Updated October 2026

Is OpenClaw safe?

Short answer: OpenClaw can be run safely, but it is not safe by default for every setup. It is a powerful agent that can read files, run commands and act on your accounts, and its own documentation is clear that the security of an install depends on how you configure it and what you let it run.

This page summarises what the OpenClaw project itself says, the main risks people run into, and how to reduce them. Every claim links to OpenClaw's official site or docs.

What OpenClaw's own security docs say

• It is not a sandbox between untrusted users. The security guide says OpenClaw "is not a hostile multi-tenant security boundary for mutually adversarial users" (security docs).
• Skills and plugins are trusted code. The tool-permission docs say to "treat skill folders as trusted code" and that plugins run in-process with the gateway. They also note that OpenClaw does not run built-in dangerous-code blocking during install or update (tool permissions).
• The defaults are reasonable on a normal install. On a regular host the gateway binds to loopback, gateway auth is required, and unknown direct-message senders get a pairing code. Container images are the exception: they default to an exposed bind, which should be paired with auth (security docs, network exposure).

The main risks

1. Malicious skills

Community skills are the biggest practical risk. OpenClaw says that when ClawHub launched it was "immediately targeted by actors who tried to publish skills bundling known malware" (OpenClaw blog).

The project has responded. Since February 2026 every skill published to ClawHub is scanned with VirusTotal and re-scanned daily, and malicious skills are blocked from download (announcement). Scanning now also uses static analysis and NVIDIA SkillSpector. OpenClaw is candid that "a clean scan doesn't mean a skill is safe", so a passing skill still deserves a read before you install it.

2. An exposed gateway

A gateway reachable from the internet without authentication lets anyone talk to an agent that has your keys and files. The docs say to "never expose the Gateway unauthenticated on 0.0.0.0" and to prefer Tailscale Serve over LAN binds (network exposure).

3. Prompt injection from untrusted content

An agent that reads email, web pages or group chats can be steered by instructions hidden in that content. For agents that handle untrusted input, OpenClaw recommends denying tools such as gateway, cron, sessions_spawn and sessions_send (tool permissions).

4. Fast-moving code

OpenClaw publishes its security work openly. Its security page reports 722 fixed and published advisories and 14 confirmed critical issues, all fixed and disclosed, as of September 2026. That transparency is a good sign, and it also means you need to keep your install updated.

How to harden an OpenClaw install

1. Run the audit. Use openclaw security audit (add --deep for a fuller scan) and fix what it reports.
2. Keep the gateway private. Leave gateway.bind on loopback, keep auth on, and use Tailscale Serve rather than opening a port.
3. Lock down direct messages. Keep the default pairing policy or switch to an allowlist (access control).
4. Sandbox agents. Turn on the Docker or Podman sandbox for agents and keep workspace access at none unless a task needs it.
5. Vet every skill. Read a skill's files before installing, prefer well-known publishers, and restrict who can modify skill folders.
6. Update often and watch OpenClaw's security page.

Safer setups if you'd rather not manage this yourself

If hardening a gateway is more than you want to take on, the alternative is a setup where the safety controls are part of the product:

• CoWork OS runs each task under an access profile (Ask for approval, Approve for me, Full access or Custom) that sets sandbox, filesystem, network and command rules, so risky actions wait for your approval. Skills you import from ClawHub or as SKILL.md bundles are scanned first and quarantined instead of activated if the scan finds a blocking issue. Messaging channels support pairing so unknown senders cannot command your agent. Access profiles · Skill imports · Security guide
• NanoClaw runs each agent in its own container with filesystem isolation.

See OpenClaw alternatives for a full comparison.

CoWork OS itself is free and open source. Model providers, gateways, connected services, and account plans may charge separately and apply their own eligibility and usage rules.

Last reviewed 2026-10-20 against official documentation. Features, plans and prices change; check the linked sources before deciding. CoWork OS is not affiliated with OpenClaw.