OpenClaw exploded onto the AI scene in early 2026, amassing over 135,000 GitHub stars in weeks. It promises to be the ultimate open-source AI agent — one that controls your computer, manages your files, and connects to your tools.

But beneath the hype lies a trail of critical vulnerabilities, malicious skills, and fundamental architectural decisions that put your data at risk. Security researchers from Kaspersky, Cisco, CrowdStrike, and Trend Micro have all raised alarms. Some experts have already dubbed OpenClaw the biggest insider threat of 2026.

Here's what you need to know — and why Zenfox was built to solve these problems from the ground up.

OpenClaw runs on your machine — and that's the problem

OpenClaw installs directly on your computer and operates with full access to your local file system. It can read and write files, run shell commands, and execute scripts with the same permissions as your user account.

That means a single prompt injection or malicious skill can:

Read sensitive files — API keys, credentials, SSH keys, browser cookies.
Execute arbitrary code — install keyloggers, exfiltrate data, or modify system files.
Access everything you can — emails, documents, financial records, anything stored locally.

Some users deploy OpenClaw on a VPS to add a layer of isolation. But this introduces new problems: you need technical expertise to configure it securely, and you're now storing an agent with access to your personal and financial information on a remote server — creating yet another attack surface.

512 vulnerabilities and counting

A security audit conducted in January 2026 uncovered 512 vulnerabilities in OpenClaw, eight of which were classified as critical. The list of CVEs keeps growing:

CVE-2026-25253 (CVSS 8.8) — allowed attackers to steal authentication tokens and gain full control of the gateway.
CVE-2026-25593, CVE-2026-24763, CVE-2026-25157 — remote code execution, command injection, and server-side request forgery.
CVE-2026-26319, CVE-2026-26322, CVE-2026-26329 — authentication bypass and path traversal vulnerabilities.

The "ClawJacked" vulnerability was particularly alarming: if you visited any attacker-controlled website, JavaScript on that page could silently open a WebSocket connection to your local OpenClaw instance, brute-force the password (no rate limits existed), and take full control of your machine.

Security researchers also found over 40,000 OpenClaw instances exposed with unsafe defaults, with more than 12,800 directly exploitable. These were leaking API keys, chat histories, and account credentials to anyone who knew where to look.

The skills marketplace is a minefield

OpenClaw's public marketplace, ClawHub, was supposed to extend the agent's capabilities. Instead, it became an unvetted software supply chain.

Researchers found nearly 900 malicious or dangerously flawed skills across ClawHub — roughly 12% of the entire registry. Attackers used professional documentation and innocuous names like "solana-wallet-tracker" to distribute keyloggers and Atomic Stealer malware.

Versions of the RedLine and Lumma infostealers have already been spotted with OpenClaw file paths added to their must-steal lists. OpenClaw stores configuration, memory, and chat logs — including API keys and passwords — in plain text.

How Zenfox solves these problems

Zenfox was designed with security as a foundational principle, not an afterthought. Here's how the two compare:

	OpenClaw	Zenfox
Where it runs	Your local machine	Secure cloud infrastructure
File system access	Full access to all local files	No access to your file system
Secrets storage	Plain text in config files	Encrypted in Infisical
Integrations	Unvetted skills marketplace	OAuth integrations verified by providers
Encryption	None by default	In transit and at rest
API connections	Manual setup, credentials exposed	Automatic, schema-validated, keys secured
Audit trail	None	Full activity logging
Vulnerabilities (2026)	512+ found	Zero critical CVEs

Cloud-native architecture, zero local exposure

Zenfox never runs on your computer. Your data never touches your local file system. There's no agent with root access sitting on your laptop waiting to be exploited. This eliminates the entire class of vulnerabilities that plague OpenClaw — no local file access, no shell command execution, no WebSocket hijacking.

OAuth integrations verified by the providers themselves

When Zenfox connects to Google, Dropbox, Slack, or any other service, it uses OAuth integrations verified and approved by the service providers. You authenticate directly with Google or Dropbox — Zenfox never sees your password. This is fundamentally different from OpenClaw's skills marketplace, where any anonymous developer can publish code that runs with full system access.

Secrets management with Infisical

Every API key, token, and credential in Zenfox is stored in Infisical, an enterprise-grade secrets management platform. Nothing is stored in plain text. Nothing lives in a config file on your desktop. Compare that to OpenClaw, where infostealers are already targeting its plain-text credential stores.

Encryption in transit and at rest

All data flowing through Zenfox is encrypted in transit (TLS) and at rest. This is table stakes for any serious platform — and yet OpenClaw offers none of it by default.

Automatic, schema-validated API connections

Zenfox can connect to over 10,000 third-party APIs automatically while strictly respecting each API's schema. No manual configuration, no credentials pasted into config files, no guessing. The connection is validated, secured, and monitored.

More features, more context, more capability

Security aside, Zenfox simply does more:

RAG capabilities — index and search across millions of documents with retrieval-augmented generation. OpenClaw has no built-in document indexing.
Persistent memory — Zenfox remembers your context across every session. OpenClaw's memory is local, unencrypted, and a known target for malware.
Automations — schedule recurring tasks that run without manual input.
WhatsApp and SMS access — manage your AI agent from your phone.
10,000+ API integrations — connect to virtually any service, automatically.

The bottom line

OpenClaw is an impressive open-source experiment — but running an AI agent with full system access on your local machine is a security model from a different era. The 512 vulnerabilities, the malicious skills marketplace, the plain-text credential storage, and the 40,000+ exposed instances tell a clear story: OpenClaw was not built for production use with sensitive data.

Zenfox was. Every architectural decision — from cloud-native infrastructure to OAuth-verified integrations to Infisical-based secrets management — was made to ensure that your data stays private, encrypted, and under your control.

If you're using OpenClaw today, or considering it, ask yourself: do you trust an unvetted agent with full access to your file system, your credentials, and your personal data?

There's a better way. Try Zenfox for free — permanent Free plan, no credit card, no trial timer — and see what a secure AI agent looks like.

Want to see how Zenfox compares to other tools? Check out our Zenfox vs ChatGPT comparison.