Skip to main content

Security Overview

OpenClaw gives an AI agent real access to your machine and your accounts. This page covers what is safe by default, what isn't, and a baseline config to start from; Security Hardening has the full checklist. Checked against v2026.10.4 on 2026-10-18.

Start here​

1. Run the latest stable release​

openclaw --version
openclaw update
openclaw plugins update --all

openclaw update works for npm, pnpm and git installs (openclaw update). Channel plugins ship some security fixes separately, so update them too. See Known Vulnerabilities for why this matters.

2. Start from a hardened baseline​

This is upstream's "hardened baseline in 60 seconds", with the current tools.exec.mode key. It keeps the Gateway local, isolates DMs per sender, and turns off shell, file and automation tools. Re-enable tools per trusted agent from there.

~/.openclaw/openclaw.json
{
  gateway: {
    mode: "local",
    bind: "loopback",
    auth: { mode: "token", token: "${OPENCLAW_GATEWAY_TOKEN}" },
  },
  session: { dmScope: "per-channel-peer" },
  tools: {
    profile: "messaging",
    deny: ["group:automation", "group:runtime", "group:fs", "sessions_spawn", "sessions_send"],
    fs: { workspaceOnly: true },
    exec: { mode: "deny" },
    elevated: { enabled: false },
    sessions: { visibility: "agent" },
    agentToAgent: { enabled: false },
  },
  channels: {
    telegram: { dmPolicy: "pairing", groups: { "*": { requireMention: true } } },
  },
}

Set OPENCLAW_GATEWAY_TOKEN to the output of openssl rand -hex 32, or run openclaw doctor --generate-gateway-token to write a token into the config. The Gateway rejects blank and placeholder tokens at startup (network exposure).

warning

OpenClaw refuses to start on unknown config keys. Snippets that use gateway.host, channels.*.allowed_chat_ids or hands.* are invalid. Run openclaw config validate after every edit.

3. Run the audit​

openclaw security audit --deep
openclaw security audit --fix    # tightens group policies and file permissions only

The audit tells you when you have drifted from safe defaults. It is not a substitute for tool policy and sandboxing, which upstream treats as the real boundaries (SECURITY.md, openclaw security).

What is on by default​

As of v2026.10.4:

SettingDefaultSource
Gateway bindloopback on host installsnetwork exposure
Gateway bind in the Docker setuplan, port published on all host interfacesDocker networking
Gateway authRequired; fails closed with no secretnetwork exposure
DM policypairing (unknown senders get a code)access control
Group policyallowlistgroups
Host shell (tools.exec.mode)full: commands run without askingexec approvals
Sandbox (agents.defaults.sandbox.mode)offsandboxing
Session tool reachGateway-wide (tools.sessions.visibility: "all")trust model
Update checkA daily request to telemetry.openclaw.aitelemetry

The bold rows are the ones to change for most setups: publish Docker ports to loopback, turn on exec approvals and enable the sandbox.

What OpenClaw has access to​

With the defaults, the agent can:

  • Run shell commands on the Gateway host as your user, without approval
  • Read and write files your user can access (file tools can be limited to the workspace; exec can't without a sandbox)
  • Drive a browser, fill forms and fetch URLs
  • Send messages on your behalf through connected channels, including across channels
  • Make HTTP requests
  • Edit its own workspace files, including SOUL.md, AGENTS.md and MEMORY.md

Source: SECURITY.md, which says exec is host-first by default and recommends sandbox mode plus strict tool policy when you need isolation.

Trust model​

OpenClaw is built as a personal assistant for one trusted operator, possibly with many agents. It is not a multi-tenant system (trust model):

  • One trust boundary per Gateway. A single operator, or a team whose members trust each other. For people who don't trust each other, run separate Gateways, ideally under separate OS users or hosts.
  • Everyone who can message an agent shares its tools. In a shared Slack workspace, any allowed sender can steer the agent within its permissions.
  • Session ownership and operator roles are guardrails, not isolation.
  • Anyone who can edit ~/.openclaw is an operator.
  • The model is not trusted. Assume prompt injection can manipulate it. A prompt injection on its own is out of scope as a vulnerability report; a report must show a bypass of auth, tool policy, approvals or the sandbox (SECURITY.md).
  • Plugins are trusted code. They run in-process with the Gateway's privileges.

