OpenClaw AI Agent Security Flaws: Prompt Injection, Data Exfiltration, and Critical Authorization Bypass
If you’re running a self-hosted OpenClaw instance — and odds are you are, given the platform’s explosive growth — today’s news from China’s National Computer Network Emergency Response Technical Team (CNCERT) is a wake-up call you shouldn’t scroll past. CNCERT has officially warned that OpenClaw’s default security configurations are dangerously weak, and the numbers behind that warning are staggering: over 135,000 public instances running with zero authentication. Two active CVEs. And a Chinese government ban on OpenClaw deployments in government systems. ...