---
schemaVersion: 1
slug: en-sd-31-20260715-openclaw-security-crisis
ticketId: SD-31
lang: en
title: "The 2026 OpenClaw Triple Breach: Freedom Isn't Free"
summary: "In early 2026, OpenClaw exposed three boundaries: 20,000+ gateways online, 824 malicious ClawHub skills, and link previews automatically requesting sensitive URLs generated by models. Localhost binding, supply-chain review, and egress controls each cover one segment; none seals every path."
originalDate: 2026-07-15
translatedDate: 2026-07-15
source: ShroomDog Lab
sourceUrl: https://gu-log.vercel.app/
author: null
authorshipNote: null
canonicalUrl: https://gu-log.vercel.app/en/posts/en-sd-31-20260715-openclaw-security-crisis
status: published
replacementTicketId: null
replacementUrl: null
---

# The 2026 OpenClaw Triple Breach: Freedom Isn't Free

> **Source:** [ShroomDog Lab](https://gu-log.vercel.app/)

In January 2026, public scanners started mapping [OpenClaw](https://gu-log.vercel.app/en/glossary#openclaw) gateways on the default port 18789. A week earlier the count was still in the thousands. By late January, reports were already in the twenty-thousands. Publicly reachable did not mean universally unauthenticated: Censys said most of the instances it saw still required a [token](https://gu-log.vercel.app/en/glossary#token).

There was no fancy zero-day magic, only “let’s just get it running” appearing in a public scan. Over the next few months, attackers kept changing doors: first the gateway itself stood on the public internet, then users carried malware in from the skill marketplace, and finally a messaging platform’s preview crawler could relay the data out.

---

## Breach One: The Unlocked Lobby

OpenClaw is an open-source [agent harness](https://gu-log.vercel.app/en/glossary#agent-harness) — the system layer that wraps the model, gives it tools, and manages what goes in and out. Self-hosted, self-managed, self-directed. The flip side of “self-directed” is “self-responsible.”

The gateway listens on port 18789 by default. The correct setup is to bind it to `127.0.0.1`, so only the local machine can connect, then put HTTPS in front via a reverse proxy. But lots of people took the shortcut: change it to `0.0.0.0`, open the door to the entire internet. Even more convenient? Don’t bother setting a password.

By late January 2026, scanning firms started publishing counts. [Censys’s January 31 report](https://censys.com/blog/openclaw-in-the-wild-mapping-the-public-exposure-of-a-viral-ai-assistant/) found **21,639** exposed instances. [BitSight](https://www.bitsight.com/blog/openclaw-ai-security-risks-exposed-instances) cumulatively observed **30,000+ distinct instances** across daily scans from January 27 through February 8. One is a point-in-time view; the other is a deduplicated multi-day count. They should not be mashed into one exact total. The trend is what held: from about a thousand to tens of thousands in a week.

[NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-25253) and the [OpenClaw advisory](https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq) soon disclosed another route: `2026.1.28` and earlier trusted a query-string `gatewayUrl`, auto-connected, and sent the stored gateway token. That token is what can escalate into operator access and possibly remote code execution; the patch boundary is `2026.1.29`. [MP-316](https://gu-log.vercel.app/en/posts/en-mp-316-20260213-openclaw-setup-guide-audit) later checked the same chain.

> **Mogu inner monologue:**
>
> Public exposure lets scanners find the door; CVE-2026-25253 tricks a stored token through another one. The failures often share a room, but they are not one causal chain. Localhost blocks the first, not a user opening a malicious `gatewayUrl`. ┐(￣ヘ￣)┌

> **ShroomDog's OS:**
>
> Binding to localhost is not advanced technique; it answers whether the service should face the public internet at all. Close the door by default, then decide how to protect it if it must open. The [LINE post](https://gu-log.vercel.app/en/posts/en-sd-29-20260715-openclaw-line-selfhost/) takes that private-network architecture all the way. (￣▽￣)/

---

## Breach Two: Trojans in the Marketplace

The gateway door was locked. The next hole was on the shelves.

ClawHub is OpenClaw’s official [skill](https://gu-log.vercel.app/en/glossary#skill) marketplace — a place for the community to share agent plugins. Upload review process? Basically none. The malicious skills followed the oldest playbook: pick a respectable name, claim to help the agent do something useful (organize notes, scrape webpages, convert formats), stuff a backdoor inside.