Threat model​

SurfaceRiskMitigation
Gateway portFull operator access if reached with a valid secret, or with noneLoopback bind, strong token, SSH tunnel or Tailscale Serve for remote access
Docker publishingPort exposed on every host interface; bypasses ufwPublish to 127.0.0.1:18789, DOCKER-USER rules
Reverse proxiesForwarded-header spoofinggateway.trustedProxies, overwrite X-Forwarded-For. An unconfigured same-host proxy is rejected with 403 proxy_attribution_required (since PR #1795, January 2026)
Channel messagesPrompt injection from sendersDM pairing or allowlists, mention-gated groups, contextVisibility
Host shellInjected commands run as your usertools.exec.mode: "ask" or "deny", sandbox
ClawHub skillsMalicious instructions or codeopenclaw skills verify, manual review, security.installPolicy
PluginsArbitrary code in the Gateway processInstall only what you trust, plugins.allow
CredentialsPlaintext in openclaw.json, .env, credentials/SecretRefs, openclaw secrets audit --check, 600/700 permissions
Transcripts and memoryPrivate data at rest, including secrets that tools read (unmasked from 2026.10.10; see below)Full-disk encryption, tight permissions, pruning
Browser automationSSRF into your LAN, session theftStrict-by-default browser.ssrfPolicy (allowedHostnames, blockedHostnames)
LLM providerYour prompts and tool output leave the hostChoose a provider and retention terms you accept, or a local model

Details: Security Hardening, upstream Security.

Changing in 2026.10.10 (beta)

2026.10.10-beta.1 (npm beta, 2026-10-15; not in 2026.10.4) stops masking secrets in tool arguments, tool results and .env reads before they reach the model, transcripts and the UI. Logs, support exports and telemetry stay masked. On 2026.10.4 masking is still on. Plan for it now by keeping secrets in SecretRefs, not in files the agent reads; see hardening and PR #169063.

The Prompt Injection Problem​

OpenClaw processes untrusted content (chat messages, web pages, documents, skill text) in the same model context as your instructions. Upstream wraps external content and offers controls such as contextVisibility, but the model can still be manipulated. Limit what a manipulated agent can do (prompt injection).

In February 2026, Zenity Labs demonstrated a zero-click attack chain against a default setup:

  1. Indirect prompt injection through a Google Document
  2. The agent creates a Telegram integration with an attacker-controlled bot
  3. The attacker edits SOUL.md for persistence across sessions
  4. A scheduled task re-injects instructions every 2 minutes
  5. A traditional C2 implant completes the compromise

Every step used intended capabilities. The defences that would have stopped it are the ones that limit capability: exec approvals or exec.mode: "deny", the sandbox, a messaging tool profile for agents that read documents, and allowlisted channels.

Checklist​

The canonical checklist, with a config and a reason for every item, is Security Hardening. For a twelve-line version to tick off before connecting a channel, see Choosing Your Setup.

Community security tools​

Third-party scanners and monitors are listed, unreviewed, on Ecosystem and in Skill Verification. A security tool runs with the same access as the agent, so vet it like any other skill or plugin.

For compliance questions (GDPR, SOC 2, HIPAA, analyst assessments), see Privacy & Compliance.

Security incident history​

OpenClaw's adoption (392,000+ GitHub stars as of 2026-10-18) outpaced its security work in early 2026. In late January and early February 2026, a one-click RCE (CVE-2026-25253) was patched, tens of thousands of exposed instances were found on the internet, hundreds of malicious skills were found on ClawHub, and the Moltbook breach exposed 1.5 million agent API tokens.

Since then the project has published 722 security advisories (as of 2026-10-18), 14 of them critical. The full timeline, the critical advisories and the current minimum version are on Known Vulnerabilities.

Deep dives​