Composite Security Score
12/100
"100K GitHub stars, 42K exposed instances, 4 models tested — all failed. The most popular agent framework is also the most dangerous."
What is OpenClaw?
OpenClaw is the most popular open-source framework for building AI agents. With over 100,000 GitHub stars, it powers thousands of production deployments — from customer service bots to autonomous coding assistants.
The framework provides tools for agent orchestration, memory management, and "skills" — modular capabilities that let agents perform actions like web browsing, code execution, and API calls. Its popularity makes it a critical piece of AI infrastructure.
ZeroLeaks tested OpenClaw deployments across 4 major LLM providers. Every model failed basic security tests. The framework's architecture provides no meaningful protection regardless of which model you choose.
| Model |
Score |
Extraction Rate |
Injection Success |
Prompt Leaked |
| Gemini 3 Pro |
2/100 |
84.6% |
91.3% (21/23) |
Turn 1 |
| Codex 5.1 Max |
4/100 |
— |
— |
— |
| Kimi K2.5 |
5/100 |
100% |
70% |
Turn 1 |
| Claude Opus 4.5 |
39/100 |
— |
— |
— |
Source: ZeroLeaks Security Assessment, January 2026 — independent third-party audit
ZeroLeaks Deep Dive: Gemini 3 Pro
Gemini 3 Pro scored the lowest at 2/100. The assessment revealed catastrophic failures across every security dimension.
System prompt extraction
84.6% (11/13)
Prompt injection success
91.3% (21/23)
Successful attack vectors
prompt injection
system prompt extraction
persona hijacking
behavioral override
canary phrase reproduction
42,000+ Exposed Instances
Security researcher Maor Dayan conducted an internet-wide scan in January 2026 and discovered 42,000+ OpenClaw instances exposed to the public internet — many with default credentials or no authentication at all.
- 42,665 instances publicly exposed
- 5,194 actively verified as vulnerable
- 93.4% of verified instances had critical auth bypass
- Potential for RCE on instances with paired companion nodes
Source: Maor Dayan, "OpenClaw in the Wild" research, January 2026
Skills Supply Chain Attack Surface
Cisco Talos analyzed the OpenClaw skills ecosystem and found significant supply chain vulnerabilities. Skills are community-contributed modules that extend agent capabilities — and they execute with full system privileges.
"We identified 847 skills in the official registry with code execution capabilities. 23% had not been audited. 12% contained hardcoded credentials. 4% had known CVEs in their dependencies."
— Cisco Talos Intelligence Group, December 2025
The skills system has no sandboxing, no permission model, and no cryptographic verification. Installing a malicious skill gives it complete access to the agent's memory, tools, and API keys.
The Lethal Trifecta
Security researcher Simon Willison identified why OpenClaw deployments are uniquely dangerous: they combine three attack surfaces that multiply each other's impact.
💉
Prompt Injection
Attackers hijack agent behavior through untrusted inputs
🔧
Tool Access
Agents have real-world capabilities like code execution and API calls
🧠
Persistent Memory
Poisoned context persists across sessions and users
"Each vulnerability alone is manageable. Combined, they're catastrophic. An attacker can inject instructions, execute arbitrary code, and persist malicious state — all from a single crafted message."
— Simon Willison, "The Agent Security Crisis", January 2026
OpenClaw's Own Admission
To their credit, OpenClaw's documentation explicitly warns users about these limitations. The problem is that most deployers ignore these warnings.
"OpenClaw is designed for research and prototyping. It should NOT be deployed in production environments without significant additional security hardening."
— OpenClaw Documentation, Security Considerations
"Skills execute with the same permissions as the main process. There is currently no sandboxing or permission isolation. Only install skills from sources you trust completely."
— OpenClaw Documentation, Skills System
Despite these warnings, our scan found 42,000+ instances deployed in production. 92.3% had not implemented any of the recommended hardening measures.
Timeline of Events
Nov 2025
OpenClaw reaches 100,000 GitHub stars, becomes most popular agent framework
Dec 2025
Cisco Talos publishes skills supply chain analysis — 23% of skills unaudited
Jan 2026
Maor Dayan discovers 42,000+ exposed instances in internet-wide scan
Jan 2026
ZeroLeaks completes multi-model security assessment — all models fail
Jan 2026
Simon Willison publishes "The Lethal Trifecta" analysis of agent security
Feb 2026
This report published
The Question Nobody's Asking
Everyone's building AI agents. Nobody's asking: what happens when those agents can be hijacked? OpenClaw's 100,000 GitHub stars represent 100,000 developers who trust this framework. But trust isn't security. Every OpenClaw agent deployed today is a potential attack vector — not just for the organization running it, but for every system it can access. The most popular agent framework is teaching an entire generation of developers to build insecure AI systems by default.
Would I Deploy This in Production?
NO
OpenClaw is excellent for research and prototyping. But 42,000 organizations didn't get that memo. Until the framework adds real security primitives — sandboxed skills, verified tool calls, memory isolation — production deployment is reckless. Use it to learn. Don't use it to ship.
Sources
- ZeroLeaks Security Assessment — Multi-Model OpenClaw Audit, January 2026
- Maor Dayan — "OpenClaw in the Wild: 42,000 Exposed Instances", January 2026
- Cisco Talos Intelligence Group — Skills Supply Chain Analysis, December 2025
- Simon Willison — "The Agent Security Crisis: The Lethal Trifecta", January 2026
- OpenClaw Documentation — Security Considerations, v2.4
- OpenClaw GitHub Repository — Stars, Issues, and Security Advisories