Tens of thousands of OpenClaw AI agents exposed to public internet through misconfiguration
Security researchers found over 40,000 instances of OpenClaw, an autonomous AI agent, exposed to the public internet through misconfiguration, with 63% vulnerable to exploitation. Major South Korean tech companies subsequently restricted the tool's use due to data security concerns, and China's industry ministry warned organizations about inadequate security settings.
What happened
SecurityScorecard found 40,214 publicly exposed instances of OpenClaw, a self-hosted open-source AI agent, on the internet, associated with 28,663 unique IP addresses.
Misconfiguration exposed the autonomous agents to potential threat actor access. SecurityScorecard correlated 549 exposed instances with prior breach activity and 1,493 with known vulnerabilities. In total, 63% of observed deployments are vulnerable, with 12,812 exposed instances exploitable via remote code execution attacks.
Reported impact
Exposed OpenClaw instances could enable threat actors to gain full access to sensitive systems the agent can interact with. Some users have leaked API keys linked to third-party services via their control panels, amplifying the impact of exposure.
Major Korean tech companies including Kakao, Naver and Karrot Market restricted or banned OpenClaw use within corporate networks due to concerns about data security and privacy. China's industry ministry identified cases of OpenClaw running with inadequate security settings and advised organizations to review their exposure.
Index analysis
Most exposures were located in China, followed by the US and Singapore. Information services was the most impacted industry, followed by technology, manufacturing and telecommunications.
OpenClaw instances face risks from remote code execution attacks and indirect prompt injection attacks, whereby threat actors send malicious instructions that the agent follows without its owner's awareness. SecurityScorecard discovered three high-severity CVEs in OpenClaw with publicly available exploit code.
Governance controls
SecurityScorecard recommended that OpenClaw users aggressively limit access, adopt a zero trust mindset, pay attention to agent logic and instructions, and be aware of prompt injection risks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.