Is OpenClaw Safe? A Plain-English Answer (2026)

Published 2026-10-18 · Updated 2026-10-18 · By The Is My Agent Safe team

Short answer

Not by default, and nobody can honestly promise it is. OpenClaw runs code with your API keys, inbox and files, so its risk depends on your setup. Most real incidents come from five fixable things: an exposed gateway, an old version, untrusted skills, keys left in plain text, and no spend limits.

Keep the gateway on loopback, or require a token before exposing it.
Stay on a current release: CVE-2026-25253, where a crafted link could leak your gateway token even on a loopback-only setup, was fixed in 2026.1.29.
Install only skills you've reviewed, and give each its own low-limit key.
Move keys out of openclaw.json into environment references.
Set hard monthly spend limits at every AI provider.

The fix path, step by step

Run the built-in audit
```
openclaw security audit --deep
```
Check your version
```
openclaw --version
```
Stop the gateway before changing config
```
openclaw gateway stop
```

Keep the gateway local

openclaw config set gateway.bind loopback

Require a token if you need remote access

openclaw config set gateway.auth.mode token && openclaw doctor --generate-gateway-token

Start the gateway again
```
openclaw gateway start
```

Update to the latest release

openclaw update --dry-run && openclaw update

Re-check
```
openclaw security audit --deep
```

Why there's no simple yes

OpenClaw is a personal agent that can read your messages, run tools and spend money through your AI provider accounts. That's the point of it, and it's also why the risk depends on how it's set up rather than on OpenClaw alone. Microsoft's security team put it bluntly: treat it as untrusted code execution with persistent credentials.

So the useful question isn't "is it safe?" but "what's exposed on my setup, and what do I fix first?"

The 5 things that actually get people hacked

1. A gateway anyone can reach

The gateway is the part of OpenClaw that accepts commands (default port 18789). On loopback, only your own machine can talk to it. Bound to a LAN or public address without a token or password, anyone who can reach it can drive your agent and use your keys. This is the pattern behind Hunt.io's February 2026 report of 17,500+ exposed instances.

2. An old version

As of 18 Oct 2026, OSV lists 593 published advisories across the openclaw and older clawdbot npm packages. The best known, CVE-2026-25253, let a crafted link leak your gateway token to an attacker, even on a loopback-only setup, because your own browser made the connection. It was fixed in 2026.1.29. Published fixes tell attackers exactly what to try on anything older.

3. Skills you haven't vetted

Skills are third-party code that runs with your agent's access. The ClawHavoc campaign put 341 malicious skills on ClawHub. A skill that asks for your API key, broad file access or shell access deserves a hard look before you install it.

4. Keys saved in plain text

API keys written straight into openclaw.json end up in backups, synced folders and support pastes. Anything that can read the file can copy them. Use environment references instead, and give skills their own low-limit keys.

5. No hard spend limits

OpenClaw can't stop a bill on its own. A leaked key, a runaway loop, or a heartbeat waking a premium model every few minutes can quietly run up a large invoice. Only your provider accounts can set a hard cap.

A 10-minute fix path

Run these on the machine where your agent lives. OpenClaw's docs say config set needs the gateway stopped, so stop it first and start it again after. Back up first: cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak.

openclaw security audit --deep
openclaw --version
openclaw gateway stop
openclaw config set gateway.bind loopback
openclaw config set gateway.auth.mode token
openclaw doctor --generate-gateway-token
openclaw gateway start
openclaw update --dry-run
openclaw update
openclaw security audit --deep

Then set a hard monthly limit at each AI provider your agent uses (OpenAI, Anthropic, Google, OpenRouter), not just an email alert.

What the built-in audit doesn't tell you

openclaw security audit --deep is the right starting point, but it speaks developer. It won't tell you whether you have spend limits, which of your keys a skill can read, or what will break when you upgrade. Our free check reads your audit output and adds those checks in plain English. It's look-only, and it's a point-in-time result, not a guarantee.

Frequently asked questions

Is OpenClaw safe to run on my personal computer?

It's riskier than it looks. Microsoft's guidance is to treat OpenClaw as untrusted code execution with persistent credentials, and the Dutch data protection authority warned against using it on systems with sensitive data. If you run it on your main computer, keep the gateway on loopback, avoid broad file and email access, and don't install skills you haven't reviewed.

Is OpenClaw safer on a VPS?

A separate VPS limits what a compromised agent can reach, which helps. But a VPS is on the internet by default, so a gateway bound to 0.0.0.0 without auth is worse there than on a laptop behind a home router. Use a firewall, keep port 18789 closed, and reach the agent over Tailscale or an SSH tunnel.

What happened with the 17,500 exposed OpenClaw instances?

In February 2026 Hunt.io reported finding more than 17,500 internet-exposed OpenClaw, Clawdbot and Moltbot control panels in its scans. Separately, CVE-2026-25253 (per NVD and the GitHub advisory) let a crafted link make the Control UI connect to an attacker-supplied gatewayUrl and send your gateway token, which worked even when the gateway listened only on loopback. It was fixed in 2026.1.29. Exposed and outdated gateways were the common thread.

Are ClawHub skills safe?

Not automatically. The 'ClawHavoc' campaign put 341 malicious skills on ClawHub, and security researchers have shown malicious skills slipping past screening. Treat skills as third-party code: read what they ask for, pin versions, and never hand them your main API keys.

Does `openclaw security audit` make me safe?

No single tool can promise that. The built-in audit is a good start, especially with --deep, but it reports findings in developer terms and doesn't check your provider spend limits or what changed after it ran. Run it, fix what it reports, and re-run it after every upgrade.

Is Clawdbot/Moltbot the same thing?

Yes. OpenClaw was previously published as Clawdbot and Moltbot. Advisories for the older package names apply to old installs, so check your version with openclaw --version.

Is OpenClaw Safe? A Plain-English Answer (2026)

The fix path, step by step

Why there's no simple yes

The 5 things that actually get people hacked

1. A gateway anyone can reach

2. An old version

3. Skills you haven't vetted

4. Keys saved in plain text

5. No hard spend limits

A 10-minute fix path

What the built-in audit doesn't tell you

Frequently asked questions

Sources

Get the weekly plain-English agent security brief