OpenClaw AI agent risks security breaches through multiple vulnerabilities
OpenClaw, an open-source AI agent tool, reportedly contains multiple critical security vulnerabilities including weak authentication, a major takeover flaw, and exposure to malicious plugin injections and prompt injection attacks. Multiple government regulators and technology companies have issued warnings and guidance restricting its deployment on systems handling sensitive data.
What happened
OpenClaw, an open-source AI agent tool developed by Austrian engineer Peter Steinberger, gained rapid popularity in early 2026 for its ability to autonomously execute complex tasks and extend capabilities through plugins. However, multiple security vulnerabilities were subsequently disclosed.
A GitHub security audit in late January 2026 identified 512 security flaws in OpenClaw, including 8 classified as critical and covering authentication and credential management. In late February, international cybersecurity researchers discovered a major vulnerability called 'ClawJacked' that allowed attackers to takeover the agent through malicious webpages to gain device access and system data; the team patched it within 24 hours. On 30 March, 360 Digital Security Group identified a high-risk vulnerability affecting over 50 countries worldwide.
Reported impact
Microsoft's security team identified two types of attack risks: malicious skill plugins and indirect prompt injection. Researchers found over 800 malicious skill plugins targeting OpenClaw on relevant platforms. Low barriers to uploading custom plugins—requiring only a non-real-name GitHub account—enable attackers to inject poisoned code allowing persistent access to victim systems.
Prompt injection poses threats of sensitive data leakage given OpenClaw's high access privileges to sensitive files and systems. Indirect injection amplifies risk as attackers need not directly interact with OpenClaw but can pollute data it reads to inject malicious commands into its decision-making process. If deployed on enterprise devices with improper configuration and weak security, OpenClaw could serve as a system 'backdoor' executing attacker commands.
Index analysis
The hierarchical architecture coupling social messaging software with automated agents and plugin systems provides flexibility and scalability but introduces multi-dimensional security risks. The system's reliance on community-provided skill plugins combined with weak code audit and signature verification creates vulnerability to code poisoning attacks.
Governance controls
On 1 April 2026, China's National Intellectual Property Administration issued a risk alert stating OpenClaw and similar tools have weak default security configurations and pose serious risks. The Dutch Data Protection Authority issued guidance in February recommending organizations not use OpenClaw on systems containing sensitive or confidential data, implement strict access controls, and cautioning against external plugins.
On 22 March, China's National Internet Emergency Center released a security usage guide for OpenClaw. Industry recommendations advise users not to run OpenClaw on regular office or classified devices; deployment requires strict controls including privilege governance, sandboxing, continuous monitoring and full-cycle security protection. Multiple companies including U.S. metaverse platforms and South Korean communications firms have banned employee use of OpenClaw on work devices.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.