OpenClaw: Full Danger Edition

February 2, 2026 · 5 min read · 1055 words · #tech, #security, #ai-agents

OpenClaw

OpenClaw is your local AI assistant that stays completely on your device with no cloud dependency. It runs on any operating system and platform, giving you full control without corporate oversight. Here is the unfiltered breakdown.

Architecture (how it actually flows)

Messaging Channels
(WhatsApp • Telegram • Slack • Discord • Signal • iMessage • Teams • Matrix • Google Chat • BlueBubbles • Zalo • WebChat…)
    ↓
┌───────────────┐
│   Gateway     │ ← ws://127.0.0.1:18789
│               │   sessions • presence • cron • config • tool router • webhook hooks
└───────┬───────┘
        │
   ┌────┼────┐
   │    │    │
Pi/RPC  CLI  UI / Apps
Agent  openclaw ├─ WebChat (browser lifeline)
               ├─ Control UI (admin dashboard)
               ├─ macOS menu bar (quick dopamine)
               └─ iOS / Android nodes (mobile eyes & ears)

  │
  ├─→ Tools (deep system reach)
  │     ├─ Browser (CDP + managed Chromium – full web control)
  │     ├─ Canvas (A2UI agent-driven visual workspace)
  │     ├─ Node actions (camera live feed, screen record, notify popups, location pings…)
  │     ├─ Cron / webhooks / session juggling
  │     └─ Skills (ClawHub registry – community poison or power)
  │
  └─→ LLMs (Claude Opus preferred, OpenAI backup, local LLMs, automatic failover)

A message arrives through any channel and gets routed to the Gateway. The Gateway decides what needs to happen next, then wakes the Pi/RPC agent or main agent. The agent uses tools and LLMs to process everything and sends the response back through the same path. It stays entirely local unless you deliberately configure remote access, which is the biggest gotcha — you will see later in the article.

Agent Looping Process

How does the agent do everything without a lot of human interaction? That is where the looping process comes into the picture. The agent handles prompts in a ReAct-style loop: it observes the input, thinks via LLM, acts with tools if needed, observes outputs, and repeats until no further actions are required for resolution. This is configurable via agents.thinking.level: high for deeper iterations. Loop eventually breaks on final response or error when no more tool usage or action is required.

Memory Storage

Memory is added to these agents by storing conversation history and sessions. These are stored in ~/.openclaw/sessions.json as JSON objects with timestamps, contexts, and pruning rules (e.g., auto-delete after 30 days or on size limit). These are managed via the sessions_history tool. The tools add support for export/import for backups.

Safety red flags 🚩🚩🚩

🚩 The main agent runs completely unsandboxed, which means it has unrestricted root-level access to your shell, filesystem, browser via CDP, and device nodes. If anything goes wrong — one exploit, one bad skill, one malicious prompt — and your entire machine can be compromised.

🔒 Fix is simple, SANDBOX IT PEOPLE!!!

Force Docker sandboxing on everything by setting agents.defaults.sandbox.mode: "all".
Isolate tools aggressively and consider Nix for reproducible lockdown for maximum isolation.

🚩 It maintains persistent deep device control, keeping the camera ready, screen capturable silently, location trackable, and notifications forgeable. Once macOS TCC (or equivalent permissions on other systems) grants consent, it stays active almost permanently, creating perfect conditions for invisible surveillance if the system is ever compromised.

🔒 Fix by hitting the nail in the head:

Revoke TCC permissions aggressively and frequently.
Enforce per-session toggles only.
Use signed builds to preserve permissions across restarts.

🚩 Prompt injection is a nightmare because any incoming DM, group message, or webhook can deliver crafted text that tricks the agent into taking crazy, scary actions. These could be deleting files, leaking keys, installing backdoors, or executing arbitrary code. Every channel is a wide-open attack surface.

🔒 Fix is simply SCRUB the prompt!!!

Lock DMs down with dmPolicy="pairing" so unknown senders require code-verified pairing.
Use strict allowFrom lists for users and groups.
Sanitize every incoming prompt in custom skills.
Manually approve new pairings through the CLI.

🚩 Credentials are stored in plaintext inside ~/.openclaw/credentials, leaving API keys, bot tokens, and session data completely exposed. Malware or even a curious person with brief access can steal everything in seconds.

🔒 Fix is to hide the plain text!!!! Why can I read your data?

Migrate to the system keychain (such as macOS Keychain).
Prefer OAuth flows instead of static keys.
Encrypt the entire folder manually.
Set chmod 600 and tighten umask.
Never commit sensitive data anywhere.

🚩 Remote gateway exposure is a serious risk when Tailscale Serve (tailnet-only) or Funnel (public internet) is misconfigured, turning your local WebSocket endpoint into a public target. Past incidents have leaked full conversation histories, keys, and sessions.

🔒 Fix is to keep everything under a lock!!!

Always bind only to loopback.
Disable remote access as much as possible, completely if possible. If you must enable remote, always enforce gateway.auth.mode: "password".
Use openclaw doctor frequently to detect and alert on any possible exposures.

🚩 The system.run elevated mode flips a switch that suddenly allows any shell command to execute. An accidental toggle or a sneaky prompt can cause catastrophic damage.

🔒 Fix is to keep the switch off for elevation:

Keep elevated mode off by default.
Require multi-factor confirmation such as a pairing code plus manual approval.
Whitelist only the commands you explicitly allow.
Add runtime guards on sensitive operations.

🚩 There are zero native guardrails on skills or prompts. A malicious ClawHub skill or a cleverly hidden instruction can bypass everything without any automatic scanning or enforcement.

🔒 Fix is CONSTANT VIGILANCE!!!!

Manually review and vet every skill before installation.
Add your own runtime checks for file writes, network calls, and exec operations.
Use AI-based prompt filters to catch sneaky injections.
Isolate untrusted skills inside separate workspaces.

OpenClaw Doctor

openclaw doctor is the only tool that truly sees the truth. This privileged CLI scans for risky DM policies, exposed endpoints, stale sessions, or permission leaks, or configuration drift. All of this is monitored just by running the CLI regularly.

Run it with openclaw doctor for a basic scan.
Add --repair for guided fixes.
Add --fix --yes for automatic problem removal.
Make it a weekly ritual or prepare to regret it.

Bottom line

OpenClaw is insanely powerful and equally enormously dangerous when handled carelessly. You should:

Sandbox ruthlessly.
Run doctor weekly.
Never expose the gateway remotely.
Enforce the strictest DM policies.
Keep zero secrets in plaintext.

Do it properly and it becomes genuinely private and yours. Half-ass it and enjoy the consequences.

XOXO