In early 2026 CVE-2026-25253 showed that one crafted link was enough to hand an attacker the keys to a self-hosted OpenClaw agent. Self-hosted AI security stopped being theoretical that month. This hub collects what we know about it.
The post-OpenClaw-crisis security baseline for any agent you self-host in 2026 looks like this: sandbox-on by default, authenticated dashboard, encrypted credential vault, explicit network egress allowlist, hash-chained audit log, working CVE disclosure channel, and a 48-hour patch SLA on critical issues.
No agent we follow ships all of those, and the sandbox is the line most of them miss. Hermes Agent runs commands on the host by default, with approvals for the dangerous ones, a chat gateway that refuses strangers and a published trust model; its sandboxes are one setting away. OpenClaw 2026.4+ also leaves its sandbox off until you configure one. Nanobot has a bubblewrap or Seatbelt shell sandbox and a workspace guard, both off by default, and pairing on most chat channels. IronClaw runs untrusted tools in a WebAssembly sandbox from the first run and keeps secrets out of their reach. Until October 2026 this paragraph said Hermes Agent ships the whole baseline and Nanobot none of it; neither was true.
If you're not at this baseline, you're closer to the pre-2026 dangerous defaults than you think. The articles below cover the threat model, the audit checklist and the incident response playbook. The CVE archive lists every disclosed vulnerability we track. The agents and providers pages note who passes and who fails our security baseline.
Self-hosted AI security is not exotic. It's regular hygiene applied to a moderately new attack surface. The mistakes that matter are mistakes we already know how to avoid in other software.
What this page says about each agent's defaults was read in its own documentation on 2026-10-18: Hermes Agent security docs, Hermes Agent SECURITY.md, OpenClaw sandboxing docs, Nanobot security settings (v0.3.5), IronClaw README (main, b0b999d): security.
Guides
- Self-hosted AI security best practices: a playbook: Securing an AI agent you host yourself: threat model, sandbox tiers, where credentials belong, Tailscale or SSH instead of a public port, logging, incident response.
- OpenClaw security crisis 2026: what you need to know: CVE-2026-25253 let one crafted link take over an OpenClaw gateway, and The Register counted more than 135,000 instances reachable from the internet. What happened, what was exposed, and what to do.
- The OpenClaw timeline: from Clawdbot to a foundation (late 2025 to July 2026): OpenClaw's history from sources: Clawdbot in late 2025, two renames in January 2026, CVE-2026-25253, 135,000 instances exposed, its creator's move to OpenAI and the OpenClaw Foundation of July 2026.
Agents on this topic
- OpenClaw: Self-hosted AI agent at the centre of the January 2026 security crisis. Its tool sandbox is off by default: the main session's tools run on the host until you configure one.
- Hermes Agent: Agent from Nous Research (MIT, Python). Runs shell commands on the host by default, with an approval step for dangerous ones; Docker and cloud sandboxes are options. Works with many LLM providers.
- IronClaw: Rust agent from NEAR AI, MIT or Apache-2.0. Untrusted tools run in a WebAssembly sandbox with declared capabilities, and secrets are injected outside them.
- ZeroClaw: Single Rust binary from ZeroClaw Labs, MIT or Apache-2.0. Works with Anthropic, OpenAI, Ollama and about twenty other providers, and turns on an OS sandbox it detects.
Vulnerabilities
- CVE-2026-25253: OpenClaw: 1-click RCE via gateway token exfiltration from gatewayUrl
Terms
Sandbox · Sandboxed tool execution · Approval flow · Prompt injection · RCE (Remote Code Execution) · WebSocket origin validation · CVE-2026-25253