Is OpenClaw safe? 7 things to check before self-hosting
Self-hosted / on-device agents like OpenClaw can operate your files, send messages, and call APIs for you — the flip side is that they hold your credentials and execute actions on your machine. In the early-2026 OpenClaw incident, researchers found 40k+ instances reachable on the public internet, ~90% bypassable, and ~20% of marketplace skills carrying malware. These 7 things are the floor before self-hosting.
1. Keep the admin panel off the internet
The most common way to die. The console should bind to 127.0.0.1 by default; reach it remotely via an SSH tunnel or authenticated reverse proxy, not a raw public port-forward.
2. Beware the “local = safe” illusion
ClawJacked (CVE-2026-25253) proved that even a localhost-bound service can be attacked by a malicious page via your browser. The server must validate Origin/Host and reject cross-origin requests.
3. Install only signed skills
Agents download and run external code — the dirtiest entry point. Install only signed skills; never fetch and execute from arbitrary URLs.
4. Declared permissions, least privilege
Each skill declares the permissions it needs and the runtime scopes it accordingly, blocking overreach — instead of granting full access on install.
5. Don’t store credentials in cleartext
Store tokens/passwords encrypted or in a system keystore, and never in configs or logs. One compromised always-on box means all your accounts.
6. High-risk actions need confirmation
Paying, messaging, deleting should be blocked pending confirmation, and confirmation should go to another device (out-of-band) — so even an injected agent can’t spend money.
7. Keep a tamper-evident audit log
Log every high-risk action and make it tamper-evident (signed / hash-chained). This decides whether an incident can be traced and blamed.