The ‘Absolute Nightmare’ in Your DMs: OpenClaw Marries Extreme Utility with ‘Unacceptable’ Risk

OpenClaw, an agentic AI platform deployed via messaging apps and one-click cloud installs, is described as insecure by design: it requires elevated credentials, often stores API keys and tokens in plaintext, exposes internet-facing control panels, and is vulnerable to indirect prompt-injection attacks that can establish persistent C2 channels — researchers and vendors warn its rapid, shadow deployments and ease of installation create substantial risk of large-scale compromise.