Can you speak a little bit more to the stats in the OP?

* 135k+ OpenClaw instances are publicly exposed

* 63% of those run zero authentication. Meaning the "low privilege required" in the CVE = literally anyone on the internet can request pairing access and start the exploit chain

Is this accurate? This is definitely a very different picture then the one you paint

> We're working hard to harden the codebase with folks from Nvidia, ByteDance, Tencent and OpenAI.

What exactly does this mean? You have contracts with these companies? People who work for them contributed sometimes in the past to openclaw repository?

Nvidia, ByteDance, Tencent and OpenAI?! Wow!

My reply which was not an attack was detached from this sub thread as an attack. All I did was ask a clarifying question about why Telegram and Discord were specifically called out in this reply despite not being mentioned by the OP at all. I'd still like an answer to this question.

I could not stop myself from looking at this user's submission history, looking for a ShowHN about Clawdbot. No such submission exists.

I can understand why, but given that OpenClaw has taken over the world, I find the lack of a ShowHN somewhat interesting.

[flagged]

That is genuinely horrifying. I wonder what the stats are for an average "artisan, hand-typed" project would be if it got as much attention as OpenClaw has. But 1.8 CVEs a day should scare any rational people away from the software... right? Surely?

Maybe the moderators removed it for being AI spam. The user’s entire post history besides this post are generated ads for their AI projects.

Thanks, we'll put that link in the toptext as well.

This is why kernel-level sandboxing matters. I use a sandbox name greywall that enforce filesystem/network isolation at the syscall level (Landlock + Seccomp + eBPF on linux, sandbox-exec on mac).

I do disagree about unix system were designed for this kind of stuff. Unix was not designed for an agent to act like you and take decision for you...

Yes, if/since that user have no access to your apple id and keychain...

Not too much harder is using a VM:

With Apple's open-source container tool, you can spin up a linux container vm in ~100ms. (No docker root)

With Apple virtualization framework, you can run macOS in a VM (with a separate apple id).

The biggest problem is the people who don’t have the necessary IT understanding to secure such things are probably completely unaware this is even happening.

Gonna be honest. I'd rather fight climate change than have people run LLMs unsecured

With your car example, you also assume the risk unto others. If your "chopper" of a car hits and kills someone else, and you survive, you're paying for the consequences of that. I don't think it's cool that untrained people can do interesting IT stuff now. I see it as a huge liability where some unsecured instance pwns the internet, then it's some 12 year old that gets marched in front of congress and everyone goes: "wtf?" There's essentially no accountability and the damage is still done.

1/5 rounds to “probably” when discussing security.

More than 25% of users seems like a pretty accurate "probably".

The 135k instances is likely not true at all.

This sounds like a classic case of "35% of statistics are made up"

It’s also only 65% of those that have zero authentication configured, according to that post (which I have done nothing to confirm or challenge at all… Frankly I wouldn’t touch OpenClaw with a ten foot… cable?) That said, I think it’s far more important to get people’s attention who might otherwise not realize how closely they need to pay attention to CVEs than it is to avoid hyperbole in headlines.

Until recently, this was default configuration

Edit: Default binding was to 0.0.0.0, and if you were not aware of this and assumed your router was keeping you safe, you probably should not be using OpenClaw. In fact some services may still default to 0.0.0.0: https://github.com/openclaw/openclaw/issues/5263

https://github.com/openclaw/openclaw/commit/5643a934799dc523...

I'm using Hermes. The same applies to all agents, don't give it free reign over all your stuff. Run it within a sandbox.

https://github.com/nousresearch/hermes-agent

NemoClaw is an OpenClaw security wrapper, not a replacement

It's shit, but most people don't know better

Wow. The advisories page is worthy of a post in itself.

It does not need access to your full machine. It can literally run in a vps.

Upvoted because, yup, it's insanity.

However:

> Why on earth would you install something like that has access to your entire machine, even if it is a separate one which has the potential to scan local networks?

I'd say that it's a given that we live in a world when your LAN is infested with compromised and hostile devices: from phones (spying devices) to home automation (spying chinese webcams) to TVs (with the TV's microphone listening 24/7 to everything people are saying) to chinese routers (which, yup, have backdoors for the chinese state) to that corean soundbar to really whatever enshittied device the world of enshittified turds we live in can come up with.

It is a fact of life that compromised, insecure, backdoored and at times all three of these shall find their way to our homes and appartments...

And it shouldn't be an issue.

What I mean by this: machines could be scanning my local networks and even maybe determine that this box at this IP is running Linux and... It still should be able to do exactly jack fucking shit with that information.

We must all learn to secure our devices for the Internet of Insecure and Enshittified Things is moving forward at godspeed. And if you think OpenClaw on its own device on your LAN is bad, wait until all the companies that were already selling enshittifed devices since years realize they'll now be able to enshittify those even more by slapping OpenClaw (or the equivalent) on their devices.

These insecure turds are all going to get a big boost of insecuredness, this time AI powered.

I'd say: bring it on. I'm ready. We all should be.

How could it be? Everything it does it does with its caller's privilege. It's not hacking your machine.

Run it as root it will have root caps, run it as ritcgab it will have ritcgab's caps. Same as every other program.

They didn't say the "folks" from those companies were engineers! Maybe it's a group of PMs from Nvidia, ByteDance, Tencent and OpenAI that are working to harden the codebase.

Coding is solved, but problems with code is not yet solved.

> But coding is solved?

My belief, is the people who post this quote thinking it's some big win are the same people who are upset they can't post "stochastic parrot" anymore.

And we all saw how that went.

I've only been playing with it recently ... I have mine scraping for SF city meetings that I can attend and public comment to advocate for more housing etc (https://github.com/sgillen/sf-civic-digest).

