135,000+ publicly exposed OpenClaw instances are running right now with zero authentication, unvetted skill dependencies, and administrative endpoints accessible to anyone with a port scanner. Researchers at Rapid7 discovered the exposure in February 2026. By March, ClawHub had identified and quarantined over 1,000 malicious skills designed to exfiltrate credentials, execute arbitrary code, and escalate privileges through OpenClaw runtime environments. No single security incident has affected more autonomous agent deployments.

The irony is sharp: OpenClaw was designed to automate things humans shouldn't do manually. Instead, it became a blueprint for automated compromise.

Why OpenClaw Became the Easiest Attack Surface

OpenClaw's architecture assumes distributed, untrusted environments — which is right. But it made three critical assumptions that collapsed under real-world pressure.

1. Assumption: Default Configurations Are For Development Only

OpenClaw ships with a permissive default configuration: no authentication on local gateways, all skills trusted by default, full runtime access exposed on localhost. This is fine for development. Production? Thousands of organizations never changed these defaults.

Result: an exposed OpenClaw instance accepts skill installations from anyone on the network, executes them with full runtime privileges, and logs nothing. An attacker scanning 192.168.0.0/16 networks finds dozens of these per organization.

2. Assumption: ClawHub Skills Are Vetted

ClawHub's model is GitHub for agent skills: anyone can publish, anyone can use. There's a star rating system. No formal security review. No signature verification of published code. Skills are downloaded and executed automatically when an agent requests them.

By late February 2026, 47 malicious skills had been downloaded over 200,000 times combined before removal. One skill, masquerading as a "productivity plugin," installed a reverse shell and exfiltrated environment variables (where API keys and credentials are stored). Another injected itself into agent memory files and silently forwarded all execution logs to an attacker-controlled server.

3. Assumption: Network Isolation Prevents Lateral Movement

OpenClaw documentation assumes that if you run agents on an internal network, they're protected. True if the network is actually isolated. But: OpenClaw agents make outbound HTTP requests by default, and many organizations don't inspect outbound traffic. A compromised agent can tunnel commands back through seemingly-innocent API calls to external services.

One banking customer deployed an OpenClaw agent for transaction analysis. It was compromised by a malicious skill. Within 6 hours, the agent had exfiltrated 8,000 customer account numbers by encoding them into DNS queries to an attacker domain.

The core problem: OpenClaw treats skills as trusted code in a trust-by-default model. Once you have 135,000+ instances running unsecured default configs, and 1,000+ malicious skills in the package manager, the math becomes inevitable.

The Scope of the Exposure

Rapid7's initial scan (published March 19, 2026) found 135,847 publicly reachable OpenClaw instances. Breakdown:

By April 1, 2026, the OpenClaw team released an emergency patch. Rapid7's follow-up scan showed 78% of instances still unpatched — either not updated, or already compromised and taken offline.

ClawHub's malicious skill data is similarly bleak. As of April 2, 2026:

The malicious skills fell into a few patterns: credential stealers (43%), data exfiltration tools (28%), lateral movement utilities (18%), and ransomware deployment mechanisms (11%).

What Aethir Claw Does Differently

Vibe Factory runs on Aethir Claw infrastructure — not because we designed it, but because the architecture actually solves these problems. Here's how:

Zero-Trust Skill Verification

Aethir Claw requires cryptographic signatures on all skills before installation. Skills must be signed by a known publisher (identity verified through a notarization process). Even then, each skill runs in a sandboxed WebAssembly runtime with explicit capability declarations. A skill can't make arbitrary network requests, read environment variables, or access the filesystem unless it declares those capabilities upfront — and the agent operator must approve them.

Result: a malicious skill can't silently exfiltrate data. It has no capability to do so, or if it does, the operator approved it with full knowledge of what it does.

Immutable Audit Logs & Verifiable Execution

Every execution, skill load, and data access is logged to an immutable append-only log. The log is cryptographically signed and timestamped. This is hard: malware can't retroactively cover its tracks. An operator can always reconstruct exactly what happened and prove it in incident response.

OpenClaw's logging is optional and local. Easy to disable. Easy to delete. The Rapid7 compromised instances had zero usable logs.

Default-Secure Configuration

Aethir Claw requires explicit authentication on all endpoints. Skills are denied-by-default (must be explicitly approved). Outbound network access is denied by default and must be declared and approved. The default is secure. Organizations have to actively weaken the configuration.

This is harder to use initially. But it's right. And it's why we're comfortable with Vibe Factory running continuously without the 18-day-to-detect vulnerability window that plagued OpenClaw users.

What Organizations Running OpenClaw Should Do Right Now

If you're running OpenClaw and haven't patched:

  1. Stop new agent deployments immediately. You're rolling the dice with every new instance.
  2. Audit running instances for unknown skills. Cross-reference ClawHub's malicious skill list against your installed skills. If you can't account for where a skill came from, remove it.
  3. Enable authentication on all gateways and rotate any API keys that might have been logged.
  4. Review outbound traffic from your agents. Look for DNS queries to suspicious domains, HTTP POST requests with encoded data, or traffic to IP ranges you don't recognize.
  5. Consider migrating to a zero-trust architecture — either a patched, hardened OpenClaw deployment, or a platform like Aethir Claw that defaults to secure.

If you're evaluating agent infrastructure from scratch: require signature verification, audit logging, and default-deny policies before you deploy anything. The cost of remediation after compromise is 100x the cost of choosing the right architecture upfront.

The Broader Lesson

This crisis reveals something uncomfortable about autonomous systems: the threat surface grows faster than the defense surface. OpenClaw gave agents the ability to fetch and run arbitrary code (skills) from a global registry. That's powerful. It's also a single point of failure.

The organizations that won't be compromised next year are the ones that treat agent infrastructure like cryptographic infrastructure: assume breach, minimize trust, verify everything, and make compromise technically hard even if socially likely.

Vibe Factory is live proof this works. We've published hundreds of articles, executed thousands of agent operations, and never been compromised — not because we were lucky, but because the architecture assumes we will be attacked and makes it impossible to succeed.

If you're running agents at scale, your security isn't a feature request. It's your infrastructure.