OpenClaw Users Are Exposed Right Now

0:00I want to give you some news that I wish I didn't have to share, but it's important that everyone on this channel understands what is going on when it comes to open claw security and it could affect how you build in the future. I mean that literally. You know, if you're using open claw and you're using it right now in April 2026, story is about you or it could be potentially and you need to know about it before you open your laptop this morning and get going with open claw. Security researchers just found about 43,000 open claw instances exposed to the open internet. Not in a lab environment, in the internet and that matters. Real machines running real agents where real data can get exposed. About 15,000 of those instances were vulnerable to remote code execution and in the last 4 days alone,

0:46nine new CVEs were published in 4 days. That's not a slow week. That's a huge dumpster fire and I want to say something directly before I get into the details. We talk about security a lot in the community and people always ask me what should I do to secure my setup? Well, in this video we're going to walk through the dangers of tightening down the hatchet when it comes to your open claw and kind of going over some best practices. You know, I'm not sharing this to be dramatic. I'm not sharing this to get the clicks. It's just an actual reasonable question that people have. You know, they're installing open claw and they want to be secure and I get that. You know, the threat is real and the people who know about it are acting and taking action, they're going to be just fine. It's the people who scroll past this video who are going to have a problem. You know, not today, but

1:31at some point you will have a problem if you're not putting security first. I'm going to walk you through what exactly happened so you can get more context behind it and what the actual risks are if you don't take security measures seriously and the most importantly, you know, how to know if you're one of those instances that are out in the public and what to do if you are. So, the first thing is how do you even end up with an exposed open claw instance? Like what is that exactly? Because when I first heard 43,000 instances exposed, I thought who was doing this? Is it me? I don't know. Who sets up an AI agent and then just makes it public? And you know, the straight up answer is that most of these people did it by accident. It wasn't purposeful. Not careless, you know, not

2:16carelessly in a reckless way. They just didn't follow the understanding of what was being exposed. The most common scenario is port forwarding. You set up open claw on your home machine or a cloud server, let's say. You want to access it remotely because that's convenient. So, you open a port in your router. You know, you forward it to your machine and now your open claw instance is reachable from any browser anywhere in the world. If you didn't also set up authentication on top of that, you just handed anyone with an internet connection direct access to your AI agent. The second scenario is cloud deployments. Without firewalls, you spin up a VPS, say on Digital Ocean or Hetzner or AWS. You install open claw. You don't configure the firewall because

3:02you're focused on getting the agent running, not the network layer. The default port is open. The instance is publicly accessible. The firewall configuration just never happened because it wasn't the exciting part of the setup. The third scenario here is and this one is subtle, but misconfigured reverse proxy setups. So, if you're trying to put open claw behind Nginx or Caddy to get a clean domain and HTTPS, something in the config is wrong. Your intended internal only service ends up publicly routed through the proxy. So, you think you're secure, but you're actually not. Real quick, before we keep going, if you're watching this and you want to actually build with some of these tools, >> [music] >> not just watch videos about them, they're going to want to check out our community down below Shipping School. We

3:47have a full cloud code course, a full open claw course and four live bootcamps every single week where we actually help you get set up from scratch. [music] Like actually set this thing up, not just watch a tutorial and figure it out by yourself. And we also provide one-on-one coaching so you could book a call with me, we could share screens and I can help you get cloud code or open claw running on your machine. That's it, no fluff. I built this community because watching YouTube's only gets you so far. We launched it just 3 days ago and we have over 55 members. You need people around you who are actually building, people who hold you accountable and coaches who can help you when you get stuck. I'll put the link in the description down below. Get in now before the price goes up. None of these

4:32people intended to expose their agents. That's the key thing here. They were focused on building the thing and the security layer just fell through the cracks and I understand this pattern completely because I've been there on other projects. You're excited about what you're building, you want it to get working and security is the thing you'll fix later and that later never ends up happening. Now, here's what the researchers actually found and what the nine CVEs are about. I want to be specific because vague security researchers found vulnerabilities is not enough context and that's not going to help you. What you need is what was actually vulnerable so you can assess your own exposure in your own setup. The first category is authentication gaps in older versions. So, some versions of open claw had no authentication by

