Is OpenClaw Safe? The Security Risks, the npm RAT, and Alternatives (2026)

The GhostClaw npm RAT

On March 3, 2026, a package called @openclaw-ai/openclawai appeared on npm under the publisher "openclaw-ai." JFrog security researchers identified it as GhostClaw (internally named GhostLoader), a full-featured Remote Access Trojan targeting developers searching for OpenClaw.

The attack was polished. The dropper displayed animated progress bars and realistic system log output mimicking a legitimate installation. After the fake install completed, it presented a fabricated iCloud Keychain authorization prompt: "OpenClaw needs to securely store credentials." It allowed up to 5 password attempts and validated each one against the real OS authentication mechanism using dscl on macOS.

Once it had your system password, GhostClaw decrypted your macOS Keychain and harvested credentials from Chrome, Edge, Brave, Vivaldi, Opera, Yandex, Firefox, Safari, and Comet. It grabbed crypto wallet seed phrases from Exodus, Electrum, Atomic, Bitcoin Core, Ledger Live, Sparrow, Wasabi, and Trezor Suite. SSH private keys. AWS, Azure, GCP, Kubernetes, and Docker credentials. GitHub CLI tokens. npm configs. iMessage history. Apple Notes. Mail configurations.

The RAT communicated with trackpipe[.]dev as its primary C2 server, with fallback exfiltration through Telegram Bot API and GoFile.io for large archives. It supported remote shell execution with 85-second timeouts, a SOCKS5 proxy, and live browser session cloning via headless Chromium with Chrome DevTools Protocol relay, letting attackers browse as you with your authenticated sessions.

Persistence was thorough: shell hooks in .zshrc, .bashrc, and .bash_profile, cron @reboot entries on Linux, and a background daemon at ~/.cache/.npm_telemetry/monitor.js. Clipboard monitoring ran every 3 seconds, scanning for API keys, private keys, and BIP-39 seed phrases. It beaconed home every 25 seconds with 30% jitter.

The package was downloaded 178 times before npm removed it on March 10, 2026.

What OpenClaw Actually Has Access To

OpenClaw runs locally with your user permissions. It is not sandboxed, containerized, or privilege-separated. Here is what it can touch by default.

A traditional LLM chatbot that gets compromised can leak conversation context. An OpenClaw instance that gets compromised becomes a fully privileged agent acting on the attacker's behalf with your credentials, your email, your file system, and your network access. CrowdStrike's assessment: a compromised OpenClaw is "a powerful AI backdoor agent capable of taking orders from adversaries."

CVE-2026-25253: One-Click Remote Code Execution

This vulnerability (CVSS 8.8) allowed any website to take full control of an OpenClaw instance. The attack chain worked like this:

OpenClaw's server did not validate WebSocket origin headers. Any web page could run JavaScript that connected to your local OpenClaw instance. The Control UI automatically trusted a gatewayURL query parameter and sent the stored authentication token over the WebSocket without verifying origin. With the token's operator.admin and operator.approvals scopes, the attacker disabled user confirmation prompts and set tools.exec.host to gateway, escaping the tool container and running commands directly on the host machine.

The entire chain executed in milliseconds after visiting a single malicious web page. No user interaction beyond the initial click.

Researchers found 42,900 OpenClaw instances exposed to the public internet across 82 countries. 15,200 of those were directly vulnerable to this RCE exploit. The vulnerability was patched in v2026.1.29, released January 29, 2026.

ClawHavoc: 1,184 Malicious Skills on the Official Marketplace

In late January 2026, threat actors registered as developers on ClawHub, OpenClaw's official skill marketplace. They uploaded trojanized skills disguised as crypto trading bots, productivity tools, and social media utilities. By February 5, Antiy researchers had identified 1,184 malicious packages linked to 12 publisher accounts. One uploader was responsible for 677 packages alone.

The attack exploited a fundamental architectural weakness: OpenClaw processes SKILL.md files as trusted instruction sources. Attackers embedded adversarial instructions directly in these files, and the agent followed them without user awareness. Payloads included staged malware downloads, reverse shells via Python system calls, and direct data exfiltration. On macOS, payloads tied to the Atomic macOS Stealer (AMOS) stole browser credentials, Keychains, Telegram data, SSH keys, and crypto wallets.

Koi Security disclosed the campaign on February 1, 2026. By that point, over 9,000 installations had been compromised.

Prompt Injection in Autonomous Agents

Prompt injection against a chatbot is annoying. Prompt injection against an autonomous agent with file system, email, and shell access is an active compromise.

Cisco researchers built a proof-of-concept malicious skill called "What Would Elon Do?" that instructed OpenClaw to execute curl commands sending data to an external server, while simultaneously injecting prompts to bypass the agent's safety guidelines. The user never saw any of it.

