Is OpenClaw Safe for Enterprise Data? The Honest Answer

OpenClaw has 347,000 GitHub stars. It's the fastest growing open source AI agent ever built. Developers are connecting it to databases, email inboxes, file systems, CRMs, and internal APIs, giving it persistent memory and the ability to act autonomously across every one of those surfaces.

And in four days in March 2026, nine security vulnerabilities were disclosed for it. One scored a 9.9 out of 10.

That's not a reason to stop building with OpenClaw. It's a reason to understand exactly what you're dealing with before you point it at enterprise data.

The security picture, in plain terms

Between March 18 and March 21, 2026, nine CVEs were publicly disclosed for OpenClaw. One scored a 9.9 on the CVSS scale. Six were rated high severity. Two medium. One critical. Four days, nine holes.

Security researcher Joel Gamblin's public tracker logged 137 security advisories between February 2 and April 4, 2026 alone, roughly one new advisory every 15 hours over a two-month stretch.

SecurityScorecard's STRIKE team identified 135,000+ publicly exposed OpenClaw instances. Of those, 63% had no authentication configured at all.

Those aren't theoretical numbers. Those are production deployments, running right now on real infrastructure, with no authentication, publicly accessible on the internet.

OpenClaw has been affected by command injection, SSRF, path traversal enabling local file reads, and prompt-injection-driven code execution. The details differ across CVEs, but the pattern is consistent: important parts of the platform have repeatedly been exposed to inputs they don't handle safely. In a system designed to browse, execute, remember, and connect, familiar vulnerabilities carry more weight than they would in an ordinary application.

What makes OpenClaw different from other software vulnerabilities

Most software vulnerabilities affect isolated systems. A flaw in a note-taking app exposes notes. A flaw in a static website exposes the site.

OpenClaw agents run with deep system privileges, terminal access, file system control, browser control, and SaaS session management. Broad permissions plus weak default security has led to leaked API keys, hijacked agents, and malicious skills stealing credentials.

The blast radius of an OpenClaw vulnerability isn't one application. It's everything the agent has access to. And by design, that's usually a lot.

Token Security found that 22% of enterprise customers have employees running OpenClaw as shadow AI without IT approval. An OpenClaw agent on a developer's laptop with VPN access to production means every vulnerability above is now a business problem.

This is the shadow AI problem made concrete. An employee installs OpenClaw, connects it to their work email and a few internal APIs, and suddenly there's an unauthenticated agent with access to production systems sitting on their laptop, unpatched, unmonitored, and invisible to security teams.

The supply chain layer nobody is watching

The vulnerability story gets more complicated when you add ClawHub, OpenClaw's marketplace for third-party skills.

ClawHub grew from 2,857 skills in early February 2026 to more than 10,700 by mid-February. The low barrier for publishing, anyone with a week-old GitHub account could upload a skill with no strong identity verification and little pre-publication code review, created a crowded marketplace that includes unsafe and maliciously designed skills.

An ongoing supply chain attack dubbed ClawHavoc resulted in 341+ malicious skills being distributed through the official ClawHub marketplace.

A skill installed from ClawHub runs inside your OpenClaw instance. It has access to everything the agent has access to. If that skill is malicious, it inherits every permission you've granted, database connections, API tokens, file system access, everything.

For an enterprise deployment handling sensitive data, this isn't a theoretical attack vector. It's an open door.

What a hardened deployment actually requires

None of this means OpenClaw is unusable in enterprise environments. It means using it well requires deliberate architecture, not default settings.

A real CVE from January 2026 demonstrated how a single unvalidated URL parameter in the Control UI could result in full remote code execution via a one-click exploit. The controls that directly address this include WebSocket origin validation, token rotation, restricted relay access, and audit logging, none of which are on by default.

The hardening checklist for a production OpenClaw deployment in a regulated environment:

Run in an isolated environment, a VM, container, or dedicated cloud instance, never on a developer's laptop with VPN access.
Enable authentication on the gateway before anything else.
Block port 18789 from any external access.
Audit every ClawHub skill before installation, and remove any installed before ClawHavoc was publicized.
Rotate API keys on a fixed schedule.
Keep OpenClaw updated, anything below version 2026.4.5 is vulnerable to at least the April batch of CVEs.

That covers the perimeter and deployment risk. It doesn't cover the prompt layer.

The gap that patching doesn't close

Here's the thing about hardening OpenClaw: every security control above protects against external attackers. None of them address what the agent reads and reasons over when it's doing its job.

A fully patched, authentication-enabled, isolated OpenClaw deployment still processes patient records in clear text. The name, the SSN, the diagnosis code, all of it in the model context window every time the agent runs a healthcare workflow.

That's not a CVE. That's architecture.

The agent sees the data because you gave it the data. No vulnerability scanner flags that. No patch fixes it. The raw values are in the prompt by design, and that design is the exposure.

OWASP's 2025 LLM Top 10 places prompt injection, including indirect injection through documents, emails, and external content the agent processes, at the top of emerging AI risks. The root cause is that AI systems treat everything in the context window as potentially meaningful and actionable. A malicious instruction embedded in a patient record or a financial document looks the same to the model as a legitimate one.

If the raw PHI is in the prompt, it's available to anything that touches the prompt, legitimate agent reasoning, downstream tool calls, memory persistence, logs, and any attacker who compromises one of those surfaces.

The architectural fix

Intercept before the prompt is constructed. Replace real values with reversible tokens. The agent processes [CVT:NAME:A1B2] and [CVT:SSN:C3D4] instead of the real values. It reasons over those, makes decisions, executes actions, and at the moment of execution, a vault resolves the tokens back to real values. The action completes. The raw data never entered the model context.

from codeastra import BlindAgentMiddleware

agent = BlindAgentMiddleware(your_openclaw_agent, api_key="sk-guard-xxx")
agent.run("Process record for patient Sarah Kim, SSN 234-56-7890, diagnosis Z00.00")
# Agent receives: "Process record for [CVT:NAME:A1B2], SSN [CVT:SSN:C3D4], diagnosis [CVT:DX:E5F6]"
# Raw values: never in the model context

This is what Astra does. Two lines of code alongside your existing OpenClaw deployment. The agent doesn't notice the difference. The attacker who compromises your logs finds nothing useful. The regulator who asks "what did the model see?" gets a clean answer.

Patch your OpenClaw instance. Harden your deployment. And close the one gap that patching was never designed to close.