OpenClaw-style deployment, its operators, the accounts it can use, and the tools it can call.
• Block untrusted content from executable context Separate email, document, and web content from the instructions the agent is allowed to execute.
• Treat skills as third-party code with access risk Approve marketplace skills through the same review path you would use for external software, including payload inspection, publisher trust checks, and least-privilege scoping for credentials and data.

What's in the full article

Akto's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step explanation of how OpenClaw's permission scopes, child sessions, and shared state can widen blast radius
• Detailed examples of the malicious skill patterns used in ClawHub supply chain abuse and how they were disguised
• Specific vulnerability notes for the exposed instance and authentication bypass issues, including CVE references
• Hands-on hardening guidance for binding the agent to localhost, restricting network access, and narrowing tokens

👉 Read Akto's analysis of OpenClaw agent security risks and defenses →

OpenClaw security risks: are your agent identity controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →