OpenClaw can be safe in a business, and most of what decides that has nothing to do with the software. It is free, open source, and built to act for you, so it reads your files, uses your logins, and sends messages under your name. Set up on one locked-down machine with a short list of things it may touch, that is useful. Set up in a rush so you can reach it from your phone, it becomes a door into your business that strangers can find.
The second case is more common than you would guess. On October 19, 2026, roughly 49,500 OpenClaw control panels were answering requests from the open internet, about 12,000 of them in the United States, on the live scan dashboard run by SecurityScorecard's STRIKE research team. Those are not break-ins. They are ordinary setups whose owners left the front door reachable, and about 1,300 more appeared in the previous 24 hours.
Whether the software is trustworthy turns out to be the easy part. What decides your outcome is who gets to give the agent orders, what it can reach when they do, and who installs the fixes.
Is OpenClaw safe to run in a small business?
Yes, under four conditions: one named person owns it, it is reachable only from inside your own network, its access is limited to a few named systems, and someone installs updates every week. Miss any of the four and you are running an unsupervised assistant that holds your logins, and nothing in the software will stop you from doing that.
OpenClaw says this itself. Its own documentation on the trust boundary, read on October 19, 2026, puts it plainly: "Sandboxing is off by default. Out of the box, OpenClaw is a personal assistant for one trusted operator." Business use, in the project's own words, "requires explicit configuration." That is a fair description, and it is the sentence most people scroll past on their way to the install instructions.
The project is not a fly-by-night thing either. It is stewarded by a nonprofit foundation, publishes a written threat model, takes vulnerability reports at a security address, and ships a check you can run yourself, which only helps the businesses that actually run it.
What can an OpenClaw agent reach once it is connected?
Everything you connect it to, plus the computer it lives on. OpenClaw's own product page advertises "Full System Access": it browses the web, fills in forms, reads and writes files, and runs commands on its machine. Each app you link, your email, your calendar, your files, your code, widens what one mistake can touch.
This is the trade people underrate. An assistant that cannot do anything is safe and useless. An assistant that can do your admin work has to hold the same keys you do. The research firm Bitsight put it bluntly in its February 2026 write-up: any service you give the agent access to is compromised if the agent is compromised. Their researchers asked their own test setup for the password it used to reach an outside service, and it went hunting through its own machine until it found one and handed it over.
The second thing owners miss is who counts as "you". OpenClaw's security trust model is direct about it: everyone who can message a tool-enabled agent shares that agent's authority. One assistant is built for one group of people who already trust each other. A chat room that includes a contractor, a part-time bookkeeper, and a client is not that group. What access an AI agent should have to your business systems works through the access tiers in detail.
How many OpenClaw setups are open on the internet right now?
Tens of thousands, and the number keeps climbing. SecurityScorecard's STRIKE team has scanned for exposed OpenClaw setups since January 2026 and publishes the running count. On October 19, 2026 its dashboard showed about 49,500 answering right now, more than 1.1 million found at some point since, and 55,820 carrying all four of the risk flags it tracks at once.
The early research tells you this is not new or rare:
| Who looked | When | What they found |
|---|---|---|
| Bitsight | January 27 to February 8, 2026 | More than 30,000 separate setups reachable from the open internet, including some in healthcare, finance, government, and insurance |
| SecurityScorecard STRIKE | First 24 hours of scanning, February 2026 | More than 40,000 exposed setups, 35.4% of them flagged as having a known weakness |
| SecurityScorecard STRIKE | October 19, 2026 | About 49,500 answering live, 38.8% flagged, 1,326 new in 24 hours |
This keeps happening because the convenient choice and the safe choice point in opposite directions. OpenClaw starts off listening only on its own machine, which is the right default and also the annoying one. The moment somebody wants to reach the assistant from a phone at the airport, they go looking for a way around that, and the internet is full of advice on how. Bitsight documented two common workarounds, both of which end with the control panel facing the open internet. The researchers also found that when they ran this in February, nothing stopped an owner from protecting that panel with a one-character password.
