OpenClaw AI Agent Has Security Risks; MIIT Warns Users to Strengthen Protection

OpenClaw (commonly known as 'Lobster') is an AI agent with active automation capabilities, capable of autonomously cleaning inboxes, booking services, managing calendars, and other tasks. Recently, the Network Security Threat and Vulnerability Information Sharing Platform of the Ministry of Industry and Information Technology detected that this open-source AI agent has high security risks under default or improper configurations, which may lead to cyber attacks, information leaks, and other issues. Due to its vague trust boundary during deployment, continuous operation, autonomous decision-making, and ability to call system and external resources, OpenClaw may perform unauthorized operations due to instruction induction, configuration defects, or malicious takeover if there is a lack of effective permission control, audit mechanisms, and security reinforcement, resulting in information leaks, system control, and other risks. Relevant units and users are advised to check public network exposure, permission configurations, and credential management when deploying and applying OpenClaw, close unnecessary public network access, improve identity authentication, access control, data encryption, and security audit mechanisms, and continuously follow official security announcements and reinforcement suggestions to prevent potential risks.