5:18default on the local web interface. If you could reach the interface, you could use it. So, if you had no password, no token, nothing blocking access, any exposed instance running those versions was fully open to anyone who found it. An attacker scanned the internet constantly for exactly this kind of thing. Automated scanners, no human needed, just ports being swept 24 hours a day. The second category is prompt injection through the file system. So, if an attacker can get a file onto your system that your agent reads as part of its workflow, they can inject instructions into that file. That's why I never recommend downloading skills that you don't know about. Take the URL of the skill, give it to your agent and just have them recreate it. That's the best way to go. So, basically, your

6:03agent tries to be helpful and obedient by design, but if it gets a prompt injected into that skill file or any file for that matter, it could cause problems. This is not theoretical. It's been demonstrated on real life systems in the research. Your agent could be given commands by someone who has never spoken to you, never access assessed your interface, just slipped a crafted file into your directory your agent monitors 24/7. The third category, path traversal vulnerabilities in a certain skill implementations, a malicious skill or a crafted file path sent to a vulnerable endpoint could allow access to files outside your intended workspace directory. So, if your workspace is on the same machine as other sensitive data

6:48and it probably is, there's a real read exposure of for an attacker who figures this out. The next category and this one is pretty serious is the remote code execution on vulnerable configurations. A crafted request to the open claw API on unpatched versions could execute arbitrary code on the host machine. So, if you're running open claw with broad system permissions because you set it up by with bypass permissions and you triggered that mode to make development faster and then you just never change it for production, an attacker who hits that endpoint gets full machine access and this is why Microsoft enterprise security guidance that came out in response to this matter, they published a full bulletin covering authentication requirements, network segmentation,

7:34permission scoping, logging and monitoring. So, if you're running open claw, you know, for a business with employees or clients, that bulletin should be required reading. I'll put the link down. Here's how you figure out your own exposure and I want to actually do this today, not next week, do it today. The first question you need to ask is do you access your open claw from outside your home or office network? If your answer is yes don't remember explicitly setting up authentication or a VPN, you might be exposed. If you're using back to your machine, you're probably okay, but if you open a router port and you're hitting an agent directly via IP address or a domain name with no login screen, you're exposed. The second

8:20question you need to ask yourself is if you're running open claw on a VPS or cloud server, pull up your firewall rules right now. What ports are open to the public internet? Open claw's web interface runs on a specific port. Is that port in your public allow list? If yes, you don't have authentication configured in front of it and that's a problem right there. The third question you need to ask is when did you last update? Go check what version you're running. Many of the patched CVEs were fixed in recent releases and now that we're on 4.2, the security has gotten much better, but I'm just saying if you haven't updated in the last maybe 2 to 3 weeks, there's a good chance you're running on vulnerable code. Here's what to do about it. Step one is update your open claw. Like I said, 4.2 has much stronger security than 3.13, 3.12 when

9:08they started really building in features and patches for a lot of the back end security. So, pull that latest version. Run the update. Do this first because it's the lowest friction fix and closes most of those vulnerabilities immediately. If you're struggling to keep up with content, well, I'm about to save you about 40 days worth of work. I built something called Content [music] Machine. It's 10 AI agents that run on the open claw orchestration and they handle everything. Scripts, thumbnails, X posts, blogs, outreach, clips, newsletters, all of it. So, I went from 1,000 subscribers to 4,000 subscribers on YouTube in 7 days using this exact system. Every single morning I wake [music] up and the content's already done. I spend maybe 15, 20 minutes

9:54reviewing and approving them and I move on with my day. It works for [music] any niche, fitness, finance, real estate, marketing, whatever you're building, and it is 100% completely customizable to your use case. So, you get [music] the Mission Control dashboard, all of the cron jobs, everything I've built over the last 40 days helping me gain more and more people to subscribe and join the community. So, you plug in your own thing, and it molds it to you, it learns how you talk, and it writes so it doesn't sound like AI slop. $97 one time, it's not a subscription. I'll put the link down below, and you'll thank me later. The second step is checking your firewall. Like, do you have it turned on? If not, turn it on. If you're on a cloud VPS, go to your provider's console right now and look at what ports are

