OpenClaw Security Risks: What Crypto Users Should Know

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. OpenClaw can run commands, read files and act on messages, so anything on its machine is in reach. Malicious skills, exposed gateways and token theft were reported in 2026. Keep wallet keys and exchange API keys elsewhere.

Watch: OpenClaw Security Risks: What Crypto Users Should Know 1:46

Video transcript

OpenClaw is an AI agent that acts on your own computer. Anything on that machine, including wallet keys, is within its reach.

Cisco says it can run shell commands, read and write files, control browsers, manage email, and take orders over chat apps. Sandboxing is off by default.

OpenClaw's docs say prompt injection needs no public access. A web page can tell the agent to read a wallet file and send it somewhere.

Koi Security audited 2,857 ClawHub skills and found 341 malicious ones, most from one campaign that installed Atomic Stealer on macOS.

Many posed as crypto tools, like Solana wallet trackers, Polymarket bots and lost Bitcoin finders. The stealers target exchange and wallet keys.

In January 2026, Censys found 21,639 exposed OpenClaw instances. One flaw let a crafted link steal the gateway token, opening the host to commands.

A safer setup uses a dedicated machine with no wallets, and trading keys without withdrawal rights. Turn on sandboxing, keep the gateway on loopback and stay updated.

Teams should find OpenClaw on staff machines, keep it off signing devices, vet skills, scan for exposed gateways and rotate keys agents have seen.

Guardian's Shield pentests everything you have facing the internet, around the clock. Offchain services are led by HackTricks co-founder Carlos Polop.

Read the full guide, or talk to Guardian about keeping AI agents away from your keys.

OpenClaw is an open-source AI agent that runs on your own computer. You talk to it through chat apps such as WhatsApp, Telegram, Slack and iMessage.

Peter Steinberger first launched it in November 2025. It was called Clawdbot until Anthropic's legal team asked the project to reconsider the name.

It became Moltbot in January 2026, then OpenClaw on January 29, 2026.

It is useful because it can act. For crypto users, the risk is what else sits on the same machine.

This guide gives no verdict. It sets out each documented risk with its source and date, then the settings that reduce it.

What OpenClaw Can Access

Cisco's AI security team listed what an OpenClaw agent can do on its host:

Run shell commands, read and write files, and execute scripts.
Control browsers, and manage calendars and email.
Take instructions through messaging apps such as WhatsApp and iMessage.
Keep persistent memory across sessions.

The project's README says "Tools run on the host for the main session unless you configure sandboxing." Sandboxing is off by default.

Its secrets sit on the same disk. Config, channel credentials, OAuth tokens and session transcripts live under ~/.openclaw/.

The docs warn that transcripts "can include pasted secrets, file contents, command output, and links."

In August 2026, The Register reported that values in OpenClaw 2.0's new Secret Store are not encrypted at rest. They rely on file permissions.

Prompt Injection Through Messages and Pages

OpenClaw's docs say injection does not need public access, "even if only you can message the bot." The content the agent reads is enough.

That includes web search results, browser pages, emails, documents, attachments and pasted logs or code.

Others have said the same:

Steinberger, at launch: "prompt injection is still an industry-wide unsolved problem."
Rahul Sood, in TechCrunch (January 2026): a malicious WhatsApp message could make the assistant act without its owner knowing.
Palo Alto Networks, via CNBC (February 2026): a "lethal trifecta" of private data, untrusted content and external communication.

For a crypto user, the worst case is short. A web page tells the agent to read a wallet file and send it somewhere.

Malicious Skills

Skills extend what the agent can do. Each is a folder with a SKILL.md file of instructions, shared on the ClawHub registry.

The docs are direct: "Treat third-party skills as untrusted code. Read them before enabling."

Cisco, January 28, 2026

Cisco tested a skill called "What Would Elon Do?", which had been inflated to rank first in the skill repository.

It silently ran a curl command that sent data to the author's server, and told the agent to bypass its safety guidelines.

Cisco's scanner raised nine findings, two of them critical.

ClawHavoc, February 2026

Koi Security audited 2,857 ClawHub skills and found 341 malicious ones, The Hacker News reported on February 2, 2026.

Of those, 335 belonged to one campaign, ClawHavoc. A fake "Prerequisites" step had users paste a command that installed Atomic Stealer on macOS.

Many lures were aimed at crypto users:

Solana wallet trackers
Polymarket bots
Ethereum gas trackers
"Lost Bitcoin finders"

Per OpenSourceMalware, cited in the same report, the stealers target "exchange API keys, wallet private keys, SSH credentials, and browser passwords."

