Financial firms deploy OpenClaw AI agents; Chinese authorities warn of security risks
Chinese financial data terminal companies Wind, Thinkorswim, and EastMoney deployed AI investment agents and tools to integrate with OpenClaw; Chinese authorities warned that OpenClaw poses significant security risks including information leakage and system compromise when lacking proper controls.
What happened
On 11 March 2026, Wind Information Technology launched WindClaw, an AI investment agent that integrates Wind's professional financial data with local deployment capability and automatic learning of user investment habits. On 12 March, Thinkorswim announced iFinD MCP, a financial data service for OpenClaw, and indicated plans to launch iFinD Claw, a custom OpenClaw variant. EastMoney also released EastMoney Skills, a package to provide OpenClaw with investment decision support capabilities.
The National Internet Emergency Center issued a risk warning on 10 March stating that OpenClaw poses security vulnerabilities including blurred trust boundaries, autonomous operation capabilities, and self-decision making. The Ministry of Industry and Information Technology warned that OpenClaw carries high security risks in default or improper configurations, which can easily lead to network attacks and information leakage.
Chinese securities firms began issuing internal compliance notices restricting OpenClaw installation and use by their staff, implementing temperature controls on the AI agent adoption trend.
Reported impact
The National Internet Emergency Center warned that OpenClaw could execute unauthorized operations causing information leakage and system compromise in the absence of effective permission controls, audit mechanisms and security hardening.
The Ministry of Industry and Information Technology cautioned that OpenClaw in default or improper configuration creates high security risk of network attacks and information leakage.
Index analysis
The incident reflects a tension between rapid AI adoption in financial services and emerging security risks associated with autonomous AI agents that lack adequate governance controls.
The regulatory warnings highlight vulnerabilities in OpenClaw's architecture including blurred trust boundaries, autonomous decision-making capabilities, and susceptibility to prompt injection and malicious takeover when deployed without proper safeguards.
Governance controls
Chinese authorities issued warnings about OpenClaw security risks, and securities firms implemented internal restrictions on OpenClaw installation and use.
Wind's WindClaw product emphasizes local data deployment for physical data isolation, and Thinkorswim's iFinD MCP includes built-in data cleaning and token optimization mechanisms.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.