I’m a financial markets person, not a developer, so I haven’t used OpenClaw myself. But since it is having an effect on many facets of the tech industry, I’ve been (loosely) following it.
This is a Bloomberg article that greatly added to my understanding from a couple of months ago (I’ve quoted several sections because the full story is behind a paywall):
The digital assistant can use your computer to handle complex tasks that previously only a human could undertake, such as making travel bookings, prioritizing emails and drafting replies, surveying product catalogs and emailing vendors.
This leap in productivity comes with a catch: OpenClaw has proved to be a gift to hackers. One critical flaw, dubbed ClawJacked, allowed intruders to take control of a user’s OpenClaw agent simply by getting them to visit a malicious website. That defect was fixed. But researchers have found more than 40,000 vulnerabilities in the software.
Nowhere is there as much excitement or apprehension around OpenClaw as in China, where its rapid adoption has led to gyrations in the stock prices of big local tech firms and prompted officials to warn government agencies and state-owned enterprises — including some of the country’s largest banks — against installing it on office devices.
[…]
It’s an AI assistant that can be set up on a computer or even a smartphone. Giant AI companies including OpenAI Inc. and Anthropic PBC also offer agents that field tasks for users. However, those companies don’t allow customers to modify their agents’ underlying parameters. OpenClaw’s code is “open source,” which allows users to be more freewheeling with the product, opening the door to some more inventive — and potentially risky — uses for the technology. OpenClaw works from the data on a user’s phone or computer, in contrast to other popular AI services that process it remotely in so-called cloud networks.
[…]
Some cybersecurity experts see a disaster in the making. In March, several Chinese government agencies and banks issued official alerts over OpenClaw. They detailed risks including data theft and “prompt injection” attacks, in which texts are sent to trick an AI agent to perform unauthorized actions.
Hackers can create new “skills” for OpenClaw that include installing hidden malware and harvesting the personal data of users and their contacts. Kasimir Schulz, director of security research at HiddenLayer Inc., said OpenClaw ticks all the boxes when it comes to cybersecurity risk: It has access to private data, it can communicate externally and has exposure to untrusted content.
For agentic AI like OpenClaw to be really useful, it needs to know all about you, and gain access to a variety of apps. That makes them juicy cyberattack avenues or targets.
https://www.bloomberg.com/news/articles/2026-03-11/what-is-the-openclaw-ai-agent-and-why-is-it-popular-in-china
So, since OpenClaw is great for vibe coding—and all of the risks and problems associated with vibe coding—things like this can happen, even to people who code for a living:
Chris Boyd, a software engineer, began tinkering with a digital personal assistant called OpenClaw at the end of January, while he was snowed in at his North Carolina home. He used it to create a daily digest of relevant news stories and send them to his inbox every morning at 5:30 a.m.
But after he gave the open-source AI agent access to iMessage, Boyd says OpenClaw went rogue. It bombarded Boyd and his wife with more than 500 messages and spammed random contacts too.
“It’s a half-baked rudimentary piece of software that was glued together haphazardly and released way too early,” said Boyd, who added that he has since altered OpenClaw’s codebase to apply his own security patches to reduce risks. “I realized it wasn’t buggy. It was dangerous.”
https://www.bloomberg.com/news/articles/2026-02-04/openclaw-s-an-ai-sensation-but-its-security-a-work-in-progress