We want to be transparent about security. Not the comfortable kind of transparency where you announce things after they're already solved and polished — the kind where we show you the real journey: what we found, what was broken, and how we're continuing to harden the platform.
OpenClaw runs agents that have real capabilities: shell execution, file access, browser control, external API calls. That's powerful. It also means the attack surface is wider than a typical app. We took that seriously this year. Here's the full picture.
15 security improvements shipped in Q1 2026. Today we launched supply-chain-hardener.py — real-time threat detection for skill packages before installation. Open-source and auditable.
These are the 15 security improvements we shipped since the start of 2026. Not a list of features — a genuine audit of what we found and closed.
All skills now pass through a static analysis gate before execution. Patterns associated with credential exfiltration, remote code injection, and filesystem abuse are blocked before the skill ever runs.
Added dependency integrity checks for npm packages included in skills. SHA-256 lockfile validation prevents tampered packages from being loaded silently.
Skills now run in isolated execution contexts. A compromised skill cannot read memory, environment variables, or credentials belonging to another skill or the core agent runtime.
Custom regex + AST scanning detects obfuscated code patterns (base64 eval chains, encoded payloads, dynamic require() abuse) commonly used in supply chain attacks.
ClawHub skills now carry an author reputation score based on publication history, community reports, and automated quality signals. Low-reputation skills trigger install warnings.
Skills declare credential requirements explicitly. Any skill attempting to read credentials it didn't declare is blocked and flagged. No silent credential access.
Skills must declare outbound network destinations. Connections to undeclared hosts are blocked. Prevents exfiltration via unexpected endpoints.
Shell commands triggered by agent reasoning (not just user-initiated) now go through an approval gate. High-risk command patterns (rm -rf, curl | bash, etc.) require explicit confirmation.
API keys and credentials are now stored encrypted at rest with per-session decryption. Keys are never written to disk in plaintext. Session memory is also cleared on exit.
Spawned subagents inherit only the permissions explicitly delegated to them. A subagent cannot escalate to parent-agent capabilities without explicit grant.
All gateway connections now enforce TLS 1.3 minimum. Plaintext gateway connections are rejected. Certificate pinning available for high-security deployments.
SKILL.md files are parsed for prompt injection patterns. Skills attempting to override safety instructions or manipulate agent behaviour via SKILL.md content are quarantined.
Skills cannot exceed defined API call rates. Prevents runaway skills from exhausting API budgets or triggering abuse detection on integrated services.
MEMORY.md and daily memory files are checksummed. Tampering by external processes (or a compromised skill) is detected and flagged before the agent loads context.
Security-relevant events (skill installs, credential accesses, shell executions, subagent spawns) are written to a tamper-evident append-only audit log. Deletions are flagged.
The 15 fixes above close known gaps. These are the next-layer capabilities we're actively shipping — some live today.
Real-time threat scanner for OpenClaw skill packages. Checks against a live threat intelligence database, runs behavioural pattern matching, and blocks known-malicious packages before installation. Open-source, auditable, runs locally. The attack surface for AI agent supply chains is still largely unaddressed across the industry — this is our answer.
Browser automation is one of the largest attack surfaces in agent architectures — a malicious page can attempt to inject instructions via visible content. Snapshot caching reduces live browser sessions by up to 70%, replacing them with verified-clean snapshots for read-only tasks. Fewer live sessions = fewer opportunities for adversarial page content to influence agent behaviour.
As reinforcement learning adapters become more common in agent tooling, we're building a validation layer that verifies RL adapter integrity before loading. Prevents tampered adapters from influencing agent decision-making in subtle, hard-to-detect ways.
Crowdsourced threat reporting from the OpenClaw community, aggregated into a real-time feed. When one user's agent detects a malicious skill pattern, that signal propagates to all users within minutes.
Third-party security audit with published results. We're targeting a reputable firm for a proper pen test of the gateway, skill execution environment, and memory system. Results will be published in full — not just the clean bill of health parts.
Security posture looks different across agent platforms and automation tools. Here's an honest snapshot of where things stand — not a marketing comparison, just what we know to be true.
To be clear: raw Claude (no sandboxing) isn't a criticism of Anthropic — it's the right tradeoff for an API. n8n and Zapier are workflow tools, not agent execution environments. Different tools, different threat models. We're comparing like-for-like where OpenClaw actually operates.
The comparison that matters most: OpenClaw runs persistent agents with shell access, file system access, and real-time browser control. That's a fundamentally different threat model from a stateless API or a no-code automation platform. Our security posture has to match that reality.
Security is not a launch event. It's a continuous process. Here's what we commit to:
See the full skill security audit →
Detailed breakdown of every vetting check, the threat patterns we scan for, and how the quarantine system works in practice.
Explore GetAgentIQ →Built by GetAgentIQ — getagentiq.ai