OpenClaw
Disclosed Feb 9, 20267 months agoUnverified
More than 135,000 OpenClaw AI agent instances found exposed to the internet
SecurityScorecard's STRIKE team found over 135,000 internet-exposed instances of the open-source OpenClaw agent, which listens on all interfaces by default; its skills were also reported to leak API keys, card numbers and personal data, and its skill store hosted malware.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Feb 9, 2026 |
| Attack | Exposed data |
| Data exposed | API keys, Credentials and tokens, Payment cards |
| Sector | AI |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
| Source | |
|---|---|
| OpenClaw instances open to the internet present ripe targetstheregister.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Feb 9 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.