AgentNo sandbox by defaultTracked every 6 hours

OpenClaw

Self-hosted AI agent at the centre of the January 2026 security crisis. Its tool sandbox is off by default: the main session's tools run on the host until you configure one.

By Peter Steinberger / OpenClaw FoundationLicense MITLanguage TypeScriptFirst release 2025-11-25
GitHub stars
393,701
GitHub, 2026-11-02
Last release
v2026.10.9
2026-10-29
CVEs (30 days / total)
0 / 661
from NVD
Sandbox default
no
GitHub stars, last 12 snapshots: +243

Overview

Published as Clawdbot in November 2025 and renamed Moltbot, then OpenClaw, at the end of January 2026. On 9 February 2026 The Register reported more than 135,000 OpenClaw instances reachable from the internet; CVE-2026-25253, fixed in 2026.1.29, let a crafted link steal the gateway token. Its creator joined OpenAI in February and the OpenClaw Foundation, a US non-profit, was announced on 8 July 2026. Tool sandboxing still has to be switched on: its documentation says it is off by default, so the main session's tools run on the host until you pick a sandbox backend (Docker, Podman, SSH and others).

Our take

Editorial opinion, not a test result.

Best for

  • Existing OpenClaw deployments with custom plugins
  • Teams already trained on the OpenClaw model
  • Agents that need the largest plugin marketplace

Not for

  • New deployments: Hermes Agent is the easier on-ramp
  • Pre-2026.3 hosts that haven't migrated (assume compromise)
  • Teams that want a single small binary (look at ZeroClaw)

Security posture

Sandbox by defaultno
Auth on dashboardyes
Threat model documentedyes
Multi-LLM supportyes
CVEs on NVD (total)661
CVEs in the last 30 days0

Off by default: the gateway and the main session's tools run on the host. Docker, Podman, SSH and other sandbox backends are set in agents.defaults.sandbox.

Sources

Sandbox default and model support read in the project's own documentation and repository on 2026-10-18.

Links

Run OpenClaw on portable hardware

Verified working on these portable hosts (with the standard caveats: see the per-device pages for power, RAM headroom, browser-tool support):

Raspberry Pi 5
€80-110 · 5-12 W
Intel NUC 13 and Geekom IT13
€300-600 · 15-55 W
Framework Laptop 13 / 16
€1100-2200 · 15-80 W
Lenovo ThinkCentre M75q (used)
€150-250 used · 15-35 W
Minisforum UM790 Pro
€700-900 · 25-65 W
Dell OptiPlex 3070 / 5070 Micro (used)
€100-180 used · 15-35 W

Compare OpenClaw with others

OpenClaw vs Hermes Agent
No sandbox by default
OpenClaw vs Nanobot
No sandbox by default
OpenClaw vs IronClaw
Sandbox on by default

OpenClaw CVEs (661 on NVD)

CVE-2026-102807medium 5.3OpenClaw: Incorrect authorization in the mcp.app.view methodOpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App…29 Sept 2026CVE-2026-102806medium 6.3OpenClaw: Incorrect authorization in the Gateway's local media root allowlistOpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between…29 Sept 2026CVE-2026-100599high 8.8OpenClaw: Fails to apply the configured exec approval path to Google Meet node commandsOpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts…26 Sept 2026CVE-2026-100598high 7.1OpenClaw: Incorrectly binds Signal approval reactionsOpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured…26 Sept 2026CVE-2026-100597high 7.8OpenClaw: Time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operationsOpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation…26 Sept 2026CVE-2026-100596high 8.8OpenClaw: Fails to properly authorize non-owner users executing MCP configuration changesOpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands…26 Sept 2026

All CVEs

Stats refreshed every 6 hours from public sources (GitHub API, NVD CVE feed, CISA KEV). See our methodology for the full tracking pipeline.

See also: all AI agents, all AI CVEs, AI hardware, scan your AI stack, Pro alerts.