Is OpenClaw Safe? The Complete Security Guide for...
Originally published on Remote OpenClaw.
OpenClaw is one of the most powerful open-source AI agent platforms available. It lets you run autonomous assistants that can read your files, execute terminal commands, send emails, and interact with dozens of services — all from your own hardware.
That power is exactly the problem.
If you're running OpenClaw with default settings, your AI agent has the same permissions as your user account. Every file it can read, an attacker who compromises it can read too. Every command it can run, a malicious skill can run silently in the background.
Marketplace
Free skills and AI personas for OpenClaw — browse the marketplace.
Join the Community
Join 1k+ OpenClaw operators sharing deployment guides, security configs, and workflow automations.
What Does a Default OpenClaw Install Actually Look Like From a Security Perspective?
Out of the box, OpenClaw runs with the same permissions as your user account — full file system access, unrestricted terminal execution, no network policies, and every skill runs with complete trust.
Default OpenClaw Behavior
Security Implication
Runs as your user account
Full access to all user-owned files and credentials
Unrestricted terminal execution
Arbitrary command execution, including destructive operations
No network policy
Outbound exfiltration to any endpoint, no deny-by-default
No file system isolation
Agent can read SSH keys, .env files, browser credential stores
Skills from Claw Hub run with full trust
Malicious skills inherit all of the above permissions
What Actually Happened During the Claw Hub Marketplace Breach?
A coordinated supply-chain attack on the Claw Hub Marketplace saw 354 compromised skills uploaded as trojanized forks of popular tools, silently stealing API keys, browser credentials, and crypto wallets from hundreds of self-hosters.
- 1 in 5 skills on Claw Hub were confirmed malicious — designed to steal data
- 354 compromised skills were identified as part of a single coordinated campaign
- The malicious skills targeted API keys, browser credentials, and crypto wallets
How It Worked
- Trojanized skills were uploaded as forks or "improved versions" of popular legitimate skills.
- The malicious payload was buried in setup scripts, dependency installs, or obfuscated helper functions.
- On installation, the skills executed silently — scanning for .env files, SSH keys, browser credential stores, and cryptocurrency wallet files.
- Exfiltration happened over standard HTTPS to attacker-controlled endpoints.
- Persistence mechanisms were installed — cron jobs, modified shell profiles, and background processes that continued harvesting after the skill was removed.
How Did the Web Vulnerability Allow Remote Takeover?
A critical flaw in OpenClaw's local API server allowed malicious web pages to send authenticated commands to your running instance — visiting a single crafted link while OpenClaw was running gave attackers full control with no user interaction required.
The vulnerability exploited the way OpenClaw's local API server handled cross-origin requests. An attacker could craft a web page that, when visited by anyone running OpenClaw locally, would detect the running instance, send authenticated API calls bypassing origin checks, and execute arbitrary commands with full user permissions.
The vulnerability was patched, but it highlighted a critical architectural gap: OpenClaw was never designed with a hostile network environment in mind.
How Do You Harden a Bare OpenClaw Install?
If you're staying on OpenClaw, reduce your attack surface by running on a dedicated machine, creating a restricted user account, locking down outbound network access, auditing every skill, and rotating API keys on a 30-day cycle.
1. Run on a Dedicated Machine or VM
Never run OpenClaw on your primary workstation. Use a dedicated machine, a VM, or at minimum a separate user account.
2. Create a Separate User Account
sudo useradd -m -s /bin/bash openclaw
sudo chmod 700 /home/openclaw
3. Lock Down the Network with Firewall Rules
# Allow only OpenAI API and deny everything else outbound
sudo iptables -A OUTPUT -m owner --uid-owner openclaw -d api.openai.com -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner openclaw -j DROP
4. Rotate API Keys Regularly
Set a calendar reminder. Rotate every API key on a 30-day cycle minimum.
5. Audit Every Skill Before Installing
Read the source code. Look for outbound network calls, file system reads outside the working directory, shell command execution, obfuscated code blocks, and Base64-encoded strings.
6. Disable Unused Integrations
Every active integration is another attack surface.
7. Monitor Agent Activity Logs
Look for commands you didn't initiate, file access outside normal patterns, and network connections to unexpected destinations.
8. Keep OpenClaw Updated
The web vulnerability was patched quickly, but only users who updated promptly were protected.
Marketplace
Free skills and AI personas for OpenClaw — browse the marketplace.
Key numbers to know
Need the faster audit path? Read the State of OpenClaw Security 2026 for the summary, then run the Security Checker to score your deployment against the live framework.
What Does NemoClaw Add for Security?
NVIDIA built NemoClaw specifically to address OpenClaw's security gaps — adding file system isolation to /sandbox and /tmp only, YAML-based deny-by-default network policies, a PII-stripping privacy router, and a full audit trail with action attribution.
