Is OpenClaw Safe? What 138 CVEs in Eight Months Actually Tell You

No software that reads your messages and runs shell commands on your machine is unconditionally safe, and OpenClaw specifically has a rough documented history to prove it. Security researchers tracked more than a hundred CVEs against it in its first eight months, several rated critical, and Microsoft's own security team stated in February that it is not appropriate to run on a standard personal or corporate machine.

The current picture is better than that sentence makes it sound. The worst flaws are patched, current versions require authentication by default, and I found no confirmed large scale breach reported in July or August. But the track record is real, it shapes how you should run this, and almost nobody writing about OpenClaw walks through it properly.

I did, so here it is in order.

The Warning Was Always in the README

When I went through the repository for our earlier piece on what OpenClaw is, one line stood out. The project tells you outright to treat inbound messages as untrusted, and that tools run on the host by default unless you configure sandboxing.

At the time I read that as sensible caution. Having now gone through what actually happened in 2026, I read it as the most accurate sentence on the entire page.

The Timeline

I pulled every dated event I could verify into one list, worst first where it matters.

25 January. An independent audit, filed as a GitHub issue, found 512 vulnerabilities in the codebase, eight of them critical.

Among the findings: credentials stored in plaintext JSON files, authentication disabled by default, and WebSocket connections accepted with no origin check.

30 January. The project shipped version 2026.1.29, patching CVE-2026-25253, a one click remote code execution bug with a CVSS score of 8.8. The University of Toronto's security advisory is the clearest neutral account of it I found, written by people with nothing to sell.

A crafted link, clicked once, could hijack the Control UI's connection and hand an attacker the auth token.

This release also removed the option to run a gateway with no authentication at all, which closed off an entire class of the exposure problem going forward.

19 February. Microsoft's security team published a statement that it is not appropriate to run OpenClaw on a standard personal or corporate machine. That is about as blunt as a major vendor gets about a piece of open source software.

Also in February. Researchers at Kaspersky found that established credential stealing malware, RedLine and Lumma, had already added OpenClaw's file paths to their target lists. Config files, memory and chat logs were holding API keys and passwords in plain text.

29 March. CVE-2026-32922 landed, rated 9.9, close to the maximum possible severity.

A single API call could turn a pairing token into full administrative control with remote code execution attached. One security firm called it the worst vulnerability in the project's history to that point.

3 April. Researchers confirmed more than 1,400 malicious skills active on ClawHub, the community extension marketplace. This is the part that should worry you most if you plan to install anything beyond the core project, because a skill is code from a stranger running on a machine that holds your credentials.

15 May. A set of four chained flaws, nicknamed Claw Chain, allowed data theft, privilege escalation and persistence when combined. The root cause was OpenClaw trusting a client supplied flag about whether the caller was an owner, without checking it against the actual authenticated session. Fixed in version 2026.4.22.

2 July. A coordinated batch of at least fourteen further advisories landed in one day, covering authorization bypasses and marketplace payloads that had skipped security scanning entirely.

13 July. Version 2026.7.1 shipped as a genuine hardening release.

Sandbox escapes through filesystem links, closed. Credential residue sitting in audit logs, closed. Browser permissions moved behind an explicit administrator check. Marketplace submissions now get screened before download rather than after.

30 August. The project released what it is calling OpenClaw 2.0, version 2026.8.1, with a faster installer, a redesigned interface and shared cloud sessions. The Register, reviewing it the same week, flagged that the new shared session feature ships without proper network or filesystem level security boundaries.

That last line matters. Every time this project closes one gap, the surface area grows somewhere else, because new features mean new places for a boundary to be missing.

What These Bugs Actually Let Someone Do

CVE numbers do not mean much until you translate them, so I picked the worst three and wrote what they actually let someone do.

The January flaw let an attacker take over your assistant by getting you to click one link. Nothing needed to be running for you to notice. The browser handed over your token because from its perspective it looked like a normal reconnection.

The March flaw let an attacker turn a pairing token, the code your assistant uses to approve a new device, into full administrative control over the gateway. That is the equivalent of a visitor badge that can be quietly upgraded to master keys.

The April finding was not a bug in OpenClaw's code at all. It was proof that people will publish malicious extensions to a marketplace faster than the marketplace can screen them, and that some of those extensions were actively stealing cryptocurrency wallet keys according to Unit 42's analysis of the campaign.

None of these require sophistication to exploit once the method is public, and I want to be clear about that. They require someone running an old version, or someone installing a skill without checking it.

How Many Machines This Actually Touched

The exposure numbers vary across sources, and I want to show you why rather than pick the scariest one.

One tracker counted 42,665 OpenClaw instances exposed on the public internet in January 2026 alone, with 93 percent of them actively exploitable at that moment.

A later count from March put exposed instances above 135,000 across 82 countries, with 63 percent running with no authentication.

Those are not the same measurement.

The January figure is from before the patch that removed the no-auth option entirely. The March figure is after it, which means 63 percent were either still on an old version or had been reconfigured to accept weak authentication anyway.

Read the drop from 93 to 63 percent as the patch working. Read the remaining 63 percent as the size of the problem a software update alone cannot fix.

