Security Guide
Security models, sandboxing, and best practices for OpenClaw
Security models, sandboxing, and best practices for OpenClaw
Important: OpenClaw connects to real messaging surfaces. Treat inbound DMs as untrusted input. This guide explains how to secure your OpenClaw installation.
Personal assistant trust model: OpenClaw assumes one trusted operator boundary per gateway (single-user/personal assistant). It is not a hostile multi-tenant security boundary for multiple adversarial users sharing one agent/gateway. If you need mixed-trust or adversarial-user operation, split trust boundaries—separate gateway + credentials, ideally separate OS users/hosts. Full threat model and operator trust details: docs.openclaw.ai/gateway/security.
If you believe you've found a security issue in OpenClaw, report it privately. Do not open a public issue. The project's Security page on GitHub describes how to report and what to include (reproduction steps, impact, and if possible a minimal PoC). Past advisories and patched versions are listed in the GitHub Security Advisories—keep OpenClaw updated to a patched release.
OpenClaw publishes security advisories for known vulnerabilities. Check GitHub Security Advisories for the full list. When a CVE or advisory is released, upgrade to the patched version promptly. Run openclaw update or follow Release notes for version history. Node.js 22.12.0+ is required—it includes fixes (e.g. CVE-2025-59466, CVE-2026-21636). Stay on supported versions to avoid known issues.
The OpenClaw project runs a formal Trust & Security Program covering the full ecosystem (CLI, Gateway, apps, ClawHub, extensions). Full details: trust.openclaw.ai.
Report to the repo where the issue lives: Core/Gateway/apps → openclaw/openclaw; ClawHub → openclaw/clawhub; Trust/threat model → openclaw/trust. If unsure, email security@openclaw.ai. Include severity, impact, reproduction steps, and remediation advice. Good-faith researchers are not pursued legally. There is no formal bug bounty program; see the SECURITY.md for full reporting requirements, out-of-scope items, and Report Acceptance Gate.
Run openclaw security audit --deep (and optionally --fix) to check DM policy, allowFrom, exec security, gateway binding, and workspace exposure. Defaults are secure (pairing, exec deny, gateway auth). Follow progress: Trust program, GitHub security-labeled issues.
Keep gateway authentication configured for any non-loopback use. From 2026.2.19, when gateway.auth.mode is "none", the security audit reports gateway.http.no_auth: it warns for loopback and flags critical severity if the Gateway HTTP APIs are reachable from the network. Use token or other auth in production; reserve "none" only for intentional local loopback setups.
Gateway lock and tool-call synthetic IDs now use SHA-256 instead of SHA-1, with the same truncation length so behavior stays deterministic. Owner-ID obfuscation uses a dedicated HMAC secret from config (ownerDisplaySecret), so obfuscation is decoupled from gateway token handling and easier to control. The embedded agent runner has a capped retry limit with an explicit retry_limit error when retries do not converge (see GitHub Security Advisories for advisories such as GHSA-76m6-pj3w-v7mf).
OpenClaw requires Node.js 22.12.0 or later. This version includes important security fixes (e.g. CVE-2025-59466, CVE-2026-21636). Verify with node --version.
The Control UI / web interface is intended for local use only. Do not bind it to the public internet; it is not hardened for public exposure.
When running in Docker: the official image runs as a non-root user. For additional hardening, use --read-only when possible and limit capabilities with --cap-drop=ALL:
docker run --read-only --cap-drop=ALL \
-v openclaw-data:/app/data \
openclaw/openclaw:latestSee SECURITY.md for full guidance.
Many users run OpenClaw on a separate machine or VM (e.g. dedicated Mac Mini, guest WiFi) so the agent does not have access to their personal accounts or credentials. Giving the agent its own accounts (Gmail, GitHub, etc.) instead of sharing yours reduces risk—if the agent is compromised, your identity is not. Trust is earned: even with your own setup, supervising the agent (e.g. approving posts before they go out) is common until you are comfortable. See DM pairing and sandboxing below.
