OpenClaw Security in 2026: A Practical Hardening Checklist

OpenClaw is not a chatbot sealed inside a browser tab. It is an always-on agent runtime that can hold credentials, read files, execute commands, browse untrusted pages, and communicate through connected services.

That combination is useful because the agent can act. It is risky for the same reason.

The correct question is not “Is OpenClaw secure?” in the abstract. Ask:

1. Who can send it input?
2. Which data can it read?
3. Which tools can it invoke?
4. Which outside systems can those tools change?
5. What contains and records a mistake?

OpenClaw’s official gateway security guide is the authoritative configuration reference. The checklist below turns that model into an operating sequence.

1. Give each trust boundary its own gateway

OpenClaw describes a personal-assistant trust model: one trusted operator boundary per gateway. An authenticated gateway caller is effectively an operator, and a session key is a routing selector—not a tenant authorization boundary.

Do not put mutually untrusted customers, organizations, or contractors behind one shared gateway and assume conversations keep them isolated. Use:

• a separate gateway and credential set per tenant;
• a separate operating-system user, container, or virtual machine boundary;
• separate persistent storage;
• separate channel and model credentials.

If you are comparing managed providers, ask exactly how they implement that separation. “Private” and “isolated” are conclusions; namespace, container, microVM, and VM are implementation facts.

2. Verify the gateway’s live exposure

Current OpenClaw normally binds to loopback, while container detection, remote access, Tailscale, or custom configuration can change the effective listener. Do not infer exposure from a config fragment. Check the running process.

openclaw config get gateway.bind
openclaw config get gateway.auth.mode
openclaw gateway status --deep
openclaw security audit --deep

Then inspect the host listener and firewall. Port 18789 should not be reachable from an untrusted network unless a deliberate authenticated access path protects it.

OpenClaw supports token, password, and trusted-proxy authentication. A reverse proxy must overwrite forwarding headers, block direct access to the gateway port, and appear in gateway.trustedProxies. Do not forward Tailscale identity headers from an ordinary proxy.

3. Treat gateway credentials as operator credentials

OpenClaw’s shared token or password does not represent a narrow end-user API key. On the shared-secret HTTP path, it restores broad operator semantics. Protect it like an administrator credential:

• generate a long random secret;
• store it outside source control;
• never put it in a browser URL, screenshot, or support ticket;
• rotate it after suspected exposure;
• do not share one token across tenants;
• prefer an identity-aware private access path over a public port.

OpenClaw’s security audit checks flag missing auth, risky bind modes, weak file permissions, proxy mistakes, and policy drift. Make the audit part of every configuration change.

4. Narrow tool authority before adding channels

A private gateway can still be dangerous if anyone who reaches the agent can trigger powerful tools.

Start with a narrow tool profile. For untrusted or semi-trusted message sources:

• deny shell execution unless the task requires it;
• restrict filesystem access to the workspace;
• disable elevated tools;
• deny runtime and automation control tools;
• use sender pairing or allowlists;
• require mentions in group channels;
• separate personal and agent-owned channel identities where practical.

OpenClaw’s documentation includes a hardened baseline that uses a messaging tool profile, workspace-only filesystem access, denied execution, and pairing policies. Copy the current version from the official guide rather than an old blog post; field names and defaults change.

5. Use isolation as a blast-radius control

Sandboxing and host isolation answer different questions.

• A tool sandbox limits where a particular execution path runs.
• A container limits the process and filesystem view, subject to the shared kernel and its configuration.
• A microVM or VM adds a stronger kernel boundary.
• A separate tenant gateway prevents one operator boundary from becoming another tenant’s operator boundary.

No isolation layer makes a permitted external API call safe. If the agent is allowed to send a message, alter a calendar, or call a billing API, the action can leave the sandbox exactly as designed.

Use isolation together with narrow credentials and a review path for consequential actions.

6. Protect credentials and persistent state

OpenClaw stores valuable state under its data directory: auth profiles, channel credentials, session transcripts, config, and memory. The audit checks for files or directories that are group/world readable or writable.

Operational rules:

• keep state off shared or synced folders;
• use 600 permissions for sensitive files and 700 for directories;
• give the agent dedicated non-privileged service credentials;
• scope each credential to the minimum account and capability;
• keep production secrets out of logs and prompts;
• rotate provider, channel, and gateway credentials together after compromise;
• encrypt and test backups, not just create them.

