Cases › security breach › LR-2026-0405
Tens of thousands of OpenClaw systems exposed by misconfigurations and known exploits
Preliminary Why: Publisher not yet named · subject to change
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, deployer, industry.
Severity major: Test: many third parties with a stated count of two or more affected. Fact: 549 exposed instances correlated with prior breach activity, indicating that some affected environments had already been compromised.
OpenClaw is an agentic AI framework designed to run continuously and act on behalf of users, with broad system-level permissions. A report from SecurityScorecard's STRIKE team identified 28,663 unique IP addresses hosting exposed OpenClaw control panels across 76 countries. The control interface binds to all network interfaces by default, and many exposed instances ran outdated versions even though patches were available. Researchers flagged 12,812 instances as vulnerable to remote code execution and found 549 exposed instances correlated with prior breach activity. The count of exposed deployments kept growing during the research period, exceeding 40,000. The source describes the exposure as a broader security challenge for agentic AI.
What happened
What was done
Risks
Read from the sources; not yet reviewed by a person.
Controls
HarnessNot effective Fail-closed defaults
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · Harnessagentic AI frameworkAgent framework vendor
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Vulnerability scanning of AI components, Adversarial testing before deployment, Short-lived, scoped credentials, Live behaviour monitoring, AI incident response plan, Segmentation of agent components, Encryption of stored data.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Intrusion and endpoint detection, Inventory of exposed services.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Fail-closed defaults | L2 Harness | Not effective |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Segmentation of agent components | L3 Application | Not stated in sources |
| Live behaviour monitoring | L3 Application | Not stated in sources |
| AI incident response plan | L3 Application | Not stated in sources |
| Vulnerability scanning of AI components | L3 Application | Not stated in sources |
| Encryption of stored data | L3 Application | Not stated in sources |
| Adversarial testing before deployment | L3 Application | Not stated in sources |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Inventory of exposed services | L4 Infrastructure / target | Not stated in sources |
Evidence
- Cause a shared system was the path
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Show the full account: 1 items from the primary sources
What happened, in order
Not dated in the sources:
- During the research period, the count of identified internet-facing instances grows past 40,000.
Show every field, with its source and grade
The AI system
What happened
Impact
LR-2026-0405 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON