Open-source AI agents expose security vulnerabilities in China
Open-source AI agents such as OpenClaw are reportedly causing security breaches and financial harm in China, with users experiencing account hijacking and credit card fraud within minutes of deployment. Experts report that AI security risks have shifted from information systems to physical systems, and that existing governance frameworks focused on content safety are inadequate for managing autonomous agents integrated with enterprise systems.
What happened
Users connecting to OpenClaw experienced 139 non-legal connections and credit card fraud within 5 minutes of deployment. Cisco monitoring discovered nine security vulnerabilities in the popular skill 'What Would Elon Do' in ClawHub, OpenClaw's official skill marketplace. Koi Security audits found malicious skills in ClawHub increased from 341 in January to over 800 in March, and a United States cybersecurity company disclosed 15,200 OpenClaw framework instances with remote code execution vulnerabilities that could allow attackers to control hosts.
Reported impact
Gartner classified OpenClaw enterprise deployment as an 'unacceptable cybersecurity risk'. Experts stated AI risk has shifted from information systems to physical systems as agents integrate with office systems, ERP systems and financial systems, enabling account hijacking and supply chain attacks. Authorities report open-source models generate biochemical, radiological and nuclear hazard information at 3.5 times the rate of other models.
Index analysis
Experts noted that unlike traditional generative AI, open-source AI agents present three distinct risk characteristics: accelerated transformation of risk forms, exponential increase in risk scale, and cascading amplification of risk transmission. The technical iteration speed exceeds the formation of security policies by 18 to 24 months, creating a gap between deployment and governance.
Governance controls
Current regulations focus on content safety in information space and lack structural adaptation to autonomous agents operating in physical and social domains. Experts proposed a 'identification-warning-governance' recursive complex system governance framework including sandbox isolation, circuit breaker mechanisms, and mandatory human secondary confirmation for high-risk operations like file deletion and fund transfers.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.