What I Would Actually Do

Four things, and the order is not arbitrary.

Update first. As of the end of August, that means running 2026.8.1, or the 2026.7.1 line at minimum if you would rather stay off a fresh major release for a week or two while early bugs shake out.

Do not stay on anything before 2026.4.22. If you are on something older than that, assume the token theft and admin escalation bugs both apply to you right now. Our install guide covers the version checks if you are unsure what you are running.

Rotate your credentials if you were ever on a vulnerable version. Not just the OpenClaw token. Anything the assistant had access to, since the July advisories specifically flagged credentials lingering in old audit logs and diagnostics as a real exposure even without confirmed exploitation.

Treat every ClawHub skill as code review, not app installation. Read the source before you run it. This was true when I wrote our install guide as general good practice. It is no longer general advice, it is a response to a documented incident where over a thousand malicious skills were live on the same marketplace.

Do not browse untrusted links in the same session as your Control UI. Use a separate browser profile for it. The January bug specifically exploited the overlap between casual browsing and an open assistant session, and that class of attack does not require a new CVE to work again with a different technique.

I would also take Microsoft's February statement seriously as a design principle rather than a one-off warning. Running this on a dedicated machine or a properly isolated container, rather than your everyday laptop, is the single change that limits the blast radius of whatever the next advisory turns out to be.

Who Is Telling You This, and Why It Matters Here

Worth being honest about the sources in this particular corner of the internet.

Some of the loudest OpenClaw security content comes from companies selling something adjacent, security scanning tools, competing agent platforms, or their own marketplace of skills.

One widely cited security roundup I read discloses upfront that its publisher builds a rival AI agent product and also sells skills on ClawHub. That is exactly the kind of conflict worth knowing before you weigh their framing.

That does not make the underlying CVE numbers wrong. A CVE with a National Vulnerability Database entry and a named researcher is a fact regardless of who is reporting it.

But the cumulative counts you will see thrown around, including the widely quoted 138 figure, come from security blogs rather than a single authoritative tally, and different trackers count differently.

Treat the named, dated, CVSS scored vulnerabilities as solid ground. Treat the round headline numbers as directionally true rather than precise.

Frequently Asked Questions

Is OpenClaw safe to use?

Current versions are meaningfully safer than early 2026 releases, with authentication now mandatory and the worst known flaws patched. It still runs with host level access by default, so safety depends heavily on staying updated, sandboxing properly, and vetting anything you install from ClawHub.

What vulnerabilities has OpenClaw had?

A documented run through 2026 including CVE-2026-25253, a one click remote code execution bug, and CVE-2026-32922, a critical flaw letting a pairing token escalate to full administrative control. Security trackers have logged more than a hundred CVEs against the project in total.

Did Microsoft say OpenClaw is unsafe?

Microsoft's security team stated in February 2026 that it is not appropriate to run OpenClaw on a standard personal or corporate machine. That was a statement about risk profile and recommended isolation, not a claim that the software cannot be used safely at all.

Are OpenClaw skills from ClawHub safe to install?

Not by default. More than 1,400 malicious skills were confirmed active on the marketplace in April 2026, some stealing cryptocurrency credentials. Read a skill's source before installing it, and avoid running unreviewed skills on a machine holding anything sensitive.

Has OpenClaw been hacked or breached?

Individual vulnerabilities have been actively exploited, including confirmed credential theft campaigns tied to malicious skills. I found no report of a single large scale coordinated breach in July or August 2026, and the project's hardening release that July closed several of the issues attackers had been using.

What OpenClaw version should I be running?

At minimum 2026.4.22, which closed the Claw Chain flaws. I would run 2026.7.1 or the newer 2026.8.1 release if you want current protections, and rotate credentials if you are updating from anything older.

Is it safe to connect OpenClaw to WhatsApp or other messaging apps?

The channel connection itself is not the main risk. The risk is what happens after a message arrives, since the project's own documentation says to treat inbound messages as untrusted and tools run on the host unless sandboxed. Pairing controls limit who can message it, but do not eliminate the underlying exposure.

Does OpenClaw store my credentials safely?

Earlier versions stored some credentials in plaintext, which malware specifically targeted. The July 2026 hardening release addressed credential residue in logs. I would still avoid storing anything highly sensitive in a system that has had this documented a history, regardless of the current state.

Where This Leaves You

The honest position is that OpenClaw today is a materially better piece of software than it was in January.

It got there by being broken in public, repeatedly, in front of researchers who published what they found.

That is not nothing. A project with no disclosed vulnerabilities is not necessarily a safer one, it may just be one nobody has looked at closely yet. OpenClaw has been looked at very closely, and it kept shipping fixes.

But the underlying deal has not changed. Self hosting an agent with shell access means you are the security team, not a vendor's SLA. If that sounds like more responsibility than you want, that is a legitimate reason to wait, run it in a locked down container, or choose a hosted alternative instead.

If you are proceeding, update before you connect anything to a live account. That single step closes more of the record above than everything else combined.

I cross checked this timeline against the project's own changelog, named CVE records, and vendor advisories. This is a fast moving security record, so check the project's current advisories before treating any version number above as still the latest.