Is My AI Agent Safe? The 12-Point Security Checklist for OpenClaw Owners

Scheduled for 21 Oct 2026. This guide is not published yet.

How should I use this checklist?

Work top to bottom. Points 1 and 2 tell you where you stand. Points 3 to 8 close the paths someone would use to get in or steer your agent. Points 9 to 12 limit the damage if something still goes wrong.

None of this makes an agent "safe". Microsoft's security team describes self-hosted agents as untrusted code and untrusted instructions meeting in one loop that runs with your credentials. The aim is to make that loop small: fewer people who can reach it, fewer things it can do, and less it can lose.

OpenClaw's own security docs are the source of truth, and each point links to them in the sources below. If our wording and the docs ever disagree, follow the docs.

1. Have I run the security audit?

OpenClaw ships its own audit. Run it on the machine where the Gateway runs:

openclaw security audit --deep

--deep adds a live check against the running Gateway and scans installed skill and plugin code. Fix every critical first, in the order the docs give: open access with tools enabled, then network exposure, then browser control, then file permissions, then plugins. openclaw security audit --fix handles file permissions and open group policies. It doesn't rotate keys, change your bind or remove skills.

Our audit guide explains every finding in plain English.

2. Am I on a current version?

openclaw --version
openclaw update --dry-run

As of October 18, 2026, 2026.8.1 is the floor for the Gateway and CLI. That release (August 31, 2026) fixed 48 advisories, 17 of them high severity. Treat it as a minimum, not a target. The current releases are 2026.10.4 on npm latest and 2026.9.33 on extended-stable. If you use the OpenClaw iOS app, it has its own version numbers. Check its advisories separately.

Old versions carry known holes. For example, CVE-2026-25253 (fixed in 2026.1.29) let a crafted link send your Gateway token to an attacker. The advisory notes it worked even when the Gateway listened only on your own machine. Preview upgrades with --dry-run and read the release notes for breaking changes.

3. Is my Gateway private?

The Gateway listens on port 18789 by default. It should answer only on your own machine (gateway.bind set to loopback, the default on a regular install). If you need remote access, use an SSH tunnel or Tailscale Serve. Don't publish the port, and don't use Tailscale Funnel for everyday access.

Container images are the exception: they default to an exposed bind, so pair them with auth and a firewall. Our exposure guide shows how to check from outside in five minutes, and our VPS guide walks through a private setup on DigitalOcean, Hetzner and AWS.

4. Is Gateway auth strong?

Use token auth with a long random token. The audit flags blank or placeholder tokens as critical and warns under 24 characters. OpenClaw can generate one for you:

openclaw doctor --generate-gateway-token

If you use webhooks, give them their own token. The audit flags hooks.token_reuse_gateway_token as critical, because one leak would unlock both.

5. Do I control who can message it?

Every message your agent reads is a chance for someone to steer it. OpenClaw's access-control docs set DMs to pairing by default: unknown senders get a code and are ignored until you approve them. Keep it that way, or use an allowlist.

• Treat dmPolicy: "open" as a deliberate choice, never a default.
• Require mentions in groups where strangers can post.
• If more than one person can DM the agent, set session.dmScope to per-channel-peer so they don't share one conversation.
• Never combine a "*" allow-all list with powerful tools.

6. Have I limited what tools it can use?

Decide what the agent actually needs. OpenClaw's exposure runbook gives a minimum baseline for any deployment others can reach:

{
  gateway: {
    bind: "loopback",
    auth: {
      mode: "token",
      token: "replace-with-a-long-random-token",
    },
  },
  session: {
    dmScope: "per-channel-peer",
  },
  agents: {
    defaults: {
      sandbox: { mode: "non-main" },
    },
  },
  tools: {
    profile: "messaging",
    exec: { security: "deny", ask: "always" },
    elevated: { enabled: false },
  },
}

Widen one control at a time. For any agent that reads untrusted content, the docs also recommend denying the control-plane tools (gateway, cron, sessions_spawn, sessions_send), because they can change the agent or keep work running after the chat ends. Keep elevated mode, which runs commands outside the sandbox, off for anyone you don't fully trust.

7. Is it sandboxed?

The sandbox runs the agent's tools in an isolated container instead of directly on your machine. The baseline above sets sandbox.mode to non-main, which sandboxes everything except your own main session. Keep the sandbox's view of your files narrow: the default workspaceAccess of none hides the agent workspace, and ro makes it read-only. Never mount system folders, credential folders or the Docker socket into it. The audit flags that as sandbox.dangerous_bind_mount (critical).

