Why OpenClaw's AI Agents Keep Getting Hacked (It's Not the Bugs — It's the Door)
OpenClaw has shipped more than 40 security fixes so far in 2026, and researchers are still finding tens of thousands of exposed instances months later. That's not a sign the patches failed — it's a sign the vulnerability was never really a bug.
The short version
OpenClaw's repeated security incidents in 2026 trace back to one architectural choice: its "gateway" — the local server that holds your API keys and lets you control your agent from a browser or phone — listens on network port 18789 with authentication disabled by default. Because most people deploy OpenClaw on a cloud server or VPS so it's reachable 24/7, that unauthenticated port ends up sitting on the open internet. Patching individual bugs (and OpenClaw has patched dozens) doesn't close that door; it just fixes what someone can do once they've walked through it.
What actually happened, in order
OpenClaw's 2026 security story reads less like "one bad exploit" and more like a slow-motion demonstration of the same root cause showing up again and again. Here's the timeline, pulled from security researchers' own scans and disclosures rather than secondhand summaries:
- Jan 25 — Researchers spot a spike in OpenClaw (and forks Clawdbot/Moltbot) instances indexed on Shodan. Within days, Censys counts 21,000+ publicly exposed gateways.
- Feb 2026 — SecurityScorecard's broader scan puts the number at over 135,000 exposed instances. Manual checks find live gateways leaking Anthropic API keys, Telegram bot tokens, and Slack credentials in plain sight.
- Jan 30 — OpenClaw ships version 2026.1.29, an early attempt at hardening the gateway. It doesn't close the underlying gap.
- Feb–Mar — CVE-2026-25253 ("ClawJacked") is disclosed: a CVSS-8.8 flaw where OpenClaw's browser-based Control UI blindly trusts a gateway address passed in a URL, so one click on a crafted link can leak your gateway's auth token to an attacker — who then connects to your local gateway and can execute code. 17,500+ instances are found still vulnerable to this specific bug. Fixed in 2026.2.25.
- Late Mar — A follow-up Censys scan finds 63,070 live instances still reachable from the open internet — down from February's peak, but still tens of thousands of unauthenticated agents holding real credentials.
- 2026.2.12 — OpenClaw ships a release fixing more than 40 separate security issues in one update — a sign of how much surface area the gateway-plus-marketplace design had opened up.
By mid-2026, security trackers had cataloged 138+ CVE-style disclosures against OpenClaw. That volume, on its own, tells you something: this isn't a project with one bad release. It's a design that keeps generating new ways to reach the same exposed surface.
Why patches keep needing patches
The mechanism is simple once you see it. OpenClaw's "Backend" — the process that actually holds your LLM API keys and executes tool calls — runs a local WebSocket server, by default on localhost:18789. To make an agent controllable from your phone, a browser tab on another machine, or a messaging integration, that gateway has to be reachable from somewhere other than the exact machine it's running on.
OpenClaw's own documentation and multiple independent security write-ups confirm the gateway does not ship with authentication turned on by default — no login screen, no API key check. It relies instead on the assumption that only "trusted" local traffic will ever reach it. That assumption breaks the moment someone runs OpenClaw on a cloud VPS instead of a home machine, which is exactly what most real deployments do — precisely because a cloud server, unlike a laptop, is on and reachable around the clock. Independent researchers estimate 98%+ of real-world OpenClaw deployments run on cloud or VPS infrastructure for that reason.
Put those two facts together and you get the actual failure mode: an unauthenticated control port, deliberately exposed to the internet by the deployment model itself. CVE-2026-25253 was one way to abuse that door (steal the token via a malicious link, then walk through). The 40-bug 2026.2.12 release fixed many others. But each of those is a fix for a specific way of exploiting an open door — not a fix for the door being open. That's why a version bump doesn't retire the underlying risk the way it would for, say, a single buffer-overflow bug: the gateway's default posture is what needs to change, and hardening guides still tell OpenClaw operators to manually enable auth, put the gateway behind a reverse proxy, or tunnel it through SSH themselves.