At the time, anyone with a GitHub account at least a week old could publish. Steinberger then added user reports. Skills with more than three unique reports are hidden by default.

ClawHub pages now show scan results, including VirusTotal, before install. A clean scan is a signal, not a guarantee.

Exposed Gateways and Token Theft

The gateway is OpenClaw's control plane. It listens on TCP port 18789 by default.

On a regular install it binds to loopback. Container images default to an exposed bind, which the docs say to pair with authentication.

On January 31, 2026, Censys identified 21,639 exposed OpenClaw instances. Most still required a token to view and use them.

That token became the target. CVE-2026-25253, rated CVSS 8.8 in NVD, let a crafted link steal it. The Control UI trusted a gateway URL from the query string.

With the token, an attacker could switch off exec approvals and run commands on the host. It worked even when the gateway listened only on loopback.

Version 2026.1.29 fixed it on January 30, 2026. OpenClaw's GitHub advisory credits depthfirst as the reporter.

Wallet Keys on the Same Machine

Each path above ends in the same place: whatever the agent's user account can read.

On a trader's laptop, that can include:

Seed phrases and private key files
Browser wallet extensions and their stored vaults
Exchange API keys, especially with withdrawal rights
SSH keys to servers that sign or deploy
Password manager sessions and browser cookies

Sood advised against running it on a laptop that holds SSH keys, API credentials and a password manager.

TechCrunch suggested a separate computer or a rented server, with throwaway accounts.

If the agent must trade, give it an exchange key without withdrawal rights, locked to one IP address.

A hardware wallet keeps the key off the computer. Approve every transaction on the device's own screen.

Safer Configurations

For individual users

Run OpenClaw on a dedicated machine or VM with no wallets, seed phrases or signing keys.
Update to 2026.1.29 or later, and keep updating.
Turn on sandboxing. The docs start with mode: "non-main" and workspaceAccess: "none".
Keep the gateway on loopback. Never expose port 18789 to the internet.
Keep DM pairing on, and allowlist groups behind a mention gate.
Limit exec, browser, web_fetch and web_search to trusted agents or explicit allowlists.
Install only skills you have read. Never paste a terminal command a skill asks for.
Use the latest-generation, best-tier model for any agent that runs tools, as the docs advise.
Run openclaw security audit after every change.

For crypto teams

Find OpenClaw on staff machines, and treat it as a privileged application.
Keep it off devices used for multisig signing, deployments or production cloud access.
Give users who do not fully trust each other separate gateways, credentials and OS users.
Use security.installPolicy to run your own check before any skill installs.
Scan your own IP ranges for gateways exposed on port 18789.
Rotate any token or key an agent has seen.

The same discipline applies to the MCP servers an agent connects to. See our MCP pentesting checklist and the opsec guide for crypto founders and teams.

How Guardian Helps

Guardian's Managed Security includes Shield, continuous coverage of everything you have facing the internet: hosts, ports, services, storage and certificates.

Shield runs reconnaissance and penetration testing around the clock, and a Guardian researcher verifies what it finds.

Its operational security service maps every path to your funds, and the keys, signers and multisigs behind each one. Guardian reviews every multisig transaction before it is signed.

The OpSec audit maps and tests the keys, signers, privileged roles and people around your funds.

Guardian's offchain services are led by Carlos Polop, who co-founded HackTricks.

Frequently Asked Questions

Is OpenClaw safe to use with crypto wallets?

That depends on what its machine can reach. The agent runs commands and reads files, so a malicious skill or prompt injection can reach any wallet file, seed phrase or exchange key there. Keep keys on another device.

What were Clawdbot and Moltbot?

Earlier names of OpenClaw. It was called Clawdbot until Anthropic's legal team asked the project to reconsider the name, and became Moltbot in January 2026. The project announced the name OpenClaw on January 29, 2026.

Are ClawHub skills safe to install?

OpenClaw's docs say to treat them as untrusted code. Koi Security found 341 malicious skills among 2,857 on ClawHub, many posing as crypto tools, The Hacker News reported on February 2, 2026. Read each skill before enabling it.

What is CVE-2026-25253?

A token-theft flaw in OpenClaw's Control UI, rated CVSS 8.8. A crafted link could steal the gateway token, letting an attacker run commands on the host, even on loopback-only setups. Version 2026.1.29 fixed it on January 30, 2026.

Sources

Keep AI agents away from your keys

Guardian maps every path to your funds, watches what you expose to the internet and reviews every multisig transaction before it is signed.

Talk to Guardian Explore Managed Security