It also have mine automatically grabs a spot at my gym when spots are released because I always forget.

I'm just playing with it, it's been fun! It's all on a VM in the cloud and I assume it could get pwned at any time but the blast radius would be small.

I use it for a side project. I just put it on VPS, and then it edits the code and tests it. The nice thing is that I can use it on the go whenever I have spare moment. It is addictive, but way better addiction than social media IMO.

The thing where you give it access to all your personal data and whatever I haven't done and wouldn't do.

I use it to manage a media server. And use natural language to download movies and series. Also I use to for homeassistant so I csn use natural language for vacuuming the house and things like that. I do use it for a number of other tasks but those are the most partical.

I don't use this one, but a simpler one, also running on a vps. I communicate via telegram.

I say to it: check my pending tasks on Todoist and see if you can tackle on of those by yourself.

It then finds some bugs in a webapp that I took note. I tell it to go for it, but use a new branch and deploy it on a new url. So it clones the repo, fix it, commit, push, deploy, and test. It just messages me afterwards.

This is possible because it has access to my todoist and github and several other services.

I use it mostly for the crons, it runs a personal productivity system that tracks my tasks, provides nudges, talks through stuff etc. It's all stored in an Obsidian vault that syncs to my desktop. I don't use it to control email/calendars or other agents.

I was asked by someone recently to try to set up an OpenClaw that would search for ordinances and other land registry information for all 3000+ counties/parishes in the USA to obtain and distill specific details on their support for building tiny homes.

I am experimenting prompt injection on OpenClaw [0][1], quite exciting.

[0] https://itmeetsot.eu/posts/2026-03-27-openclaw_webfetch/

[1] https://itmeetsot.eu/posts/2026-03-03-openclaw3/

Agent based chron jobs mostly that work with other agents. It’s really nice if you want to tell your computer to do something repeatedly or in confluence with many other agents in a very simple way. Like check my email for messages from Nadia and send me a notification and turn on all the lights in my driveway when she gets there without having to actually get into the nuts and bolts of implementing it. It’s actually really powerful and probably what Siri should be.

so far, I've used it to kill a bunch of time trying to get it to respond to "Hi @Kirk" in a private Slack channel.

...and to laugh a little every time it calls me "commander" or asks "What's the next mission?" or (and this is the best one) it uses the catchphrase I gave it which is "it's probably fine" (and it uses it entirely appropriately...I think there must have been a lot of sarcasm in qwen 3.5's training data)

and I've treated it like it's already been compromised the whole time.

I give it monumental tasks. For example, I will write massive markdown files describing all the features I want to see in an application, and I will use a standard AI chatbot to check my work and consider additional details. Finally, when I have everything written down, I upload it to OpenClaw and tell the agent to make it happen.

Sometimes it toils away for 2+ hours, spawning Claude Code instances, checking its work, testing the code, even using browser automation to make sure everything works the way it is supposed to if it's writing a webapp.

In the end, it consumes like $10-20 worth of tokens and spits out a functional application with everything I asked for.

Claude Code can do this on its own, to an extent, but there's something about getting OpenClaw to iterate through multiple sessions and testing everything to make sure it works the way I described that I really like. It completely offloads the process to the AI, and keeps me mostly out of the loop.

Is the code any good? Probably not. Am I at risk of being exploited by malware? Probably. But I have automated quite a lot of things with the software that OpenClaw builds for me, and I am careful to review the libraries it imports before running the code on any machine with actual access to anything I actually care about.

Personally, anyone using OpenClaw for the "it reads your emails" use case is crazy, because prompt injection is real, and you're basically inviting anyone who knows your email address to take a stab at pwning you, with full access to your personal life. I keep my instances on a VPS, behind a restrictive security group, and only accessible via Tailscale where it has zero access to anything on my tailnet. I only recently gave it its own email account (not mine!), but even then I am skeptical of doing so, and take efforts to prevent it from taking action on any email it receives (e.g., disabling the Heartbeat) because who knows what it'll end up doing. I mostly like that it can email me if I ask it to.

my claw controls my old M2 mac, mostly my claw uses Claude code to code

Assuming you're asking in good faith, IMHO the deeper story around OpenClaw is that it's the core piece of a larger pattern.

The way I'm seeing folks responsibly use OpenClaw is to install it as a well-regulated governor driving other agents and other tools. It is effectively the big brain orchestrating a larger system.

So for instance, you could have an OpenClaw jail where you-the-human talk to OpenClaw via some channel, and then that directs OpenClaw to put lower-level agents to work.

In some sense it's a bit like Dwarf Fortress or the old Dungeon Keeper game. You declare what you want to have happen and then the imps run off and do it.

[EDIT: I truly down understand sometimes why people downvote things. If you don't like what I'm saying, at least reply with some kind of argument.]

We detached this subthread from https://news.ycombinator.com/item?id=47629849 and marked it off-topic.

The current OpenClaw GitHub repo [1] contains 2.1 million lines of code, according to cloc, with 1.6M being typescript. It also has almost 26K commits.

[1] https://github.com/openclaw/openclaw

There are like 10 openclaw clones out there. If you prefer security over features, just pick up another one.

[flagged]

[flagged]

[flagged]

If you're running OpenClaw, you already threw security and reliability out the window by running LLMs on the command line. It's a bit late to start worrying now.

[flagged]

Guys, OpenClaw is a toy, that's it!

The link mentions the CVE, here's the link https://nvd.nist.gov/vuln/detail/CVE-2026-33579

The CVE seems to be real.

Flag then move to the next one

As if the non-Reddit links aren’t majority AI slop already.

We need a new word for people who use the word ‘Luddite’ to refer to ‘reasonable concern over the reckless use of new technology’.

Is it Ludditism to not want to get PWNed spending $3k a month?