Trust

A New Era in Computing Security

For the past 20 years, security models have been built around locking devices and applications down — setting boundaries between inter-process communications, separating internet from local, sandboxing untrusted code. These principles remain important.

But AI agents represent a fundamental shift.

Unlike traditional software that does exactly what code tells it to do, AI agents interpret natural language and make decisions about actions. They blur the boundary between user intent and machine execution. They can be manipulated through language itself.

We understand that with the great utility of a tool like OpenClaw comes great responsibility. Done wrong, an AI agent is a liability. Done right, we can change personal computing for the better.

This security program exists to get it right.

Context

OpenClaw is an AI agent platform. Unlike chatbots that only generate text, OpenClaw agents can:

• Execute shell commands on the host machine
• Send messages through WhatsApp, Telegram, Discord, Slack, and other channels
• Read and write files in the workspace
• Fetch arbitrary URLs from the internet
• Schedule automated tasks
• Access connected services and APIs

This capability is what makes OpenClaw useful. It's also what makes security critical.

AI agents that can take real-world actions introduce risks that traditional software doesn't have:

1. Prompt injection — Malicious users can craft messages that manipulate the AI into performing unintended actions
2. Indirect injection — Malicious content in fetched URLs, emails, or documents can hijack agent behavior
3. Tool abuse — Even without injection, misconfigured agents can cause damage through overly permissive settings
4. Identity risks — Agents can send messages as you, potentially damaging relationships or reputation

These aren't theoretical. They're documented attack patterns that affect all AI agent systems.

Scope

This security program covers the entire OpenClaw ecosystem. Nothing is out of scope.

Core Platform

• OpenClaw CLI and Gateway (openclaw)
• Agent execution engine
• Tool implementations
• Channel integrations (WhatsApp, Telegram, Discord, Slack, Signal, etc.)

Applications

• macOS desktop application
• iOS mobile application
• Android mobile application
• Web interface

Services

• ClawHub (clawhub.ai) — Skills marketplace and registry
• Documentation (docs.openclaw.ai)
• Any hosted infrastructure

Extensions

• Official extensions (extensions/)
• Plugin SDK and third-party plugins
• Skills distributed through ClawHub

People

• Core maintainers and contributors
• Security processes and response procedures
• Supply chain and dependency management

Program Overview

We're establishing a formal security function with four phases:

Phase 1: Transparency

Goal

Develop and publish our threat model openly, inviting community contribution, so users understand the risks and can make informed decisions about their deployments.

Why

Security through obscurity doesn't work. Attackers already know these techniques — they're documented in academic papers, security blogs, and conference talks. What's missing is clear communication to users about:

• What risks exist
• What we're doing about them
• What users should do to protect themselves

By developing the threat model openly, we benefit from collective expertise and build trust through transparency.

Threat Model Coverage

Threat Model Scope

Each risk in the threat model will include description and severity rating, attack examples, current mitigations, known gaps, and user recommendations.

The threat model will be open for community contribution via pull requests.

Phase 2: Product Security Roadmap

Goal

Create a public product security roadmap defining defensive engineering goals, tracked as GitHub issues so the community can follow progress, provide input, and contribute.

Defensive Engineering Goals

Specific priority issues will be identified through the Phase 3 code review and added to the public roadmap as they are discovered and triaged.

Phase 3: Code Review

Goal

Conduct a comprehensive manual security review of the entire codebase, supplemented by automated tooling where appropriate, to identify vulnerabilities we've missed and validate our threat model.

Scope

The code review covers the entire OpenClaw codebase and ecosystem:

Approach

1. Manual code review — Line-by-line analysis of security-critical paths
2. Automated scanning — Static analysis, dependency auditing, secret detection
3. Dynamic testing — Attempting documented attack patterns against running system
4. Architecture review — Evaluating trust boundaries and data flows

Disclosure

• All critical and high findings fixed before public disclosure
• Findings summary published after remediation
• Full report available on request
• CVEs assigned where applicable

Phase 4: Security Triage Function

Goal

Establish a formal process for receiving, triaging, and responding to security vulnerability reports.

Response SLAs

Our Commitments

• Acknowledge all complete reports within 48 hours
• Provide status updates at least every 14 days
• Credit researchers in advisories (unless anonymity requested)
• Not pursue legal action against good-faith security research
• Consider bounties for qualifying critical/high findings (case-by-case)

Security Advisor

OpenClaw is bringing on Jamieson O'Reilly (@theonejvo) as lead security advisor to guide this program.

Jamieson is the founder of Dvuln, co-founder of Aether AI (the world's most dangerous AI, in your corner), a member of the CREST Advisory Council, and brings extensive experience in offensive security, penetration testing, and security program development.

Responsibilities

• Lead threat modeling and risk assessment
• Scope and oversee code review
• Establish triage process and response procedures
• Review security-critical code changes
• Provide guidance on security architecture decisions

Current Security Posture

OpenClaw already has security controls in place. Understanding what exists helps users configure their deployments appropriately.

Secure by Default

Verify Your Setup

openclaw security audit --deep

Key items to verify:

• DM policy is pairing or allowlist (not open)
• allowFrom is configured for your channels
• Exec security is not set to full unless intended
• Gateway is bound to loopback or behind authentication
• Workspace doesn't contain secrets

Timeline

WEEK 1-2: Phase 1 — Transparency
├── Threat model development begins (open for contribution)
├── Security configuration guide drafted
├── Visual overview created
└── Announcement posted

WEEK 3-4: Phase 2 — Product Security Roadmap
├── GitHub issues created for defensive engineering goals
├── Security label and milestone set up
├── Community input period opens
└── First security work begins

WEEK 5-8: Phase 3 — Code Review Preparation
├── Scope finalized (entire codebase)
├── Review begins
└── Initial findings

WEEK 8-12: Phase 3 — Code Review Execution
├── Manual review completed
├── Findings documented
├── Remediation for critical/high
└── Verification completed

WEEK 8+: Phase 4 — Triage Function
├── security@openclaw.ai live
├── PGP key published
├── Disclosure policy published
└── First advisories (if needed)

ONGOING:
├── Monthly security updates
├── Continuous threat model refinement
├── Regular dependency auditing
└── Community engagement

FAQ