8. Do I know what every skill and plugin does?

A skill or plugin is code you've chosen to run. OpenClaw's docs say plugins run inside the Gateway and should be treated as trusted code, and that skill folders should be treated the same way, with tight control over who can change them. Microsoft calls installing a skill "basically installing privileged code".

• Install only from sources you trust, and prefer pinned, exact versions.
• Set an explicit plugins.allow list so nothing loads by accident.
• Remove anything you don't recognize or no longer use.
• Read the skills.code_safety and plugins.code_safety findings from --deep. Remember the scan looks for patterns and has size limits. A clean scan isn't proof a skill is harmless.
• Since 2026.8.1, OpenClaw can learn skills and apply scanner-approved ones automatically by default. Review what's been added, and turn that off if you want every skill to be your decision.

9. Are my keys locked down on disk?

OpenClaw's docs say to assume anything under ~/.openclaw may contain secrets: config tokens, channel credentials, model keys and session transcripts.

• Keep permissions tight: 700 on directories, 600 on files. openclaw doctor and --fix can set them.
• Use full-disk encryption on the machine.
• Don't keep OpenClaw's state in iCloud, Dropbox or Drive. The audit warns about this as fs.synced_dir.
• When sharing diagnostics, use openclaw status --all, which redacts secrets, rather than raw logs.
• Give each agent its own API key, so a leak can be revoked without breaking anything else.

10. Does it use dedicated accounts?

Your agent can act with whatever accounts you connect. Microsoft advises dedicated, non-privileged credentials and non-sensitive data only. OpenClaw's docs say not to sign the runtime into personal Apple or Google accounts, password managers or browser profiles. The Dutch data protection authority warns against using agents like OpenClaw on systems with sensitive data such as access codes, financial records or identity documents.

If the agent needs email, a calendar or a GitHub account, give it its own, with the narrowest permissions that work.

11. Is there a cap on what it can spend?

A stolen key or a runaway loop shows up as a bill. Spend limits usually live at the provider account or project level, not on the key itself. OpenAI, for example, sets hard limits per organization or per project. Its spend alerts only notify you and don't stop traffic, and it notes that recorded spend can slightly exceed a hard limit. To cap one agent, give it its own project with its own hard limit. Other providers differ, so check their docs.

Check the heartbeat too. It runs a full agent turn on a schedule (every 30 minutes by default), so a premium model on a short interval costs money even when nothing happens. OpenClaw's heartbeat docs suggest a cheaper model, isolatedSession: true and lightContext: true to cut that cost.

12. Do I have a kill switch?

Write this down before you need it. From OpenClaw's incident response steps:

1. Contain: stop the Gateway, set gateway.bind back to loopback (or turn off Tailscale Serve or Funnel), and set risky DMs and groups to disabled or mention-only.
2. Rotate: change the Gateway token or password, remote client secrets, and every model and channel key the agent held.
3. Review: check openclaw logs, recent config changes and session transcripts for anything you didn't do.
4. Re-check: run openclaw security audit --deep and confirm the criticals are gone.

Keep a backup you can rebuild from. openclaw backup create makes an archive, but it contains your secrets, so store it like your keys.

What does this checklist not cover?

It doesn't cover prompt injection in depth (content the agent reads that tries to give it orders), team or multi-user setups, or compliance. OpenClaw's docs assume one trust boundary per Gateway. If people who don't trust each other share an agent, give them separate Gateways. For a broader framework, see the OWASP Top 10 for Agentic Applications and our OWASP explainer.

For everything OpenClaw-specific, start at the OpenClaw hub. Unfamiliar terms are in the glossary. The free check reads the output of points 1 and 2.

Frequently asked questions

Sources

1. OpenClaw docs: security overview
2. OpenClaw docs: openclaw security (CLI)
3. OpenClaw docs: running the security audit
4. OpenClaw docs: security audit checks
5. OpenClaw docs: network exposure
6. OpenClaw docs: Gateway exposure runbook
7. OpenClaw docs: hardened baselines
8. OpenClaw docs: access control and allowlists
9. OpenClaw docs: tool and agent permissions
10. OpenClaw docs: secrets, storage and logs
11. OpenClaw docs: operator incident response
12. OpenClaw docs: heartbeat
13. OpenClaw docs: openclaw update (CLI)
14. OpenClaw 2026.8.1 release notes (GitHub)
15. NVD: CVE-2026-25253
16. GitHub advisory GHSA-g8p2-7wf7-98mq
17. OpenAI API docs: spend limits
18. Microsoft Security Blog: Running OpenClaw safely (Feb 19, 2026)
19. Autoriteit Persoonsgegevens: AP warns of major security risks with AI agents like OpenClaw (Feb 12, 2026)
20. OWASP Top 10 for Agentic Applications for 2026