The OpenClaw --fix audit mode can tighten several permissions and safe settings. Review its output; it intentionally does not make judgment-heavy policy changes for you.

7. Treat skills, plugins, and MCP servers as code

A skill may look like Markdown, but the agent interprets it as instructions. Plugins and MCP servers can add executable code, tool descriptions, network calls, and credential access.

Before installation:

• read the entire skill or plugin source;
• inspect install scripts and every fetched URL;
• verify the publisher outside the registry;
• reject unexplained credential access;
• look for hidden Unicode and generated or precompiled payloads;
• pin a version or content hash when possible;
• use an explicit plugin allowlist;
• record what changed so you can remove it.

Our dedicated OpenClaw skill-vetting guide includes the review and incident-response checklist.

8. Separate untrusted input from external authority

Prompt injection is an authorization problem.

An email, webpage, document, chat message, or tool result can contain instructions designed to manipulate the model. Content filtering helps, but it cannot prove that a model will ignore every malicious instruction.

The durable control is to separate “the agent may prepare this” from “the system may execute this.” For high-impact actions:

• validate recipients and resources server-side;
• show the exact proposed payload to a human;
• make approval specific to that payload;
• execute through a server-owned path;
• retain the proposal, review, and outcome;
• keep money, credentials, legal commitments, and trust changes manual.

BrainRoad implements that pattern for its managed action types. It does not automatically govern arbitrary third-party OpenClaw channels or tools. See the honest boundary in what BrainRoad isolates and what it does not.

9. Patch and verify, do not blindly auto-update

OpenClaw changes quickly. Updates can fix security defects and can also change config, policy, or plugin behavior.

Use a repeatable cycle:

1. Read the upstream release notes.
2. Back up state and verify the restore path.
3. Update in a non-public or test instance first.
4. Run openclaw doctor.
5. Run openclaw security audit --deep.
6. Probe channels and gateway status.
7. Review new tools, plugins, and policy warnings.

A provider saying “automatic updates” is not enough. Ask whether updates are tested, pinned, staged, and recoverable.

10. Prepare an incident procedure before connecting real accounts

OpenClaw’s security guide recommends a clear contain, rotate, audit sequence.

Contain

• stop the gateway;
• remove public or remote exposure;
• disable risky channels and open sender policies;
• revoke suspicious plugins, skills, and tools.

Rotate

• gateway and remote-client secrets;
• model-provider keys;
• channel tokens and linked-device credentials;
• any credential the agent or a malicious skill could read.

Audit and rebuild

• preserve and review relevant logs and transcripts;
• inspect config, skills, plugins, and persistent memory for unauthorized changes;
• run the deep audit;
• rebuild from known-good state when integrity is uncertain;
• restore only verified data and configuration.

A go-live checklist

• One tenant and trusted-operator boundary per gateway
• Live listener verified; no unintended public port
• Authentication required and tested from outside the host
• Proxy and forwarding headers configured correctly
• Tool profile narrowed for every channel
• Execution isolated from the main workstation
• Dedicated, least-privilege credentials
• Skills, plugins, and MCP servers reviewed and pinned
• Backups encrypted and a restore tested
• openclaw security audit --deep has no unexplained critical findings
• Consequential outside actions have a separate authorization path
• Incident stop/rotate/rebuild steps written down

Frequently asked questions

Is loopback plus a token enough?

It closes a major network-exposure path, but it is not the whole threat model. The agent may still ingest malicious content, execute broad tools, expose credentials to a compromised skill, or take an allowed outside action. Pair network controls with tool policy, isolation, credential scoping, and action authorization.

Should I expose OpenClaw through Nginx or Caddy?

Only deliberately. Keep the gateway port unreachable directly, require authentication at the gateway or a correctly configured trusted proxy, overwrite forwarding headers, and list only the real proxy addresses as trusted. Re-run the live security audit after the proxy is in place.

Can I safely share one gateway with a team?

A team of mutually trusted operators can share one trust boundary if that is intentional. Do not use one gateway as a hostile multi-tenant boundary. Separate customers or mutually untrusted users into separate gateways and credentials.

Does managed hosting remove the need for this checklist?

No. It transfers some responsibilities: server operation, network design, patching, backups, or tenant isolation. You still need to understand credentials, connected tools, channels, action authority, export, and incident response. Ask the provider for concrete controls rather than accepting the word managed.

Primary references

• OpenClaw gateway security
• OpenClaw security audit checks
• OpenClaw gateway configuration reference
• OpenClaw Kubernetes installation