AI Agents
OpenClaw, deployed the way its own documentation asks
OpenClaw is MIT-licensed, powerful, and has a documented record of agentic security failures. We deploy it with the controls its own docs ask for.
OpenClaw is a free, MIT-licensed agent platform that uses messaging apps as its interface. It runs locally, connects to more than twenty-five channels, and executes real tasks through an extensible skills system. It is among the most-starred projects on GitHub, and people are already running it against work data whether or not anyone approved it.
It also has a documented record of agentic security failures. Both things are true, and the second is the reason the first matters to you.
We are not going to tell you OpenClaw is enterprise-hardened. Its own README tells operators to treat inbound messages as untrusted input and to review the gateway exposure runbook before exposing anything remotely. That guidance is correct, and most installations do not follow it.
The record
What has actually gone wrong
Published incidents, not hypotheticals. Each should be traced to its primary source before you rely on it in a risk assessment.
January 2026
Cisco reported third-party OpenClaw skills performing data exfiltration and prompt injection without user awareness.
February 2026
An agent autonomously created a dating profile without explicit authorisation — the "MoltMatch" incident. A vivid illustration of excessive agency: the agent was not compromised, it simply did more than anyone intended.
March 2026
Chinese state agencies were barred from using OpenClaw, citing unauthorised data deletion, leaks and excessive energy consumption.
OpenClaw has also become a standing case study in the academic literature on agentic attack surfaces — which is a compliment to its reach and a warning about its default posture.
What we deploy
The control layer
Agent behavior is bounded by what you technically enforce, not by what you policy-require.
Sandboxed sessions by default
OpenClaw ships a sandbox mode that runs non-main sessions in isolation, with Docker as the default backend and SSH and OpenShell available. We turn it on, scope it, and verify it — rather than accepting the convenience of running everything in the main session.
Inbound messages treated as untrusted input
This is OpenClaw's own guidance, and it is the single most-ignored line in its documentation. A message arriving over WhatsApp or Slack is attacker-controlled text being fed to a model that can call tools. We design the trust boundary accordingly, with DM pairing approval and explicit allowlisting rather than open enrolment.
Least-privilege tool scoping
An agent should hold the narrowest set of capabilities that lets it do its job. We enumerate every tool and channel it can reach, remove the ones nobody can justify, and document what remains — which is also the artifact an assessor will ask for.
Third-party skills reviewed before installation
In January 2026 Cisco reported that third-party OpenClaw skills performed data exfiltration and prompt injection without user awareness. The skills system is genuinely useful and genuinely a supply chain. We review what you install and pin what you keep.
Audit logging of agent actions
Not just what the agent said — what it did. Which tool it called, with what arguments, on whose behalf, and whether a human approved it. Without this you cannot answer an incident question, and under an effect-based standard you cannot show what the system actually did.
Human approval gates designed against fatigue
OWASP catalogues "Overwhelming Human in the Loop" as a distinct agentic threat and human-agent trust exploitation as ASI09. An approval gate that fires forty times a day is not a control; it is a rubber stamp with extra steps. We tune what escalates.
Questions
Frequently asked
Is OpenClaw safe to run in a regulated environment?
Not out of the box, and we would rather say that plainly. OpenClaw is a local-first agent platform that connects to messaging channels and executes tasks through tools — which is exactly the capability set that makes agentic security hard. It has a documented incident record. What makes it deployable is the control layer around it: sandboxing, allowlisting, reviewed skills, least-privilege tool scoping, and audit logging. Those are our job.
What licence is it under, and who maintains it?
MIT. It is maintained by the OpenClaw Foundation, established 14 February 2026 after its creator, Peter Steinberger, joined OpenAI. The project began in November 2025 and passed through several names — Warelay, Clawdbot, Moltbot — before settling on OpenClaw in January 2026. It is written in TypeScript and Swift and is one of the most-starred repositories on GitHub.
Why would we use OpenClaw rather than a commercial agent platform?
Because it runs on your hardware, under your control, with no per-seat licence and no data leaving your boundary by default. For organizations whose objection to agents is residency or vendor risk, that removes the objection. If your constraint is instead that you need a vendor to accept contractual liability, a commercial platform is the better answer and we will tell you so.
Does OpenClaw fall under the EU AI Act or state AI law?
Deploying it does not by itself put you in any special category. What matters is what you point it at. An agent that materially influences a hiring decision engages Illinois HB 3773 regardless of which framework it runs on; one that touches PHI is inside your HIPAA scope. The European Commission's own AI Act Service Desk has said its regulatory thinking on AI agents is preliminary at this stage — which is precisely why the controls need to be defensible on their own terms rather than by reference to a rule that does not exist yet.
Interested in this agent?
Let's scope it against your compliance requirements and agree what it returns.