OpenClaw uses a layered security approach:
Default behavior on Telegram/WhatsApp/Signal/iMessage/Microsoft Teams/Discord/Google Chat/Slack:
dmPolicy="pairing") - Unknown senders receive a short pairing codeopenclaw pairing approve <channel> <code>To allow public DMs (not recommended for most users):
dmPolicy="open""*" in the channel allowlist (allowFrom)Warning: Only use open DM policy if you understand the security implications and have proper sandboxing configured.
Email (Gmail, etc.): Giving OpenClaw access to your main inbox is a significant prompt-injection and phishing vector—inbound email can contain instructions or links meant to steer the agent. Unless you need email automation, avoid connecting your primary account; if you do, use a dedicated account or strict filters. See Tips & best practices for more.
X (Twitter): X has been tightening enforcement on bots and automated posting. Do not give OpenClaw its own X account or rely on it for automated X posting; account restrictions are common. Prefer other channels for automation.
To sandbox group chats and non-main sessions:
{
"agents": {
"defaults": {
"sandbox": {
"mode": "non-main"
}
}
}
}This runs non-main sessions (groups/channels) inside per-session Docker sandboxes. Bash commands then run in Docker for those sessions.
Default Allowlist:
bash, process, read, write, editsessions_list, sessions_history, sessions_send, sessions_spawnDefault Denylist:
browser, canvas, nodes, crondiscord, gatewayYou can customize these lists per session or globally.
For group chats, OpenClaw provides several security layers:
{
"channels": {
"telegram": {
"groups": {
"*": {
"requireMention": true
},
"123456789": {
"requireMention": false,
"activation": "always"
}
}
}
}
}The Gateway can be secured with:
gateway.auth.mode127.0.0.1 for local accessFor remote Gateway access:
Never expose the Gateway directly to the internet without proper authentication.
Connecting your OpenClaw agent to social networks like Moltbook introduces additional security considerations:
To secure your agent when connecting to social networks:
OpenClaw is designed for privacy:
Note: When connecting to social networks like Moltbook, your agent's posts and interactions are publicly visible. Review what your agent shares to ensure you're comfortable with the information being exposed.
Your workspace, memories, and configuration are stored as files you can inspect, edit, or delete at any time.
Deploying OpenClaw in business or enterprise environments requires additional security considerations:
Employees may install OpenClaw without IT approval, creating shadow IT risks. This can lead to:
openclaw doctor and security scanning tools regularlySkills from ClawHub and other sources can pose security risks if not properly vetted. Malicious skills have been discovered that attempt to steal cryptocurrency, access sensitive data, or compromise systems.
OpenClaw partners with VirusTotal to add security scanning for skills on ClawHub. All skills published to ClawHub are now scanned using VirusTotal’s threat intelligence and Code Insight (LLM-powered analysis of what the code actually does).
Scan results and links to the full VirusTotal report appear on ClawHub skill pages. This is one layer of defense—it helps catch known malware and suspicious patterns but is not a silver bullet; prompt injection and social engineering are still possible. Keep using sandboxing, tool policies, and manual review. Full announcement and trust program: OpenClaw blog – VirusTotal partnership; trust.openclaw.ai.
Critical: Always review skills before installation, especially from ClawHub or unknown sources. Malicious skills can:
You can give your agent a written security policy in a file called SHIELD.md—a community proposal that tells the agent how to react when something matches a known threat (e.g. block this skill, ask before that tool call). Log, require approval, or block. There’s no runtime enforcement; the model has to be instructed to follow it, so keep using sandboxing and tool policies too. The SHIELD guide covers how it fits with AGENTS.md, SOUL.md, and MEMORY.md, and how to fill it (e.g. from threat feeds like MoltThreat).
Before installing any skill, follow this review process:
SKILL.md) and review the tools and instructionsFor more information about skills security, see the Skills Guide.
openclaw doctor to check for misconfigurationsopenclaw doctorUse the built-in commands to check and harden your setup:
openclaw doctor
openclaw security audit --deep --fixopenclaw doctor surfaces risky DM policies, misconfigured sandbox settings, missing authentication, and other warnings. For threat-model and hardening guidance (including automated fixes), use openclaw security audit --deep and --fix as described in the official gateway security docs.
These checks help you find: