93.4% of exposed OpenClaw instances vulnerable to auth bypass

You love OpenClaw.
We make sure it can't hurt you.

We're a small team of security researchers who do one thing: audit, harden, and monitor OpenClaw instances. You keep the most powerful AI agent ever built. We remove everything that makes it dangerous.

Book a Consult Services & Pricing ↓
48-hour turnaround on full audits
40+ checks in every assessment
We fix it — not just report it
100% money-back guarantee
341malicious ClawHub skills
42,665exposed instances
512vulns in one Kaspersky audit
26%of skills contain flaws
The situation

Cisco called it "an absolute nightmare."
Kaspersky says use a burner laptop.

OpenClaw is, by every measure, the most capable personal AI agent in existence. It reads your email, writes your code, manages your calendar, controls your browser, and runs shell commands on your machine — all autonomously, all day, all night.

It also has no meaningful security layer. ClawHub — the marketplace where you install skills — has zero vetting. A researcher found 341 malicious packages in a single week, including keyloggers, infostealers, and backdoors. A crafted WhatsApp message can hijack your agent. Your API keys sit in plaintext files the agent can read.

"If you can't understand how to run a command line, this is far too dangerous of a project for you to use safely."
— Shadow, OpenClaw Core Maintainer

The security community is unanimous: OpenClaw is incredible technology with a catastrophic security posture. CrowdStrike and Palo Alto Networks both issued advisories calling it unsuitable for corporate environments.

But you're not going to stop using it. Neither would we. So we built a practice around making it safe — one instance at a time, by hand, by people who've read the source code and track the threats daily.

Not a tool. A team.

You don't need another CLI to learn. You need someone who already knows what's wrong, can explain it clearly, and will fix it before you hang up the call. That's us.

We only do OpenClaw.

We're not a general cybersecurity consultancy. Every hour we spend is on OpenClaw's 400,000-line codebase, its skill ecosystem, its messaging bridges, its novel attack surface. Depth, not breadth.

Fix first. Invoice after.

If we find active malware or exposed credentials during your audit, we flag it and help you fix it immediately. Your safety doesn't wait for paperwork.

We publish everything we know.

Our weekly ClawHub Security Bulletin is free and public. Our detection rules are open source. We earn trust by sharing knowledge, not hoarding it.

"From a capability perspective, OpenClaw is groundbreaking. From a security perspective, it's an absolute nightmare."
Cisco AI Defense — Security Research Team, February 2026
Services

Three ways we help.
Pick the one that fits.

Every engagement includes remediation. We fix what we find — not just report it. All prices per instance unless noted.

Quick Security Scan

Don't know how exposed you are? Start here. We scan your installed skills for malware, check your config for the 20 most critical misconfigurations, and deliver a clear, prioritized report — with severity ratings and step-by-step fix instructions for everything we find.

  • Full skill-by-skill malware scan
  • Top 20 config security checks
  • Credential exposure audit
  • Network/port exposure check
  • Prioritized findings report
  • DIY fix instructions per finding
from$477
Per instance. One-time.
Book Quick Scan
Delivered within 24 hours

Full Audit & Hardening

The complete treatment. We remotely access your instance, audit every surface — skills, config, credentials, network, messaging bridges, agent memory — then harden everything to best practices. You get a clean, locked-down instance and a detailed written report of every finding and fix.

  • Everything in Quick Scan
  • 40+ security checks (full matrix)
  • Sandbox & tool permission hardening
  • DM & messaging bridge lockdown
  • Memory integrity review
  • Credential rotation guidance
  • All findings remediated (we fix it)
  • Written report with risk score
  • 30-min walkthrough call
  • 7-day follow-up support
from$887
Per instance. One-time. Includes remediation.
Book Full Audit
Delivered within 48 hours

Monthly Security Retainer

Your OpenClaw runs 24/7. Your security should too. We monitor your instance continuously, vet new skills before you install them, alert you to new threats, and re-audit monthly. Think of it as a fractional security team for your AI agent.

