OpenClaw Security: Why I Won’t Be Trialling It (And What You Need to Know About Agentic AI Risk)

A couple of weeks ago I wrote a post comparing Base44 and OpenClaw — why I use Base44 and where OpenClaw makes sense for different types of operators.

After I published it I kept digging.

And the more I read, the more I felt like the security side of this story deserved its own post. Not a footnote. A proper look.

Because I’ll be honest: I was curious about OpenClaw. I considered trialling it. The appeal is real — open-source, self-hosted, fully autonomous. It does things that no other personal AI agent does quite as well.

But I won’t be trying it. Not after what I found.

This is what the research actually shows.

What OpenClaw actually is — and why security matters more here than usual

OpenClaw (previously called Clawdbot, then Moltbot after some trademark drama) is an open-source AI agent that went viral in early 2026, hitting 135,000 GitHub stars within weeks. That’s not a slow build. That’s an explosion.

And unlike most AI tools, OpenClaw doesn’t just answer questions. It does things.

It executes shell commands. It reads and writes files. It sends emails, manages your calendar, browses the web, and takes actions across your digital life — all autonomously, triggered via WhatsApp, Slack, iMessage, or Telegram.

That capability is exactly why it went viral.

It’s also exactly why the security risks are in a different category to most tools.

When an AI can act on your behalf — silently, autonomously, at scale — a misconfiguration or a compromised skill isn’t just an inconvenience. It’s a direct line into everything the agent has access to.

What actually happened: the documented incidents

I’m not speculating here. Reco’s security research — one of the more credible SaaS security firms out there — documented the timeline in detail. Here’s what happened in a matter of weeks.

January 27–29, 2026: the skills marketplace gets weaponised.

Attackers distributed 335 malicious skills through ClawHub, OpenClaw’s public skills registry. The skills looked legitimate — professional documentation, innocuous names like “solana-wallet-tracker.” Inside them: instructions to install keyloggers on Windows machines and Atomic Stealer malware on macOS.

Researchers eventually confirmed 341 malicious skills in total out of 2,857 available. That’s 12% of the entire registry. Compromised.

January 30, 2026: a quietly patched remote code execution vulnerability.

OpenClaw released version 2026.1.29, patching CVE-2026-25253 before public disclosure. The vulnerability allowed one-click remote code execution via a malicious link — exploiting the Control UI’s trust of URL parameters without validation. Attackers could hijack instances via cross-site WebSocket hijacking, including instances configured to listen only on localhost.

The attack chain takes milliseconds.

January 31, 2026: 21,639 instances exposed to the open internet.

Censys — a security scanning firm — identified over 21,000 publicly accessible OpenClaw instances. Up from approximately 1,000 just days earlier. Misconfigured instances were leaking API keys, OAuth tokens, and plaintext credentials.

Same day: the Moltbook breach.

Moltbook — a social network built for OpenClaw agents — was found to have an unsecured database. It exposed 35,000 email addresses and 1.5 million agent API tokens. The platform had 770,000 active agents at the time.

That’s not one bad week. That’s a cascade.

The real problem isn’t the software

Here’s the thing I keep coming back to.

OpenClaw’s documentation says it plainly: “There is no ‘perfectly secure’ setup.”

That’s honest. I respect it.

But it also means the security burden lands entirely on you. You are responsible for:

• Vetting every skill before you install it
• Ensuring your instance isn’t exposed to the internet
• Monitoring for credential leaks and keeping API keys rotated
• Staying on top of CVEs as they’re disclosed
• Understanding what your agent has access to and what it can do with it

Most small business owners are not doing any of that.

Not because they’re careless. Because they’re running a business. They don’t have time to be part-time security analysts on top of everything else.

And that’s the gap that makes this genuinely dangerous.

What this means for agentic AI more broadly

OpenClaw is the first high-profile example of what happens when agentic AI goes mainstream without security infrastructure to match.

Reco describes it as the first major AI agent security crisis of 2026. I think that’s right.

And it’s worth understanding why agentic AI is different to the AI tools most people are already using.

ChatGPT answers questions. Notion AI summarises documents. Those tools are passive.

Agentic AI acts. It has permissions. It makes decisions. It runs code. And if something goes wrong — a malicious skill, a compromised credential, a misconfigured endpoint — it can cause real damage before any human notices.

This isn’t a reason to avoid agentic AI. It’s a reason to be deliberate about which one you use and how it’s managed.

Where Base44 sits in this picture

I want to be honest about Base44 too. It’s not perfect.

In July 2025, Wiz Research disclosed a critical authentication vulnerability — an attacker could have accessed private apps using only a non-secret app ID. It was serious. Simple to exploit. High potential impact.

But here’s what happened next.

Wiz disclosed it responsibly. Base44 and Wix fixed it in under 24 hours. Wix confirmed there was no exploitation in the wild. Wiz independently verified the fix.

That’s the difference between a vulnerability and a crisis. Every platform will have vulnerabilities. The question is how they’re managed when they surface.

Base44 is now SOC 2 Type II and ISO 27001 certified. Those certifications mean an independent auditor has reviewed how the platform protects your data — not just a self-assessment, an actual audit.

It’s a managed platform. Your agent runs in the cloud. There’s no exposed Control UI on your laptop. No skills marketplace where 12% of the content is malware. No instance to misconfigure and leave facing the open internet.

Less control. Less risk.

For most business owners, that’s the right trade.

The honest take

I wanted to try OpenClaw. I genuinely did.

The autonomous capability is unlike anything else. The community is huge. The open-source model is philosophically appealing.

But the security record in the first weeks of its viral moment — 341 malicious skills, a one-click RCE, 21,000 exposed instances, a marketplace data breach — is not a teething issue. It’s a structural problem with putting an autonomous AI agent in the hands of people who aren’t equipped to secure it.

I’m not equipped to secure it. Most people reading this aren’t either.

And until agentic AI platforms build security in rather than bolting it on as an option, I’ll keep using tools where someone else is responsible for that layer.

That’s not laziness. That’s architecture.

Affiliate disclosure: This post contains affiliate links. If you sign up to Base44 via my link I earn a small commission at no extra cost to you. I only recommend tools I actually use.

Want help building AI into your business without the security headaches? Let’s talk →