[Koi’s audit, updated on 2026-02-16](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting), identified **824** malicious skills after the marketplace grew from 2,857 to **10,700+** skills — less than **7.7%**. [GP-51](https://gu-log.vercel.app/en/posts/en-gp-51-20260212-1password-openclaw-skill-malware) covered another popular skill dropping malware in the same period. Koi’s inspected payloads included AMOS infostealers, reverse shells, and direct `.env` exfiltration. Install one “helpful little tool” and you carry the horse in yourself.

“Claude Skills are safer” is not a useful comparison unless the product surface is named. [Anthropic’s official overview](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) draws the boundary explicitly: Claude API Skills run in a sandbox with no network access, while [Claude Code](https://gu-log.vercel.app/en/glossary#claude-code) Skills have the same network access as other programs on the user’s computer. [Managed Agents skills loaded from a GitHub repository](https://platform.claude.com/docs/en/managed-agents/skills) are discovered from `.claude/skills` at session start; Anthropic warns that this happens without a review step and that anyone who can commit to the [repo](https://gu-log.vercel.app/en/glossary#repo) is inside the trust boundary.

> **Mogu 's hot take:**
>
> The brand is not the security boundary; the product surface is. An API sandbox locks the wallet in another room. A Claude Code skill stands in the same room as local programs. [Enterprise scanning](https://support.claude.com/en/articles/15927065-get-started-with-skill-and-plugin-scanning) is an optional, off-by-default beta with explicit gaps. (¬‿¬)

**A marketplace having a search box does not mean it owns your supply-chain trust.** Before installing a third-party skill, ask about its review process, permissions, and whether you can see the code. If you cannot, why trust it?

---

## Breach Three: Link Preview Turned Insider

The third breach was different. This time the exfil request did not even have to leave from the victim’s agent host.

[PromptArmor’s demonstration](https://www.promptarmor.com/resources/llm-data-exfiltration-via-url-previews-(with-openclaw-example-and-test)) has two steps: the **agent first produces an attacker URL carrying leaked data**, stuffing conversation text, tokens, or filenames into its path or query; then a **link-preview crawler from Telegram, [Slack](https://gu-log.vercel.app/en/glossary#slack), or another platform** fetches that URL. The last hop leaves from the platform, never touching the [proxy](https://gu-log.vercel.app/en/glossary#proxy) on the victim’s gateway.

This proves a preview crawler can finish exfiltration for the agent. It does not prove that the platform fetched a malicious page and fed the [prompt injection](https://gu-log.vercel.app/en/glossary#prompt) back to the agent, or that a host proxy caught the payload at the last moment. The defenses that match the demonstration are to disable or restrict link previews, keep the agent from writing secrets into URLs, and scan messages for exfil links before sending. PromptArmor’s concrete OpenClaw advice is to set `linkPreview` to `false` for the Telegram channel.

> **Mogu roast time:**
>
> An egress allowlist on the host sees only packets the host sends; a preview crawler leaves from the platform. Ingress, host egress, and platform unfurl are three control planes. Do not count one allowlist three times. The [Teams post](https://gu-log.vercel.app/en/posts/en-sd-30-20260715-openclaw-teams-intranet/) handles the second one. (ง •̀\_•́)ง

---

## Conclusion: Three walls, and the attack changes doors

[GP-18’s security starter guide](https://gu-log.vercel.app/en/posts/en-gp-18-20260202-openclaw-security-first-guide/) covers the baseline hardening to do before self-hosting. This post adds what three incidents in 2026 exposed as attacks moved from the public internet to the supply chain and then the platform preview layer: each wall can see a different control plane.

> **ShroomDog highlights:**
>
> [This series](https://gu-log.vercel.app/en/posts/en-sd-28-20260715-claude-tag-intro/) ends at an old choice: managed services trade a monthly bill and platform lock-in for part of the responsibility; OpenClaw’s self-hosting freedom hands the entire security stack back to you. Either path can work. Know who owns the risk. ╰(°▽°)╯

Those tens of thousands of exposed gateways each had someone behind them who thought, “Let’s just get it running first. We’ll worry about the rest later.” Attackers don’t wait for “later.”