One correction worth making: exposed is not the same as broken into. Nobody has shown that most of these setups were raided. What the numbers show is a lot of unlocked doors on a street where people are known to try handles.
Does OpenClaw fix its security problems?
Constantly, which is both the reassuring part and the catch. We counted the project's public security notices on October 19, 2026: 722 of them published between January 31 and September 11, 2026, including 14 rated critical and 249 rated high. We counted 100 software releases in the five months to October 18, 2026, the most recent of them that same day.
Read those two numbers together and you have the honest picture. A project that publishes 722 security notices in eight months is one that takes reports seriously, fixes them, and tells people. It is also one you cannot install and forget. Every one of those fixes only protects a business that installed it.
The critical ones are the kind that matter to an owner, not just to an engineer. In plain terms, several of them would have let somebody who was not supposed to be there run commands on the machine, or quietly upgrade their own access from "can look" to "can do anything." Those were found and patched. The question for you is whether the copy running in your office got the patch.
That standing job is the cost most do-it-yourself plans leave out. The setup weekend is the cheap part. Reading release notes and applying updates every week, forever, owned by a named person who is still here next year, is the expensive part. Hermes Agent against OpenClaw comes down to the same thing from a different angle, and what Hermes Agent costs a small business to run prices the hours.
Can someone trick your agent with an email?
They can try, and locking your chat app does not stop it. OpenClaw's guidance on this says the attack does not need a stranger messaging the bot at all: any content the agent reads, including web pages, emails, documents, attachments, and pasted text, can carry hidden instructions aimed at the agent rather than at you.
Picture your agent sorting the shared inbox. A message arrives with instructions buried in it, worded for a machine and invisible to a person skimming. The agent reads the inbox, reaches the instructions, and treats them as a request. If that same agent can also send email and open files, those instructions have just borrowed your hands.
The practical defenses are boring and they work. Give the agent that reads outside mail no ability to send or to touch files. Keep the agent with real access away from anything that arrives from outside. Put approval in front of every message that leaves your company, every payment, and every change to who can get in. We cover the approval design in what to approve and what to let run.
OpenClaw's team is honest that this is not solved. Their threat model says most failures are not clever exploits at all, but "someone messaged the bot and the bot did what they asked."
Eight questions to settle before the agent touches your business
Print this. Give it to whoever is setting the agent up, whether that is your own technical person, a contractor, or a vendor. Every answer has to be yes before it gets a real login. The stop rule is simple: if three or more are no, the agent gets a practice account and sample data until they are yes.
| # | Question to answer | Why it matters | Yes / No |
|---|---|---|---|
| 1 | Is the control panel reachable only from inside our network? | This is the single failure behind tens of thousands of exposed setups | |
| 2 | Is it protected by a long random password that is not reused anywhere? | Researchers found one-character passwords were accepted, and anything reachable gets guessed at | |
| 3 | Does it run on its own machine, not somebody's working laptop? | Limits what one bad day can reach | |
| 4 | Does it have its own email address, its own logins, and no shared passwords? | Lets you shut it off without locking out a person | |
| 5 | Can we list every system it can reach, on one line each? | If nobody can list them, nobody is controlling them | |
| 6 | Does it need a person's approval to send anything outside the company, move money, or change who has access? | These are the actions you would have to apologize for | |
| 7 | Is there a named person who installs updates every week, with a backup when they are away? | 722 fixes in eight months only help if you install them | |
| 8 | Has anyone run the built-in check, openclaw security audit, and shown you the result? | The project ships its own inspection; make somebody run it in front of you |
Question eight is the cheapest on the list and the easiest to actually verify. OpenClaw includes a command, openclaw security audit, that checks whether strangers can reach the bot, whether it is exposed on the network, whether risky abilities are switched on, and whether its files are readable by the wrong people. It takes seconds to run. Ask to see the output rather than somebody's summary of it, and ask again after any change to the setup.
