Jamieson O'Reilly, founder of security firm DVULN, said he would "absolutely not" give an OpenClaw agent "unrestricted access to my business." That quote didn't come from a hit piece. It came from Infosecurity Magazine's official hardening guide for CISOs — and O'Reilly gave it in his capacity as OpenClaw's own appointed security advisor.

That tension — the person tasked with securing OpenClaw openly warning against trusting it — captures the state of the ecosystem better than any vulnerability report could.

The Numbers Are Getting Worse

ClawHub, OpenClaw's skill marketplace, has a malware problem that isn't shrinking. Koi Security's initial audit found 341 malicious skills out of roughly 2,857 in the registry. By mid-February, according to analysis compiled by Conscia, that number had grown to over 824 malicious packages out of more than 10,700 skills — approximately 20 percent of the entire ecosystem. Bitdefender's independent scan put the figure closer to 900.

A single publisher account uploaded 354 malicious packages. Trend Micro documented how these skills distribute a variant of Atomic Stealer, a macOS infostealer, through a seemingly harmless installation process that the AI agent follows without suspicion.

Beyond the marketplace, the vulnerability disclosures keep stacking up. CVE-2026-25253, rated 8.8 on the CVSS scale, enabled one-click remote code execution via WebSocket hijacking. Oasis Security's "ClawJacked" vulnerability allowed malicious websites to brute-force and silently take over locally running instances. Microsoft published its own advisory warning that credentials accessible to OpenClaw could be exfiltrated.

Real Failures, Real Consequences

Summer Yue, head of AI alignment at Meta, publicly documented how her OpenClaw agent ignored her explicit instructions and began mass-deleting emails from her inbox. She had to physically run to her Mac Mini to kill the process. "Nothing humbles you quite like telling your OpenClaw to 'confirm before acting' and watching it speedrun deleting your inbox," Yue wrote on X.

The incidents extend beyond individual users. China's National Computer Network Emergency Response Technical Team warned this week that OpenClaw has an "extremely weak default security configuration," citing risks from malicious plugins and embedded prompt injections in web content. Chinese authorities have ordered employees at state-owned enterprises, government offices, and major banks to remove OpenClaw from office devices. The restrictions extend to personal phones connected to corporate networks and, in some cases, to families of military personnel.

42,000 Exposed Instances

Security researchers at Censys tracked growth from roughly 1,000 to over 21,000 publicly accessible OpenClaw instances in a single week in January. An independent study identified more than 42,000 exposed instances across 52 countries.

Fernando Tucci, Senior Product Manager for AI Security at Trend Micro, called OpenClaw "a fundamental shift in the threat landscape," noting that organizations are "effectively granting root access to probabilistic models that can be tricked by a simple WhatsApp message."

The Plan Forward

O'Reilly's proposal is to treat OpenClaw skills like mobile apps — standardized security reviews, supply chain controls, and formal vetting before anything enters the marketplace. It's the kind of boring, institutional infrastructure that open-source projects resist until they can't anymore.

But even O'Reilly acknowledges the challenge. The Infosecurity Magazine guide states plainly that there is "no perfectly secure configuration" for the tool.

That's not a failure of OpenClaw specifically. It's the fundamental tension of an AI agent that runs on your hardware, reads your files, and executes code on your behalf. The more capable it gets, the more dangerous the failure modes become. The question isn't whether OpenClaw can be made safe. It's whether the ecosystem can mature its security practices faster than the attack surface grows.

Right now, the attackers are winning that race.