Microsoft’s security team published guidance on February 19 urging organizations to treat self-hosted AI agents such as OpenClaw as untrusted code execution, warning that the broad access these tools have to local systems makes a misconfigured deployment a serious liability. CrowdStrike issued a similar warning, saying attackers can take over poorly secured instances and turn them into persistent backdoors.
OpenClaw is a popular open-source agent framework that users run on their own machines or servers. It connects a large language model to tools for browsing the web, managing files and executing commands, and it can be extended with community-built “skills” distributed through a registry called ClawHub. That combination of autonomy and system access is what makes it useful, and also what worries security teams.
What Microsoft is warning about
In its blog post, Microsoft said self-hosted agents execute code using long-lived credentials while processing untrusted input from web pages, documents and messages. That creates what the company called a dual supply chain risk: malicious content fed to the agent can hijack its behavior through prompt injection, and malicious skills installed from a registry can carry hidden instructions or code. Microsoft’s recommendations center on identity controls, isolating the agent from the rest of the network and limiting what it can do at runtime.
Exposed instances and poisoned skills
Security researchers have reported finding more than 135,000 OpenClaw instances exposed on the public internet, many with administrative interfaces reachable without adequate authentication, according to reports summarized by the networking firm Conscia and others. Separately, researchers at Koi Security audited all 2,857 skills then available on ClawHub and identified hundreds that were suspicious or outright malicious, including skills designed to exfiltrate data or give an attacker remote control of the agent.
CrowdStrike said in its own analysis that a compromised agent is more dangerous than a conventional malware implant because it already has legitimate access to a browser, the file system and a command shell, and because its activity can look like normal automation. The firm has added detection for OpenClaw deployments to its Falcon platform so that customers can at least see where the agents are running.
What security teams should do
The guidance from both companies converges on a few practices. Agents should run in isolated environments, such as containers or dedicated virtual machines, with network access restricted to what the task requires. Credentials should be scoped narrowly and rotated, rather than giving the agent a user’s full set of tokens. Skills should be reviewed before installation and pinned to known versions. Administrative interfaces should never be exposed to the internet without strong authentication.
These are standard zero-trust principles, applied to a new kind of software. Experts quoted in the coverage note that the problem is less that OpenClaw is uniquely insecure than that many users deploy agents with the permissions of a trusted administrator and the input-handling discipline of a chatbot.
The episode is an early example of a pattern likely to recur as agentic AI spreads: the more autonomous and capable an agent becomes, the more its security depends on the configuration around it rather than on the model itself.