10:39publicly accessible. If open claw's port is open to the world, close it. You should not need it open if you're using a bot interface or accessing it locally. The third step is if you generally need external access to your agent, use Tailscale. It's free for personal use, you install it on your machine, and your phone, and your laptop, and you get a secure encrypted private network with no open ports to the internet. Your agent is only reachable from devices on your Tailscale network. It takes 20 minutes to set up, and it solves a lot of the external access problems cleanly without exposing anything to the public internet. If Tailscale isn't an option, at minimum put open claw behind a reverse proxy with proper authentication, not basic auth with a shared password that never changes, a real auth provider. Cloudflare access is free for personal use and gives you an

11:25SSO in front of any. Authelia is a good self-hosted option, do not just accept that nobody knows your IP address as a security strategy. That's not security, that's a terrible mistake. I want to tell you how my own setup handles this because I think it's useful context. My open claw runs on the Mac mini right here, right beside me, and I access it through Telegram. The Telegram bot is my interface to do and talk to a lot of my agents. The Mac mini itself has no open ports, I don't expose the web interface anywhere. The only way to interact with my agent is through the bot, and the bot has an allow list configured that only accepts commands from me. Nobody else can send the messages, nobody else gets responses, the machine is physically behind a home router with no port forwarding. There is no reachable way from the internet. For my cron jobs in the content pipeline, they run locally

12:11and push outputs to external endpoints. The machine calls out, and nothing calls in. That's the architecture I'd recommend for anyone running personal AI agents. I even take it a next step further, and I do run Tailscale when I'm out and about. You know, I have my laptop, I have my phone, I can hit my Mission Control dashboard, launch YouTube videos, make scripts, and things like that. Extra layer, more security is Keep the agents inside your network, use a bot or an API as the only external facing interface, lock down who can talk to that interface. I want to address the bigger picture because nine CVEs in four days is not a coincidence. This is what happens when technology goes mainstream. For the first few months of Open Claw's life, the people that were using it were primarily technical. They understood network exposure risks. They configured

12:57firewalls, they thought about authentication. Now Open Claw's mainstream, tutorials are everywhere, the setup guides assume you know what you're doing. People who have never thought about network security are spinning up AI agents on cloud servers because a YouTube video make it look easy, and it's not as easy as it looks, and the security awareness hasn't caught up to the adoption curve. That's not criticism of new users at all, it's just that's how technology works. Every technology that goes mainstream goes through this same curve. Security tooling and awareness always lag behind adoption. We're in that gap right. And actually, the fact that nine CVEs are being identified and fixed in a rapid succession is a good sign about the platform's maturity. It means the security research community is paying attention to Open Claw. It means

13:42Anthropic and the maintainers are taking the report seriously and shipping patches. A platform that responds quickly to security findings is one you can trust over time. But, the developers can't protect you from exposure or create yourself. That's on you. Check your setup, update your installation, put a proper auth in front of anything external facing. Do it now. The full security report from the researchers and the Microsoft enterprise guidance are linked in the description. Give that to your agent and lock things down now. If you want to learn how to build and run AI infrastructure properly, including security practices that actually make sense for people and small businesses, come join us inside Shipping School. We just hit 201 members in 20 days, and we are actually real people, real community building real things, and we just

14:27implemented a beginner's basic Open Claw call with Brett where he walks you from the first thing, I want to install Open Claw, or we're building out that class right now where you can jump in once a week and get your hand held to set this thing up correctly. We So, that makes nine live calls a week now. My goal is to have about 20 to 30 live calls a week where we can hit different niches, different setups, different AI workflows from technical calls to beginner calls to help meet your needs. And really just help you take the next step with AI. I'll put the link to that down below, and we'll see you guys in the next one. If you haven't subscribed already, please hit the subscribe button, and we'll see you. Happy Easter.