What are the potential risks behind the popularity of OpenClaw?

Currently, OpenClaw, an open-source AI intelligent agent, has rapidly become popular due to its advantages of local deployment, autonomous execution, and plugin extension. Its GitHub star rating has exceeded 100000 in a short period of time, sparking a craze for "raising lobsters" in China and becoming a landmark product for AI to move from dialogue interaction to task execution. This tool, which can be driven by natural language to complete file operations, process orchestration, and code writing, may seem to bring efficiency revolution to individuals and enterprises, but behind its barbaric growth, multiple risks such as architecture design, security vulnerabilities, ecological governance, and data privacy are concentrated and exposed. It has attracted special warnings from institutions such as the Ministry of Industry and Information Technology and the National Cybersecurity Notification Center, and is worthy of rational examination by the whole society.

The core risks of OpenClaw stem from inherent flaws in architecture design and permission control. To achieve autonomous execution in all scenarios, it defaults to obtaining permissions close to the system administrator level, which can execute shell commands, read and write local files, control browsers, and call network resources, but lacks strict permission isolation and minimum permission constraints. There are security vulnerabilities in multi-layer architectures: the IM integration gateway layer is prone to forged messages bypassing authentication, the intelligent agent layer can be tampered with by malicious conversations, the execution layer is directly connected to the system and easily completely controlled, and the product ecosystem layer becomes a channel for malicious plugin propagation.

The frequent occurrence of high-risk vulnerabilities and new attack methods make OpenClaw's security defense ineffective. As of now, the project has disclosed 258 vulnerabilities. Among the 82 vulnerabilities recently exposed, 12 are classified as extremely critical and 21 as high-risk, mainly due to code injection, path traversal, and access control vulnerabilities, with extremely low exploitation thresholds. The "ClawJacked" high-risk vulnerability exposed in February 2026 allows attackers to bypass firewalls, brute force local access credentials, and remotely control user devices by simply constructing malicious web pages using the WebSocket protocol.

The risk of supply chain poisoning caused by the loss of control over the plugin ecosystem has further amplified security risks. OpenClaw relies on ClawHub skill plugins to achieve functional extensions, with thousands of plugins covering office, development, automation, and other scenarios. However, the platform lacks strict security audits, and any developer can upload plugins. Moreover, plugins inherit all permissions from the main program by default, without sandbox isolation protection. Security agency monitoring shows that 336 out of 3016 sampled plugins contain malicious code, accounting for over 10%. Some plugins disguise themselves as practical tools but actually steal user passwords, SSH keys, API tokens, and even implant backdoors to turn devices into "chickens".

Data privacy breaches and uncontrollable behavior of intelligent agents have become significant threats to user digital security. OpenClaw requires high-frequency screen capture and system interface calls during runtime, recording user operation trajectories and work habits throughout the process. It also stores a large amount of sensitive information such as LLM keys, OAuth tokens, and database passwords locally, often in plaintext form. Once compromised, private data will be fully exposed. At the same time, the inherent "illusion" problem of AI models increases in risk with the support of high authority. Intelligent agents are prone to judgment errors when executing tasks, such as batch deletion of emails, tampering with core data, and ignoring user instructions, resulting in irreversible data loss.

The gap in legal compliance and responsibility definition has put risk management in a difficult position. As an emerging AI intelligent agent, OpenClaw's autonomous execution behavior has not yet been included in the clear legal regulatory scope. The boundaries of data capture are vague, and the division of rights and responsibilities is unclear. Once problems such as data leakage and system damage occur, the responsibilities of users, developers, and platform parties are difficult to define. At the same time, the speed of technological iteration far exceeds the pace of updating security assessment standards, and the existing compliance system cannot cover its risk scenarios. Some users blindly pursue technological dividends, ignore data security and personal information protection requirements, and easily cross legal red lines. In addition, the cognitive misleading caused by technological hype leads ordinary users to ignore the essence of risks, blindly invest time and funds, and further exacerbate potential losses.

The explosion of OpenClaw is an important exploration for the landing of AI technology, but its risks warn that technological innovation must not come at the cost of security compromise. For individual users, it is necessary to abandon the misconception of "technology is omnipotent" and only deploy locally in sandboxes, carefully install plugins, and update versions in a timely manner; For enterprises, a zero trust protection architecture should be established, and permission isolation and operation auditing should be done well; For regulators and platform providers, it is necessary to accelerate the improvement of security standards and audit mechanisms, and plug loopholes and ecological vulnerabilities. Only by balancing efficiency and safety, and allowing technology to develop in an orderly manner within a compliant framework, can AI agents like OpenClaw truly become a driving force for digital life, rather than a source of uncontrollable risks.