Feature
OpenClaw (Default)
NemoClaw
File system access
Full user permissions
Isolated to /sandbox and /tmp only
Network policy
Unrestricted outbound
YAML whitelist, deny-by-default
PII protection
None
Privacy router strips PII from LLM calls
Audit trail
Basic logs
Full audit trail with action attribution
Skill sandboxing
None
Containerized execution environment
Network Policy Example
network_policy:
default: deny
allow:
- endpoint: api.openai.com
ports: [443]
- endpoint: api.github.com
ports: [443]
How Does NanoClaw Compare to NemoClaw for Security?
NanoClaw uses OS-level container isolation to sandbox the entire agent runtime — the agent physically cannot reach anything outside the container's boundaries, offering stronger isolation than NemoClaw's application-level controls but with less granularity.
Aspect
NemoClaw
NanoClaw
Isolation method
Application-level controls
OS-level containers
Granularity
Fine-grained per-action policies
Coarse container boundaries
Performance overhead
Minimal
Moderate (container overhead)
PII protection
Built-in privacy router
Requires additional tooling
Audit detail
Per-action attribution
Container-level logging
What Is the 10-Point Security Hardening Checklist for OpenClaw?
The critical actions are: run on a dedicated machine, create a restricted user, configure firewall rules, and audit every skill. High-priority items include API key rotation, disabling unused integrations, reviewing logs, and keeping OpenClaw updated.
#
Action
Priority
1
Run OpenClaw on a dedicated machine or VM — never your primary workstation
Critical
2
Create a dedicated user account with minimal file system permissions
Critical
3
Configure firewall rules to restrict outbound network access
Critical
4
Audit every Claw Hub skill's source code before installation
Critical
5
Rotate all API keys on a 30-day cycle
High
6
Disable all unused integrations (email, calendar, browser)
High
7
Enable and regularly review activity logs
High
8
Keep OpenClaw updated to the latest patched version
High
9
Use NemoClaw's network policy engine or equivalent firewall rules
Recommended
10
Consider migrating to NemoClaw or NanoClaw for built-in isolation
Recommended
Should You Still Use OpenClaw in 2026?
Yes, with serious caveats — OpenClaw remains the most flexible open-source AI agent platform, but running it with default settings is irresponsible. Follow the hardening checklist, or migrate to NemoClaw or NanoClaw for built-in isolation.
If you want maximum security with minimal effort: Migrate to NemoClaw. The deny-by-default network policy alone eliminates the most dangerous attack vectors.
If you want hard isolation guarantees: Use NanoClaw. OS-level containers provide the strongest boundary.
If you want to stay on OpenClaw: Follow every step in the hardening checklist. Run on a dedicated machine. Lock down the network. Audit your skills. Accept that you're taking on additional risk in exchange for flexibility.
Frequently Asked Questions
Can OpenClaw access my passwords and saved credentials?
Yes, by default. OpenClaw runs with your user account's permissions, which means it can read browser credential stores, SSH keys, .env files, and any other credentials stored on your system.
What was the Claw Hub incident?
A coordinated supply-chain attack where 354 compromised skills were uploaded as part of a single campaign. One in five skills on the platform were confirmed malicious, stealing API keys, browser credentials, and cryptocurrency wallet files.
Has the Claw Hub Marketplace been fixed?
Claw Hub was audited and relaunched with a skill signing and verification system. However, the fundamental issue — that OpenClaw skills run with unrestricted permissions — hasn't changed in core OpenClaw.
What is the web vulnerability that allowed remote takeover?
A critical flaw in OpenClaw's local API server allowed malicious web pages to send authenticated commands to a user's OpenClaw instance. Simply visiting a crafted web page while OpenClaw was running could give an attacker full control. The vulnerability has been patched.
Is NemoClaw a fork of OpenClaw?
No. NemoClaw is a separate platform built by NVIDIA designed from the ground up to address OpenClaw's security gaps. It maintains compatibility with most OpenClaw skills but adds file system isolation, a network policy engine, a privacy router, and a full audit trail.
How is NanoClaw different from NemoClaw?
NanoClaw uses OS-level container isolation — running the entire agent inside a sandboxed container that physically cannot access the host system. NemoClaw uses application-level controls with more granular policies. NanoClaw offers stronger isolation; NemoClaw offers finer-grained control and built-in PII protection.
Can I use OpenClaw safely for business or client work?
Only with significant hardening. At minimum, run it on a dedicated machine, use a restricted user account, lock down the network, and audit all skills. For businesses handling sensitive client data, NemoClaw or NanoClaw is the more responsible choice.
How often should I rotate API keys used by OpenClaw?
At minimum every 30 days. If you suspect any compromise, rotate immediately. Use environment variables rather than hardcoded values, and consider a secrets manager for production deployments.
Does OpenClaw have any built-in security features?
Yes. OpenClaw includes device pairing, gateway token authentication, and per-assistant data isolation. These are helpful but insufficient on their own given the agent's unrestricted system permissions.
What should I do right now if I'm running OpenClaw with default settings?
Immediately: update to the latest version. Today: create a dedicated user account with restricted permissions. This week: configure firewall rules, audit your installed skills, and rotate all API keys. This month: evaluate migrating to NemoClaw or NanoClaw.
Last updated: March 2026