Add a ninth line of your own if you install community add-ons. OpenClaw's own answer on that treats them as code you are choosing to trust, and says the marketplace scans "are not a complete security boundary."
What we require of the agents that run our own company
We run our business on AI agents, so this is not theory for us. The rules we hold them to are duller than people expect, and most of them are about who approves what.
No agent of ours sends an email on its own. Every one is drafted and waits for a person to approve it, and that rule is written once and applies to every agent we have, with no per-agent exceptions. Money movement, changes to live customer systems, mass messaging, and anything legal all need an owner's sign-off. Each agent gets its own job and its own access, so the one that handles our books cannot reach the one that handles our marketing accounts. Passwords live in one approved place and never get written into notes, shared documents, or anything saved alongside our work.
The rule we are proudest of came from a mistake. One of our owners found an automated job acting inside his personal account on a professional network, doing work another owner had asked for. He stopped it the same day and set a standing rule: anything automatic that acts inside his personal account needs his approval first, every time, even when somebody else requested the work. Read-only jobs were allowed back; the ones that act were not. That is the right instinct, and it is one a small business can copy on Monday morning.
We have had agents fail in other ways too, and we wrote up five of them with what each one cost. None of the failures were exotic. They were an agent doing exactly what it was told, in a situation nobody had thought about.
When running OpenClaw yourself is a reasonable call
Plenty of the time. Run it yourself when somebody on your team genuinely enjoys this and has real hours free, when the first job is low-stakes, when the agent touches practice data or one harmless system, and when a bad day costs you an afternoon rather than a customer. That is a good way to learn what these things are actually like, and it costs almost nothing.
Get help when the opposite is true: when the agent would hold your email, your customer records, or your books, when nobody owns the weekly updates, when the only person who understands the setup could leave, or when you are in a line of work where a data problem becomes a letter from a regulator. The four ways a business can get an AI agent lays out what sits between those two choices, and OpenClaw alternatives helps if you already run one and want out.
The thing to avoid is the middle: a real agent, with real access, owned by nobody in particular. That is roughly the profile of the setups sitting on that scan dashboard.
Frequently asked questions
Is OpenClaw safe to install?
On a personal machine with nothing sensitive on it, yes, and that is what it was built for. On a business machine with your email and files, only after you have limited what it can reach, kept it off the open internet, and named the person who installs updates. The project itself describes the out-of-the-box setup as a personal assistant for one trusted operator.
Has OpenClaw been hacked?
Individual setups have been left exposed in large numbers, and security researchers have shown how an exposed one can be abused. That is different from the project being breached. OpenClaw publishes its security fixes openly, 722 of them between January 31 and September 11, 2026, which is how a healthy open source project handles this.
Is OpenClaw a scam or legitimate software?
It is legitimate. It is free, open source, released under a permissive license, stewarded by a nonprofit foundation, and built in public by a large group of contributors. Nobody is selling you a subscription. The risk is in how it gets set up, not in who is behind it.
Can OpenClaw read my emails and files?
Yes, if you connect them. That is the point of it. It can read and write files on its machine and reach any account you link. Decide which accounts it gets before you install anything, and give it its own logins rather than sharing a person's.
What is the single most important thing to get right?
Keep the control panel off the open internet. That one choice is behind almost every alarming number in the research, and it costs nothing to get right at setup. The rest of the checklist matters, but it matters less than this.
Do I need a technical person to run this safely?
For a business, yes. Not a full-time one, but somebody who owns the setup, the access list, and the weekly updates, and who answers when it misbehaves. If you cannot name that person today, you have your answer about running it yourself.
Who owns the patching?
Every honest version of this question ends in the same place. The software is free, the setup is a weekend, and the real commitment is the person who keeps it locked down and up to date for the next two years. If you have that person, OpenClaw is a fine thing to run.
If you do not, we do that part. Bring the one job you would hand over first, and we will scope it with you, including an honest read on whether you should just run it yourself.
