The Security Reality

🔓 Exposed Instances

1,100+ OpenClaw gateways found on Shodan with zero authentication — leaking API keys, OAuth tokens, chat histories.

💉 Prompt Injection

Skills are just text files. Malicious skills can instruct agents to exfiltrate data, credentials, or execute arbitrary commands.

🔑 Credential Theft

Agents often have access to user's API keys, email, calendar. One compromised skill → full account access.

💰 Crypto Scams

Account rename → scammers hijacked old handles in 10 seconds. Fake $CLAWD token hit $16M market cap.

Cisco: "A Security Nightmare"
Forbes: "Not A Good Idea"
VentureBeat: "Your security model doesn't work"
Karpathy: "Computer security nightmare at scale"