Open-source AI Agent OpenClaw ('Lobster') Still Has Security Risks After Updates; Experts Advise Caution

Recently, the open-source AI agent OpenClaw (nicknamed 'Lobster') has gained much attention. However, experts from China Academy of Information and Communications Technology warn that even after updating to the latest version to fix known vulnerabilities, security risks still exist. Previously, the MIIT Network Security Threat and Vulnerability Information Sharing Platform issued related warnings.

OpenClaw can autonomously perform tasks like file management and data processing, but due to issues such as autonomous decision-making and lax skill pack audits, there are risks like incorrect execution of harmful operations and data leaks. Using malicious skill packs or improper configurations (e.g., admin rights, public network exposure) may lead to attacks even after upgrades.

Experts advise users to use it cautiously: download the latest official version, do not expose instances to the public network, follow the principle of minimal permissions, be careful with skill pack installations, and enable log auditing and other protective measures. Report vulnerabilities to the MIIT platform if found.