Topic starter
02/08/2026 9:46 am
TL;DR: OpenClaw combines persistent memory, shell access, third-party skills, and messaging integrations, creating a broad attack surface where prompt injection, malicious marketplace packages, exposed instances, and authentication bypasses can yield real system control, according to Akto. Existing security models assume software follows human-initiated decisions, but agentic workflows violate that premise and require continuous discovery, runtime guardrails, and posture management.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “OpenClaw AI Agent Security Risks: Technical Deep Dive and Modern Defenses”.
By the numbers:
- 63% of the 40,000 OpenClaw instances scanned were open to remote attack, with many unauthenticated.
- A preliminary audit found 341 malicious skills in a single coordinated ClawHavoc operation.
- A follow-on analysis found more than 1,100 malicious packages on ClawHub tied to a handful of publisher accounts.
Key questions
Q: What breaks when an AI agent can turn untrusted content into privileged actions?
A: The trust boundary breaks because the agent no longer just reads external text.
Q: Why do agentic AI systems need runtime governance instead of only pre-deployment review?
A: Because their capability set changes after deployment.
Q: What are the signs that an AI agent may be running out of control?
A: Look for unusual consumption patterns rather than a single spike.
Practitioner guidance
- Constrain agent runtime exposure Bind agent services to localhost or private network paths, and remove public internet exposure unless there is a documented business need and compensating control set.
- Inventory every deployed agent and skill Continuously discover agents, MCP tools and marketplace skills across cloud infrastructure, code repositories and employee devices so shadow deployments do not bypass policy.
- Govern third-party skills as privileged code Require provenance review, permission scoping and approval before any skill or marketplace package is installed into an agent that can reach production data or systems.
Bottom line: OpenClaw turns memory, skills and shell access into a governance problem because the agent can execute actions rather than merely suggest them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:39 pm
Agentic identity models collapse when software can both decide and execute. Traditional IAM assumes an identity authenticates, then acts within a predeclared scope. OpenClaw shows that an agent can ingest instructions, select tools and carry out actions within the same runtime path, which means least privilege is no longer a static provisioning decision. The implication is that governance must move from account-centric thinking to action-centric control of agent behaviour.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams compare agentic AI controls with traditional app security controls?
A: Traditional app security focuses on code, containers and known vulnerabilities, while agentic AI control must also cover instructions, tool selection and delegated action. That means a clean static scan does not prove safety if the agent can still be manipulated into credential disclosure or unsafe execution. The governance model has to shift from software integrity alone to behavioural authority control.
👉 Read our full editorial: OpenClaw agent security risks show where identity models break