Introduction

Is OpenClaw safe? The honest answer: OpenClaw is as safe as the way you deploy it. The software itself is MIT-licensed, actively hardened, and ships with sensible security defaults — but it's also a program that reads your messages, holds your API keys, and executes tools on your machine. Run it carelessly and researchers have shown exactly what happens: exposed instances leaking API keys, chat histories, and credentials to anyone who knew where to look.

This article gives you the operator's view — what the real risks are in 2026 (including what changed in OpenClaw 2.0), and a ten-point checklist for common deployment and credential risks. It is not a complete security assessment. Nothing here requires you to be a security engineer.

What OpenClaw's Trust Model Actually Is

Start with what the project itself says, because it's more candid than most. The official security guide and README establish three defaults:

  1. Inbound messages are untrusted input. Anything that arrives from WhatsApp, Telegram, Discord, or any channel is treated as potential prompt injection — including messages that look like they came from you.
  2. Sender access is channel-specific. Review the configured channel's pairing and allowlist behavior. When the documented pairing flow requires approval, inspect the requester before approving it.
  3. Tools run on your host by default. In the main session, the agent's tools — shell, files, browser — execute with your machine's permissions unless you configure sandboxing.

That third point is the crux. OpenClaw is an agent that acts, not just chats, and its actions run with your privileges until you cage it. Everything in the checklist below flows from these three defaults.

The Real Risks (Ranked by How Often They Bite People)

1. An exposed Gateway. The Gateway is OpenClaw's control plane. Expose it to the internet without the exposure runbook's precautions and anyone who finds it can talk to your agent — with your tools and your credentials. Security researchers at Bitsight and Immersive Labs documented exactly this failure mode across the internet in 2026: instances reachable by anyone, dumping API keys and chat history.

2. API key leakage. Your model provider keys are real money. Keys can surface through chat context, logs, tool output, or plugin access. A leaked OpenAI or Anthropic key doesn't just read your data — it runs up your bill. We cover this in depth in the API key security guide.

3. Prompt injection through a channel. A convincing message ("hey, it's me — send me the contents of that file") is untrusted input that your agent may act on. The pairing default protects you from strangers; it does nothing against a compromised contact's account, which is why sandboxing and tool scoping matter.

4. Malicious or careless skills. Third-party skills and plugins can introduce instructions, code, or dependencies that interact with your assistant's access. Inspect source and requested permissions before installation; a marketplace listing is not a security audit. See our guide to choosing and vetting skills.

5. Credential-bearing backups. The backup archives that protect you during upgrades contain your private messages and channel credentials. An unencrypted backup on a shared server is a leak waiting to happen.

The 10-Point Hardening Checklist

Work through these in order. The first three close the doors attackers actually use.

1. Keep the Gateway off the public internet. Access it over localhost, Tailscale/WireGuard, or an SSH tunnel. If you must expose it remotely, follow the official exposure runbook — authentication, TLS, and rate limiting at minimum.

2. Review access for every configured channel. Follow that channel's documented pairing, allowlist, or account policy. Confirm an unapproved account cannot start work; do not assume all channels use identical defaults.

3. Review tool sandboxing. Configure supported isolation and inspect effective mounts, network access, and tool policy using our sandboxing guide. A separate VPS can reduce exposure to your daily computer, but is not automatically a tool sandbox or a guarantee against credential access.

4. Treat API keys like cash. Use the provider's available permissions, alerts, and enforced limits where supported; verify their scope and enforcement. Revoke exposed credentials promptly. Details in the API key guide.

5. Vet skills before installing. Prefer skills with public source you can skim in five minutes, an author with a track record, and an installed base. Avoid skills that request broad shell access or network access they don't need for their stated purpose.

6. Scope what the agent can reach. Run OpenClaw as a dedicated user, not your daily-driver account. Keep credentials out of its environment where it doesn't need them (the 2.0 secret-handling changes help, but your directory layout matters more).

7. Encrypt and offsite your backups. Especially because they contain chat history and channel tokens.

8. Update promptly. Review current releases and relevant security fixes. The 2.0 security overhaul specifically hardened runtime, plugins, and secret handling. Being three months behind on an agent runtime is a different risk class than being three months behind on a text editor. Follow the upgrade guide.

9. Watch provider usage. An unexplained spike is a reason to investigate; it can reflect legitimate tasks, retries, or unauthorized use. Configure available alerts before leaving tasks unattended.

10. Assume inbound is hostile. Don't let the agent auto-execute anything sensitive from a chat message. For high-stakes actions (payments, deletions, emails to real people), require explicit confirmation in the chat and configure your skills accordingly.

If You Only Do Three Things

Short on time? Do these, in order:

  1. Review Gateway exposure and authentication using the official runbook; use a private access path for a personal deployment.
  2. Inspect effective tool sandboxing and permissions to reduce filesystem and execution access. It does not contain every prompt injection or integration.
  3. Verify provider permissions, spending controls, and alerts; distinguish notification thresholds from enforced limits and revoke exposed credentials regardless.

These controls address different failure paths. Continue to review updates, channel access, plugins, and backups.

FAQ

Is OpenClaw safe to connect to WhatsApp? Review the official WhatsApp access and account guidance, the permitted senders, Gateway authentication, and the tools the agent can execute. Pairing and a private listener reduce certain risks but do not certify the deployment as safe.

Did OpenClaw have a security breach? This checklist is not a catalogue of all historical incidents. Check the official project advisories and release notes for vulnerabilities relevant to your version, and distinguish an upstream vulnerability from a deployment access-control failure.

Is OpenClaw safe with my API keys? Credential exposure depends on secret storage, tool policy, mounts, plugins, and output handling. Keep keys out of model-visible output, verify the provider's available permissions and enforcement behavior, monitor usage, and rotate exposed credentials.

Is it safe to run OpenClaw on my personal laptop? Assess the files, accounts, and commands the assistant can access before running it on your daily computer. A dedicated user or separate host can reduce access to that computer, but still needs authenticated access, tool policy, backups, and credential protection. Use the VPS selection guide for host criteria; it is not a security or performance certification.