Is OpenClaw safe?

What OpenClaw is, and why safety is your job

OpenClaw is a free, MIT-licensed, self-hosted personal assistant that you reach from WhatsApp, Telegram, Slack, iMessage and other chat apps13. It can handle your inbox and calendar, browse and fill forms, and run on your own machine where state stays local13. There's no vendor cloud and no subscription13, which is the appeal. It also means there's no vendor security team standing between the agent and your accounts. You are the operator.

The real setup risks

• Full system access. Out of the box it can act with your computer's permissions unless you sandbox it13.
• Exposed Gateways. A normal host install binds the Gateway to loopback (this machine only). Container images are the deliberate exception: they default to an exposed bind, which you must pair with authentication11.
• Shared agents aren't isolated. OpenClaw assumes one trusted boundary per Gateway and is "not a hostile multi-tenant security boundary"11. Session ownership and visibility are "usability features, not security boundaries"14.
• Cross-conversation messaging. Agents with the message tool can send across conversations and chat providers by default11.
• Defaults that widened. In 2026.9.2, session tools moved to all-session visibility and ordinary agent-to-agent access was switched on; you set tools.sessions.visibility to agent or self to narrow it15.
• Prompt injection is on you. The project's security policy says prompt injection without a policy, approval, sandbox or tool-boundary bypass is usually not treated as a vulnerability, and neither is a malicious plugin you chose to install14. Limiting tools is how you contain it.

The security track record, in numbers

OpenClaw publishes its vulnerabilities as GitHub security advisories12. When we queried GitHub on 17 Oct 2026, it returned 722 published advisories dated 31 Jan to 11 Sep 2026: 14 critical, 249 high, 390 medium and 69 low. Most landed in February (220) and March (204), falling to 45 in June and 75 in September. A big project that discloses openly will log more advisories than one that doesn't, but this is still a lot of surface to keep patched.

The critical ones were serious, and each lists a fixed version. Examples: remote code execution through a node-invoke approval bypass, fixed in 2026.2.1416; path traversal in plugin installation, fixed in 2026.2.117; pairing-scoped device tokens that could mint admin rights and reach code execution, fixed in 2026.3.1118; a sandbox escape via a race condition, fixed in 2026.3.3119; and a .env injection allowing config takeover, fixed in 2026.3.2820. If you're running a release from early 2026, update now. The current release is 2026.10.4.

Whether any of these was exploited in the wild: unknown. The advisories we read don't say.

Recent security fixes from the release notes

Our breaking-changes tracker flags OpenClaw releases that need migration work, and the OpenClaw page shows the latest version daily.

How to run OpenClaw safely: a checklist

1. Run the audit. openclaw security audit tells you if you've drifted from safe defaults11.
2. Keep the Gateway local (loopback bind) with token auth. Never expose a container's Gateway without authentication1121.
3. Lock down tools. Start from the project's hardened baseline below: messaging-only tool profile, file access limited to the workspace, shell execution denied or always-ask, elevated mode off, no agent-to-agent access21.
4. Pair DMs and gate groups. Unknown senders get a pairing code; group replies require a mention21.
5. Use a separate number for WhatsApp, Signal or Telegram so personal chats stay out of the bot's reach21.
6. Split trust. For people who don't fully trust each other, use separate Gateways and credentials, ideally separate OS users or hosts11.
7. Update on a schedule. If you want fewer surprises, follow the extended-stable line, which carries critical security updates2.
8. Treat plugins as code you run. Check ClawHub's security-audit information before installing9.

The 60-second hardened baseline from OpenClaw's docs21:

{
  gateway: {
    mode: "local",
    bind: "loopback",
    auth: { mode: "token", token: "replace-with-long-random-token" },
  },
  session: { dmScope: "per-channel-peer" },
  tools: {
    profile: "messaging",
    deny: ["group:automation", "group:runtime", "group:fs", "sessions_spawn", "sessions_send"],
    fs: { workspaceOnly: true },
    exec: { security: "deny", ask: "always" },
    elevated: { enabled: false },
    sessions: { visibility: "agent" },
    agentToAgent: { enabled: false },
  },
  channels: {
    whatsapp: { dmPolicy: "pairing", groups: { "*": { requireMention: true } } },
  },
}

Should you use it?

Yes, if you're comfortable with a terminal, will keep it updated, and want an assistant that lives in your chat apps with no vendor cloud. No, if you want something your team can sign up for and forget: a business plan from ChatGPT, Claude or Microsoft gives you admin controls and a vendor accountable for security (see the small-business guide). Also compare OpenClaw vs Hermes Agent, the other main self-hosted option, which offers five sandbox backends22.