Agentic AI is reshaping enterprise operations. Unlike conversational models that respond to prompts, agentic frameworks run continuously, maintain state across sessions, invoke external tools, execute system commands, and operate autonomously, all without waiting for human instruction. This can create security risks that conventional AI governance doesn't address.
OpenClaw has become one of the most widely deployed agentic frameworks. Since its release in November 2025, it has accumulated 363,000 GitHub stars by April 2026, surpassing React and the Linux kernel in adoption velocity. Healthcare organizations, enterprise operations teams, and individual engineers have embraced it for its natural language interface and task automation capabilities.
But adoption has outpaced security. Our research uncovered 20,125 fingerprint-confirmed OpenClaw instances exposed on the public internet, with 79.67% running on cloud infrastructure. More concerning, 22% of enterprises discovered unauthorized OpenClaw deployments before their security teams were even aware they existed. This is the shadow IT problem at scale, and these unauthorized deployments grant privileges orders of magnitude higher than typical software-as-a-service (SaaS) applications.
Here's what we discovered
Our threat model analysis examined OpenClaw's attack surface across six critical dimensions: network exposure, authentication and credential storage, prompt injection behavior, Model Context Protocol (MCP) integration, supply chain risks through third-party skills, and deployment-specific vulnerabilities. The findings reveal a platform whose design amplifies the inherent risks of agentic AI rather than introducing new ones, and that amplification is severe.
Our May 2026 scan identified 30,366 candidate endpoints. DigitalOcean hosts the largest share at 27.2%, followed by Alibaba Cloud (21.2%) and Tencent (9.4%). The concentration on consumer-friendly, low-cost infrastructure suggests that most exposed instances run on individual engineer accounts, not enterprise tenants. One-click deployment templates bundled by cloud providers became vectors for accidental exposure. Many operators skipped the reverse-proxy step and left the operator dashboard directly reachable on on its CSP defined default port.
The dashboard can become the weakest link
An unauthenticated or weakly secured operator dashboard can grant full compromise. An attacker can steal the pairing token to establish a man-in-the-middle position on the large language model (LLM) connection itself, silently proxying all requests and responses. Worse, the operator panel also grants shell access. What begins as API control becomes host control. When OpenClaw runs on a cloud VPS with public IP bindings, this becomes a one-click remote code execution.
Secrets stored in plain sight
OpenClaw stores LLM API keys, messaging platform tokens, and session history in plaintext SQLite databases under `~/.openclaw/`. A compromised local process, a malicious skill, or a non-isolated MCP server can read this directory and immediately exfiltrate credentials to any external system. These are keys to LLM API accounts, enterprise messaging infrastructure, and stored conversations, not ephemeral tokens.
Threats hide where operators don't expect them
Direct prompt injection through operator-supplied content is only the beginning. OpenClaw processes external data constantly: web pages it visits, emails it reads, API responses it parses, and records it retrieves. Attackers can weaponize any of these sources to hijack the agent's goals. Guardrails behave inconsistently across different LLM providers. What a GPT-4 model rejects, a local model running through Ollama might accept.
MCP servers run with no guardrails
The MCP allows OpenClaw to invoke external services and tools, but MCP servers operate without sandboxing. This means a non-isolated MCP server inherits OpenClaw's full permissions, and can pivot laterally into backend systems if compromised. A malicious MCP server takes a different path: it poisons the responses it returns, corrupting the agent's reasoning and output without detection.
Third-party code operates without oversight
OpenClaw's skill marketplace, ClawHub, had over 1,700 community-submitted integrations by April 2026, and each can run with full agent privileges. Our scanning confirmed malicious content in the marketplace designed to exfiltrate credentials (as seen in our research on OpenClaw skills distributing the Atomic macOS stealer), with no security review being enforced before publication. The curated marketplace experience typical of consumer app stores doesn't exist here.
Convenience comes with hidden costs
AWS Lightsail, DigitalOcean, and similar providers bundle OpenClaw into templated deployments. Security posture varies by provider: some one-click deployments, like Lightsail, provide strong security settings by default, while others, like DigitalOcean, require extra steps to enforce secure settings. Either way, operators should keep the shared responsibility model in mind, since they are ultimately responsible for their deployment's security settings. Many templates still skip token authentication entirely, relying instead on the installer's initial setup. If the setup script isn't run, or if it's interrupted, the operator panel opens unauthenticated. The convenience that makes these templates attractive therefore becomes a liability when security defaults are weak.
Why this matters for organizations
Organizations operating OpenClaw internally face an attack surface spanning from the internet-exposed dashboard through credential storage, skill execution, and MCP integration. A single misconfiguration (an unintended port exposure, a weak token, a trusted skill that turns malicious) can cascade into full agent compromise and lateral movement into backend systems.
Those considering OpenClaw adoption must establish zero-trust architecture before deployment. Network segmentation, continuous monitoring for configuration drift, restricted access to the operator panel, and strict vetting of any third-party skills are prerequisites, not optional enhancements.
Enterprises in healthcare or any regulated industry face steeper stakes. Patient data transiting through an agentic AI framework with plaintext credential storage and unvetted third-party integrations creates compliance and liability exposure that security teams must understand before deployment begins.
Download the full report
Download the full report for the complete threat model, proof-of-concept findings, and practical guidance on every risk covered here.