OpenClaw introduces huge risks to enterprises, but employee adoption might be inevitable -- whether CISOs sanction it or not. Here's how to enable safer deployments.
OpenClaw has become one of the fastest adopted open source tools in recent memory. Originally released in late 2025 under the name Clawdbot, this autonomous AI agent now boasts hundreds of thousands of GitHub stars and a rapidly expanding ecosystem of third-party skills.
For enterprise CISOs and other business leaders, OpenClaw's appeal is obvious: It can automate routine workflows, manage calendars and inboxes, and interact with SaaS platforms through natural language commands. But that convenience comes with a threat surface that traditional security models were never designed to address.
Why CISOs should care about OpenClaw
OpenClaw operates by bridging large language models and local system resources. It can run shell commands, control browsers, read/write files and interact with external services, which users can trigger from chat messages on platforms such as Slack, Signal and Discord.
The very permissions that make it useful, however, also make OpenClaw dangerous. When connected to corporate tools such as Google Workspace or Microsoft 365, OpenClaw gains access to emails, documents, calendar entries and OAuth tokens that could enable lateral movement across your environment. Security researchers have described this combination of private data access, external communication capability and exposure to untrusted content as a lethal trifecta for enterprise AI risk.
OpenClaw security risks
OpenClaw risks are not theoretical. Security researchers have identified more than a million OpenClaw instances exposed to the public internet, including 100,000-plus that were directly vulnerable to remote code execution. A critical vulnerability, CVE-2026-25253, was disclosed with a CVSS score of 8.8, alongside multiple command injection advisories. Making matters worse, in early 2026, researchers found roughly 17% of the public ClawHub skills registry contained malicious code, including payloads that enable credential theft and data exfiltration.
Perhaps most concerning for enterprise security teams is the shadow AI dimension: OpenClaw requires no administrator privileges to install and generates no distinctive network signatures that standard monitoring tools would flag.
Actionable steps to manage OpenClaw risk
Despite their considerable security risks, agentic AI tools such as OpenClaw are likely here to stay. Given the technology's productivity benefits, CISOs might find employee adoption continues whether security teams sanction it or not.
Given the technology's productivity benefits, CISOs might find employee adoption continues whether security teams sanction it or not.
The most effective approach is not to ban OpenClaw outright, but to incorporate it into your existing risk management framework. Start with clear policies, isolated environments, vetted supply chains and continuous monitoring.
Establish governance before deployment
Before permitting OpenClaw in any capacity, define an acceptable use policy that specifies which teams can deploy the agent, what data it can access and which integrations are approved.
Treat OpenClaw instances as you would any privileged service account, using formal provisioning, review cycles and offboarding procedures.
Isolate the runtime environment
Deploy OpenClaw only within dedicated VMs or containers that are segmented from production networks and sensitive data stores.
Use nonprivileged, purpose-built credentials with the minimum permissions necessary. Microsoft's security guidance specifically recommends treating the agent runtime as an untrusted execution boundary.
Before deploying any skill, review its SKILL.md manifest and source code for hidden network calls or suspicious behavior. Never promote a new skill directly to production without sandbox testing first.
Implement continuous monitoring
Configure detailed logging of all agent actions, including command execution, API calls and chain-of-thought artifacts. Forward these logs to your SIEM and build detection rules similar to those used for living-off-the-land attacks. Endpoint security alone cannot interpret agent behavior, so behavioral analytics and anomaly detection are essential complements.
Key control families that CISOs should prioritize include access control, audit and accountability, system and communications protection, and supply chain risk management. Mapping your OpenClaw deployment to these controls provides both a defensible security posture and a common language for communicating risk to the board.
Note that in OpenClaw deployments, traditional endpoint and network security tools see processes running and API calls being made, but they cannot interpret agent behavior or distinguish legitimate automation from compromise. Closing that visibility gap is the central challenge. The organizations that establish these guardrails now will be best positioned to harness autonomous AI safely as the ecosystem matures.
Matthew Smith is a vCISO and management consultant specializing in cybersecurity risk management and AI.