The Archestra AI CEO demonstrated a simpler version: send a normal-looking email to an OpenClaw user. Hidden instructions in the email told the agent to export all saved passwords to an external URL. The agent complied. The demo took under five minutes from email to full credential exfiltration.

CrowdStrike documented a more advanced scenario: attackers poisoned a public AI social network with wallet-draining instructions hidden in user posts. When OpenClaw agents ingested those posts through their social media integrations, they followed the embedded instructions.

The difference between a chatbot and an autonomous agent: the chatbot tells you what it would do. The agent does it. OpenClaw can send emails, transfer files, run shell commands, and interact with external services. A successful prompt injection gives the attacker all of those capabilities.

China's Security Warning

CNCERT, China's national internet emergency response center, issued a formal security alert warning government agencies against OpenClaw deployments. Their monitoring found that OpenClaw instances under default configurations were "highly susceptible to cyberattacks and information leakage." The alert urged organizations to audit public network exposure and implement strong identity authentication.

The warning carried particular weight because OpenClaw's downloads from Chinese IP addresses were surging. At the same time, local governments in Shenzhen and other tech hubs were promoting OpenClaw as an innovation and industry platform. State media outlet Global Times ran its own security warning piece, and CGTN (China's international broadcaster) published a separate alert.

The tension is notable: one arm of the government promotes the technology while another warns against using it. The security concerns center on unauthorized data leakage, the risk that misconfigured instances could be taken over, and the possibility that sensitive data could flow to external servers without organizational awareness.

What the Security Industry Concluded

The major security vendors reached similar conclusions independently.

The January 2026 security audit found 512 vulnerabilities. Eight were critical. OpenClaw's own documentation states there is no "perfectly secure" setup. Infostealer malware families like Zestix have already been updated to specifically target OpenClaw configurations and stored credentials.

Safer Alternatives

The right alternative depends on what you were using OpenClaw for.

For Autonomous Task Completion

For Coding Agents

For Self-Hosted with Security

If You Must Use OpenClaw: Hardening Checklist

Frequently Asked Questions

Is OpenClaw safe to use?

Not without significant hardening. OpenClaw has had a critical RCE vulnerability (CVE-2026-25253, CVSS 8.8), a supply chain attack that compromised 1,184 skills on ClawHub, and a malicious npm package (GhostClaw) that deployed a RAT stealing macOS credentials. Malwarebytes and Kaspersky both concluded the tool should not run on primary machines. If you must use it, run it in a dedicated VM, never expose the port publicly, and audit every skill.

What was the OpenClaw npm RAT (GhostClaw)?

GhostClaw was a malicious npm package (@openclaw-ai/openclawai) uploaded on March 3, 2026 that impersonated the official OpenClaw installer. It displayed a fake CLI with animated progress bars, prompted for your system password through a fabricated Keychain dialog, then stole browser credentials from 9 browsers, crypto wallet seed phrases from 8 wallet apps, SSH keys, cloud credentials (AWS/Azure/GCP), iMessage history, and Apple Notes. It installed a persistent RAT with SOCKS5 proxy and live browser session cloning.

What is CVE-2026-25253?

A critical remote code execution vulnerability (CVSS 8.8) in OpenClaw. The server did not validate WebSocket origin headers, allowing any website to steal authentication tokens and execute arbitrary commands on the host machine. Over 42,900 exposed instances were found globally, 15,200 directly vulnerable. Patched in v2026.1.29.

What is the ClawHavoc supply chain attack?

ClawHavoc was a campaign where threat actors uploaded 1,184 malicious skills to ClawHub, OpenClaw's official marketplace. The skills embedded adversarial instructions in SKILL.md files and distributed the Atomic macOS Stealer. Over 9,000 installations were compromised before disclosure on February 1, 2026.

What are the safest alternatives to OpenClaw?

For sandboxed autonomous agents: Claude Computer Use (cloud-isolated VMs) and Devin (fully sandboxed cloud environments). For coding agents without email/calendar access: Claude Code and Codex. For self-hosted with real security: IronClaw (WebAssembly sandboxes), NanoClaw (container isolation), and ZeroClaw (strict sandbox mode).

Can OpenClaw be prompt-injected?

Yes. Unlike chatbots, a prompt-injected OpenClaw instance can execute the attacker's instructions: send emails, exfiltrate files, run shell commands. Cisco researchers demonstrated silent data exfiltration via a malicious skill. Archestra AI's CEO demonstrated full credential theft via a single email in under five minutes. CrowdStrike documented attacks through poisoned social media posts.