OpenClaw, the Fastest-Adopted Software Ever, Is Also a Security Blind Spot

This report alerts CISOs that OpenClaw — a widely adopted, locally running AI agent — has become a major shadow-IT and security problem: thousands of instances are exposed and leaking credentials and API tokens, a public marketplace contains a measurable portion of malicious skills distributing keyloggers and stealers, and several serious CVEs (including remote code execution and command injection) have been disclosed. Major security vendors have issued coordinated warnings and guidance, and the author recommends governing agent access to data (authentication, policy enforcement, encryption, and logging) rather than outright bans.