  • Initial full audit included
  • Monthly re-audit of all surfaces
  • New skill vetting on request
  • Real-time CVE & threat alerts
  • Config drift monitoring
  • Priority incident response
  • Quarterly posture report
  • Direct Slack/Discord channel
$447/mo
Per instance. Initial full audit included. Cancel anytime.
Book Retainer
Starts with 48-hr full audit

Also available

Emergency Incident Response

Active compromise or suspected exploitation. We respond within 4 hours. $1,500

Team / Multi-Instance

3–10 instances, unified reporting, team security policies. Custom pricing

Enterprise Shadow AI Assessment

Find every OpenClaw instance on your corporate network. Risk report + governance recommendations. Custom pricing

Secure Setup from Scratch

Haven't installed yet? We guide you through a hardened installation with vetted skills only. $549

How it works

Start to finish in 48 hours.

01 — CONSULT

20-min call

Tell us your setup — skills, integrations, what worries you. We tell you exactly what we'd check and what it costs. No pitch.

02 — ACCESS

Secure connection

Scoped, temporary, logged access. We audit the environment — never your messages, files, or accounts. Full access log provided.

03 — AUDIT & FIX

Assessment + remediation

We run our full check matrix. Critical findings (active malware, exposed keys) get fixed immediately — before we finish the audit.

04 — REPORT

Written report + call

Detailed findings, fixes applied, recommendations, risk score. 30-min walkthrough call. 7 days of follow-up support.

What we protect against

These aren't hypothetical.

Every threat below has been documented by independent security researchers in the last 60 days.

🧬

Malicious Skills

341 confirmed malicious packages. Infostealers, keyloggers, backdoors disguised as productivity tools.

ClawHavoc campaign — Koi Security
💉

Prompt Injection

One crafted message hijacks your agent. Exfiltrates SSH keys, tokens, and chat history silently.

Giskard & Kaspersky researchers
🔓

Credential Exposure

API keys in plaintext. 1,800+ instances actively leaking credentials on the open internet.

CVE-2026-25253 — CVSS 8.8
🧠

Memory Poisoning

No trust levels in agent memory. Attacker payloads persist across sessions for weeks undetected.

HiddenLayer AI Security
🌐

Network Exposure

42,665 instances visible on Shodan. Gateway bound to 0.0.0.0. Minimal or no authentication.

Dvuln / Shodan scan
👻

Agent Contagion

37,000 agents on Moltbook processing untrusted content from other agents. Prompt injection spreads virally.

Zenity Labs research
FAQ

Good questions.

How do you access my instance without seeing my private data?

Scoped, temporary access — typically read-only SSH or a screen-shared session where you watch live. We audit config files, skill manifests, network exposure, and credential storage — not your messages or personal files. Full access log provided. If you prefer, we'll guide you through running the checks yourself on a video call.

I'm technical. Why wouldn't I just do this myself?

You can — and we publish free guides to help. But we audit OpenClaw instances daily. We track ClawHub malware in real time. We know which config combinations create exploitable gaps that aren't documented anywhere. The Quick Scan ($477) gives you a prioritized report so you can fix everything yourself if you want. The Full Audit ($887) means we fix it all for you.

What if you find something critical during the audit?

We stop and fix it immediately — before finishing the full audit. Active malware, exposed credentials, and data exfiltration don't wait for a report. Included in every engagement at no extra charge.

What's the money-back guarantee?

If you're not satisfied with the quality of our work, full refund. No questions, no hoops. We've never had to issue one.

Why not just use Cisco's free scanner?

Cisco's Skill Scanner checks individual skills for known malware signatures. It doesn't audit your config, check network exposure, rotate credentials, review memory poisoning, harden messaging bridges, or fix anything. It's a useful starting point. We're what comes after.

What if OpenClaw fixes its own security?

We hope they do — we contribute upstream. But even with perfect defaults, you still need independent scanning of third-party skills, monitoring for config drift, threat intelligence, and audit evidence. WordPress got much more secure over the years. Wordfence still has 5 million active installs.

Do you work with companies?

Yes. Our Enterprise Shadow AI Assessment finds every OpenClaw instance on your network, assesses risk, and builds governance recommendations — without banning the tool. We also offer team/multi-instance audits with unified reporting and centralized security policies.

Your OpenClaw has the keys to everything.
When did you last check who else is using them?

Book consult. We'll tell you exactly what to worry about — and what not to.

Book a Consult officer@clawcap.com

Or find us in the OpenClaw Discord → @clawcop