Korean IT firms ban OpenClaw AI agent over security risks
Korean IT companies Naver, Kakao and Dangun banned employees from using OpenClaw, an open-source AI agent that controls computers, citing security vulnerabilities including API key exposure and prompt injection attacks that could leak confidential business and personal data.
What happened
Naver, Kakao and Dangun announced bans on employee use of OpenClaw, an open-source AI agent that directly accesses and controls computer environments, on their corporate networks and work devices.
OpenClaw operates by directly accessing a user's computer to perform actions such as moving the mouse and typing, allowing AI to carry out tasks without human intervention.
Security vulnerabilities in OpenClaw include API keys stored in plain text and exposure to indirect prompt injection attacks that could allow the AI to extract sensitive personal or financial information.
Reported impact
Companies assessed that the AI agent could access and leak business confidential information or sensitive personal data, or cause unexpected malfunctions.
The security firm Wizz analysed that design flaws in Moltbook, an AI agent community using OpenClaw, exposed the personal information of thousands of people.
Index analysis
This was the first time domestic Korean companies publicly restricted the use of a specific AI technology since early 2025, when public institutions and companies imposed restrictions on the Chinese AI model DeepSeek due to personal data leak and cybersecurity concerns.
Samsung Electronics and SK Hynix did not issue separate notices regarding OpenClaw, as they had already prohibited external generative AI model use on their corporate networks in principle since 2023 following the ChatGPT craze, though their security teams are reportedly investigating OpenClaw use on corporate network devices.
Governance controls
Kakao announced that it would restrict OpenClaw use to protect company information assets.
China's Ministry of Industry and Information Technology issued an official warning that if OpenClaw is improperly configured, it could become a vector for cyberattacks and data leaks, and required stronger authentication and access control systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.