# OpenClaw Security Research - Reference for Video Script

All data points below are sourced from published articles and security disclosures.
Use these as on-screen text overlays, voiceover facts, or visual references.

---

## OpenClaw Overview

- **Created by:** Peter Steinberger (Austrian developer)
- **Previously known as:** Clawdbot -> Moltbot -> OpenClaw
- **GitHub Stars:** 216,397+
- **Public Repos:** 19
- **Founded:** November 2025, went viral January 2026
- **Steinberger joined OpenAI:** February 14, 2026
- **Wikipedia page:** Yes (en.wikipedia.org/wiki/OpenClaw)

## What It Does

- Self-hosted, open-source AI agent platform
- Runs locally, connects to LLMs (Claude, GPT, DeepSeek)
- Accessed via messaging apps (Signal, Telegram, Discord, WhatsApp)
- Full shell access on the host machine
- Can read/write files, execute scripts, browse the web
- Persistent memory across sessions (stored as plaintext files)
- Can autonomously book flights, call restaurants, manage calendars, refactor code

---

## Security Headlines (Chronological)

| Date | Source | Headline / Finding |
|------|--------|--------------------|
| Jan 27, 2026 | 1Password | "It's incredible. It's terrifying. It's OpenClaw." |
| Jan 28, 2026 | Cisco Blog | "Personal AI Agents like OpenClaw Are a Security Nightmare" |
| Jan 28, 2026 | TechCrunch | "Everything you need to know about viral personal AI assistant" |
| Jan 29, 2026 | Axios | "Silicon Valley's latest AI fixation poses early security test" |
| Feb 1, 2026 | 404 Media | "Exposed Moltbook Database Let Anyone Take Control of Any AI Agent" |
| Feb 2, 2026 | PCMag | "OpenClaw Is the Hot New AI Agent, But Is It Safe to Use?" |
| Feb 2, 2026 | CNBC | "From Clawdbot to Moltbot to OpenClaw: Meet the AI agent generating buzz and fear" |

---

## Critical Security Findings

### 1. CVE-2026-25253 - 1-Click Remote Code Execution (CVSS 8.8)
- Allowed remote attackers to take full control via a single click
- Exploited lack of WebSocket Origin header validation
- Auth tokens leaked via URL query string to attacker servers
- Cross-Site WebSocket Hijacking even on localhost-bound instances
- Kill chain: steal token -> disable guardrails -> escape sandbox -> execute arbitrary code
- All versions prior to 2026.1.29 vulnerable

### 2. Cisco Skill Scanner - Malicious Skill Discovery
- Cisco AI Security team tested third-party skill "What Would Elon Do?"
- Found 9 security findings: 2 CRITICAL, 5 HIGH severity
- Skill performed data exfiltration via silent curl command to external server
- Skill conducted prompt injection to bypass safety guidelines
- Tool poisoning with embedded malicious payload
- Command injection via embedded bash commands
- OpenClaw executed all of it without user awareness

### 3. Moltbook Database Breach (Wiz)
- 1.5 million API authentication tokens exposed
- 35,000 email addresses leaked
- Private messages between agents exposed
- Supabase API key with full admin privileges hardcoded in client-side JavaScript
- 17,000 human owners controlling 1.5 million agents (88:1 ratio)
- Anyone could take control of any agent on the platform

### 4. ClawHub Supply Chain Attack
- 350+ malicious skills published by threat actor "hightower6eu"
- Skills disguised as legitimate tools (crypto trackers, finance tools, productivity)
- Primary payload: Atomic Stealer (AMOS) infostealer targeting macOS
- AMOS capabilities: harvest passwords, steal browser data, empty crypto wallets, hijack sessions
- Attackers used bots to inflate download counts to "Top Trending"
- No code review or automated scanning on the marketplace

### 5. Shadow AI / Enterprise Risk
- Token Security: 22% of their customers already had employees using OpenClaw without IT approval
- McKinsey: 39% of companies experimenting with AI agents
- Pentagon deploying agents across networks including for war-gaming

### 6. Financial Impact
- Reports of $50,000+ in stolen API credits
- Ransomware groups encrypting user files via agent access
- Wiper scripts executing rm -rf on home directories via compromised agents

---

## Damning Quotes

> "There is no 'perfectly secure' setup."
> -- OpenClaw's own documentation

> "If you can't understand how to run a command line, this is far too dangerous of a project for you to use safely."
> -- Shadow, OpenClaw maintainer (on Discord)

> "Security for OpenClaw is an option, but it is not built in."
> -- Cisco Blog

> "Running an AI agent with shell access on your machine is... spicy."
> -- OpenClaw support docs

> "A lot of people setting this up don't realize what they're opting into. They see 'AI assistant that actually works' and don't think through the implications of giving an LLM root access to their life."
> -- Rahul Sood, CEO Irreverent Labs

> "The rise of 'Local-First' AI agents has introduced a new, highly lucrative attack surface for cybercriminals. [OpenClaw] offers privacy from big tech, but creates a 'honey pot' for commodity malware."
> -- Infostealers.com

> "The butler can manage your entire house. Just make sure the front door is locked."
> -- SOCRadar

---

## Armorer Capabilities (What Makes It Different)

### Core Value Prop
"The Ollama of AI Agents - Security Built In"

### One-Command Install
```bash
armorer install openclaw
```

### Security Features

| Feature | Description |
|---------|-------------|
| **Docker Sandboxing** | Every agent runs in an isolated Docker container |
| **Superior Observer Model** | Armorer has RW access to agent data; agent cannot see Armorer |
| **Credential Vault** | OS Keyring storage (macOS Keychain, Linux Secret Service), injected via Docker secrets |
| **LLM Guard** | Real-time prompt injection and data exfiltration detection |
| **Secret Redaction** | Automatic detection and removal of leaked API keys from logs |
| **Network Policies** | NONE / WHITELIST / OPEN - control outbound connections |
| **Filesystem Policies** | NONE / ISOLATED / SCOPED / HOME / ROOT - graduated access |
| **Risk Profiles** | AI-driven security interview determines appropriate isolation |
| **Command Deny/Allow Lists** | Blocks rm -rf /, mkfs, curl\|bash, etc. |
| **Prompt Injection Filtering** | Regex + LLM-based detection of injection patterns |
| **Guard Alerts (Telegram)** | Real-time alerts with inline action buttons |
| **Guard Actions** | Shutdown, Auto Steer, Scan, Restart, Resume |
| **Credential Sanitization** | Rotate/revoke exposed keys |
| **OTEL Monitoring** | OpenTelemetry-based runtime activity monitoring |
| **Agentic Debugging** | Autonomous repair loop with knowledge base |
| **Skill Armory (MCP)** | Centralized MCP server management with secure injection |
| **Vulnerability Scanning** | Automated pre-installation security scanning |

### Architecture

```
Host Machine
├── Armorer CLI (user interface)
├── Armorer Core (persistent Docker container)
│   ├── ConversationGuard (LLM Guard scanners)
│   ├── PolicyGuard (command/path/network enforcement)
│   ├── Secret Redaction Engine
│   ├── OTEL Event Consumer
│   └── Inbox/Outbox task processing
└── Sandboxed Agents
    ├── Agent A (isolated container, no Armorer visibility)
    └── Agent B (isolated container, no Armorer visibility)
```

The key insight: **Armorer sees everything the agent does. The agent cannot see Armorer.**
This is a unidirectional privilege boundary - even a fully compromised agent cannot attack the oversight system.
