Michael Limberger

Security hardening

This section is why the live meetup was cancelled, and why the tutorial is free. OpenClaw has had serious incidents. Understand the risk before you run it on a machine that holds SSH keys, browser passwords, and wallets. Read carefully. This part is not optional.

The ClawHavoc attack

In late January 2026, a coordinated supply chain attack hit ClawHub, the skill marketplace. An account named "hightower6eu" uploaded 677 malicious packages. At peak, 824 of about 10,700 skills (roughly 8%) were trojanized.

The payload was Atomic macOS Stealer (AMOS). Compromised skills could harvest:

Browser credentials (Chrome, Firefox, Safari)
        SSH keys
        Telegram sessions
        Cryptocurrency wallets
        Keychain data

This was a real attack against real users, not a hypothetical.

The exposure problem

Separately, researchers found over 312,000 OpenClaw instances on the public internet, many without authentication. That means open gateways, not just lab boxes behind a VPN.

Five CVEs were disclosed, including CVE-2026-25253 (CVSS 8.8): one-click remote code execution through the Control UI. An attacker could exfiltrate gateway tokens over WebSocket, then send commands the agent runs with your user permissions.

If the gateway is reachable without auth, someone else can run commands as you.

Step 1: run the built-in security audit

Show me

openclaw security audit --fix

It checks inbound access, tool blast radius, network exposure, browser control, filesystem permissions, plugin allowlists, and model hygiene. --fix auto-remediates what it can (mainly permissions and log redaction). Network and auth issues still need manual work.

Deeper scan with live TCP probing:

Show me

openclaw security audit --deep

Step 2: gateway binding and authentication

Your openclaw.json should already include:

"gateway": {
          "bind": "loopback",
          "port": 18789,
          "auth": {
            "mode": "token",
            "token": "your-64-char-random-hex-string"
          }
        }

Binding must be 127.0.0.1 only, not 0.0.0.0. There is a known silent fallback: if loopback binding fails, the gateway can open on all interfaces with no clear warning.

Verify after every start:

lsof -i :18789 -nP | grep LISTEN

You must see 127.0.0.1:18789. *:18789 or 0.0.0.0:18789 means LAN exposure.

Token auth blocks unauthorized gateway API use. Generate a strong token:

Show me

openssl rand -hex 32

Step 3: add a firewall rule

Defense in depth. Even with correct binding, block external traffic to the gateway port:

Show me

echo "block in on ! lo0 proto tcp to any port 18789" | sudo pfctl -ef -

That blocks inbound TCP on 18789 except from loopback (lo0).

Step 4: install SecureClaw

SecureClaw (Adversa AI) adds audit checks, hardening modules, and monitors, including ClawHavoc indicators.

Show me

git clone https://github.com/adversa-ai/secureclaw.git
        cd secureclaw/secureclaw
        npm install && npm run build
        npx openclaw plugins install -l .

Run its audit:

npx openclaw secureclaw audit --fix

It can fix gateway binding (0.0.0.0 to 127.0.0.1), directory and config permissions, and append privacy directives to the agent SOUL.md.

Step 5: disable mDNS broadcasting

Keep this in .env:

OPENCLAW_DISABLE_BONJOUR=1

By default OpenClaw can advertise over Bonjour (UDP 5353). On shared Wi-Fi that reveals the instance; full mode TXT records can include paths and username. There is also a known crash path where brief Wi-Fi drops trigger an mDNS assertion that kills Discord channel handling until restart. Disable broadcasting unless you have a specific reason not to.

Step 6: do not install third-party skills

After ClawHavoc, Snyk scanned 3,984 ClawHub skills and found about 41.7% with serious vulnerabilities and about 7.1% leaking credentials through LLM context.

Red flags if you ever consider a skill:

Show me

SKILL.md files with "Prerequisites" sections telling you to run
        curl ... | bash (arbitrary code execution disguised as setup)
        
        References to webhook.site, glot.io, or external paste services
        (data exfiltration endpoints)
        
        Password-protected ZIP downloads (hiding malicious code from
        automated scanners)
        
        Publishers with bulk uploads and no track record (the attacker
        uploaded 677 packages from one account)
        
        Any eval() calls or Base64-encoded content in scripts (obfuscated
        payloads)

Safer default: use only the 53 skills bundled with OpenClaw. For any third-party skill, check VirusTotal on the ClawHub page (as of February 2026, uploads are scanned via OpenClaw's VirusTotal partnership). Better still: skip third-party skills unless you truly need them.

+----------------------------------------------------------+
|  SECURITY CHECKLIST                                      |
|                                                          |
|  [ ] openclaw security audit --fix                       |
|  [ ] Gateway binds to 127.0.0.1 only (verify with lsof)  |
|  [ ] Gateway has token authentication                    |
|  [ ] Firewall rule blocks external access to port        |
|  [ ] OPENCLAW_DISABLE_BONJOUR=1                          |
|  [ ] No cloud API keys in environment                    |
|  [ ] ~/.openclaw/ permissions are 700                    |
|  [ ] Config files permissions are 600                    |
|  [ ] No third-party skills installed                     |
|  [ ] SecureClaw installed and audit passed               |
+----------------------------------------------------------+

macOS permission traps

Three permissions matter for OpenClaw. Miss one and failures look mysterious:

1. Full Disk Access (System Settings, Privacy & Security)
        2. Accessibility access
        3. Screen Recording (if using browser automation)

Restart Terminal after toggling any of these. macOS does not apply permission changes to already-running terminal sessions. That trap burns a lot of debugging time.

Complete the checklist and you have closed the most common and most exploited paths. Nothing is bulletproof, but this is the minimum responsible setup. Next we actually use OpenClaw.