The number that matters isn't the CVE count — it's the exposure count. Even after 40+ fixes and a dedicated patch for ClawJacked, tens of thousands of instances were still found openly reachable months later. That gap between "patched" and "no longer exposed" is the real story.
What this means if you're choosing an AI agent tool
None of this is a reason to avoid AI agents generally — it's a reason to ask a more specific question than "is this safe?" The useful question is: does this tool have a network listener at all, and if so, is it authenticated by default? A few concrete ways to check any agent tool, not just OpenClaw:
- Does it run a local server or gateway? If an agent tool needs to be reachable from a phone app, a browser, or another device, something on your machine (or a cloud box) has to be listening on a port. That's not automatically bad — but it's a question worth asking directly, not assuming the answer to.
- Is authentication on by default, or something you have to turn on yourself? "Secure by default" and "secure if you configure it correctly" are very different guarantees. OpenClaw's gateway is the second kind — hardening guides exist because the out-of-the-box state isn't the safe one.
- Where does it actually run — your machine, or a rented server? A tool that's designed to run on your own desktop, on your own schedule, without needing to be "always reachable" from the outside, structurally has less to expose. There's no 24/7 uptime requirement pushing people toward cloud hosting in the first place.
- What happens if a plugin or skill is malicious? OpenClaw's separate community skill marketplace has had its own problem — roughly 12% of listed skills were found to be malicious in past audits, including some of the most-downloaded ones. A locked-down gateway doesn't protect you from that; it's a different question entirely.
How bots.team is architected differently
bots.team runs as a desktop app on your own Mac or PC. Each bot runs on your machine, on the schedule you set, and reports back inside the app — there's no gateway process listening for inbound connections from the internet, because nothing about the product needs your computer to be reachable from outside. You don't open a port to make it work, so there's no unauthenticated port to accidentally leave open. That's a structural difference, not a configuration setting someone could get wrong — the "you'd have to expose a listener for this to be a problem" scenario simply doesn't come up.
To be precise about what this claim does and doesn't cover: bots still call out to Anthropic's Claude for the actual reasoning, the same way OpenClaw calls out to whichever model provider it's configured for — that outbound connection isn't the thing at risk here. What's different is the inbound side: nothing is listening for someone else to connect in.
| Question | OpenClaw (typical deployment) | bots.team |
|---|---|---|
| Runs a network listener for remote control? | Yes — gateway on port 18789 | No inbound listener |
| Authenticated by default? | No — must be enabled manually | N/A — nothing to authenticate against |
| Typical hosting | Cloud VPS, reachable 24/7 (~98% of deployments) | Your own desktop, runs on your schedule |
| Community plugin marketplace | Yes — ~12% of past listed skills found malicious | No open plugin marketplace |
FAQ
Has OpenClaw fixed this by now?
The specific bugs, largely yes — ClawJacked (CVE-2026-25253) was patched in version 2026.2.25, and the 2026.2.12 release alone closed 40+ separate issues. What hasn't changed is the default posture: the gateway still ships without authentication turned on, and hardening it is still something an operator has to do themselves, per OpenClaw's own security guidance. That's why exposure counts (63,070 live instances as of late March) stayed high well after the highest-profile bugs were fixed.
Is this an OpenClaw-specific problem, or does it apply to any self-hosted AI agent?
It applies to any tool with the same shape: a control server designed to be reachable from outside the machine it runs on, shipped with authentication off by default. OpenClaw is the highest-profile example because of its scale, but the underlying lesson — "authenticated by default" matters more than "patched frequently" — applies to evaluating any agent framework.
Does bots.team ever send my files or screen to the cloud?
Bots call Anthropic's Claude API to do their reasoning, the same way almost every AI agent tool calls out to some model provider — so relevant context does reach that API when a bot is actively working on a task. What bots.team doesn't have is a standing, internet-reachable control server on your machine that something else could connect into between runs.
What's the one question I should ask before adopting any AI agent tool?
"Does this need to run a server that's reachable from outside my machine, and if so, is it locked down by default?" If the honest answer involves "you should enable authentication" as a setup step rather than a factory default, treat that as a real risk factor — not a minor detail.