DEV Community

Daniel Kim
Daniel Kim

Posted on

OpenClaw Broke React's 10-Year GitHub Record in 60 Days. Its CVE List Grew Almost as Fast.

#opensource #ai #github #security

OpenClaw on GitHub

React took roughly ten years to cross 250,000 GitHub stars. OpenClaw did it in about sixty days, going from 9,000 stars to over 60,000 in the space of a single week after it went viral in late January 2026, then blowing past 346,000 by April and settling north of 380,000 stars today — enough to put it inside GitHub's all-time top-15 most-starred repositories, ahead of projects with a decade of head start.

That number alone would be a decent DEV post. But the interesting part of OpenClaw isn't the star count. It's what happened in parallel: while the repo was setting growth records, security researchers were racking up a matching list of CVEs — a critical one-click remote code execution bug with a CVSS score of 8.8, command injection, SSRF, path traversal, and prompt-injection-driven code execution, on a project explicitly designed to sit in your WhatsApp, Slack, and Discord threads with standing access to your shell.

I went through the repository, the CVE disclosures, Microsoft's internal security guidance for running it, and the surrounding framework-comparison ecosystem. The short version: OpenClaw is a genuinely useful piece of engineering that solves a real distribution problem other agent frameworks ignore, and it is also, by its own vendor's admission, not something you should run next to your work laptop. Both things are true at once, and the gap between them is why this is worth understanding rather than skimming.

What OpenClaw actually is

Cut through the branding ("Your own personal AI assistant. Any OS. Any Platform. The lobster way.") and OpenClaw is a self-hosted agent runtime with one specific, well-executed idea: your AI assistant should live where your conversations already live, not in a separate browser tab.

Concretely, it's three things bundled together:

  1. A Gateway — the control plane. A long-running server process that owns sessions, tool execution, event routing, and channel connections.
  2. Channel adapters — connectors for WhatsApp, Telegram, Slack, Discord, Signal, Apple iMessage, Google Chat, Microsoft Teams, Matrix, and Zalo. Ten-plus messaging surfaces, normalized into one internal message format.
  3. A skills/tools system — modular capabilities (shell access, file operations, browser automation, calendar, memory) that the agent can invoke, plus a plugin interface for adding your own. The community-run awesome-openclaw-agents repo alone catalogs 162 production-ready agent templates across 19 categories.

You talk to it the way you'd text a person. It remembers context across sessions via persistent memory, runs continuously (heartbeat/background tasks, cron-style triggers, webhook and Gmail-Pub/Sub-style event delivery), and asks for approval before doing things you haven't pre-authorized — at least by default.

The install bar is genuinely low: Node.js 22.22.3+/24.15+/25.9+, pnpm, and either an npm install or one of the platform-specific shell installers. It runs on macOS, Linux, Windows via WSL2, in Docker, or on Fly.io/Render. There's a menu-bar app for local Gateway control, a web Control UI, a CLI/TUI, and an Android companion that pairs as a device node with camera, screen-capture, and voice tabs.

That's the pitch: point-and-click deployment, no orchestration code, and the assistant meets you in the app you already have open.

How it's built — and why that's the differentiator

Most of the 2025–2026 agent-framework wave optimized for control: LangGraph models agent logic as an explicit state machine so you can reason about every transition; CrewAI and AutoGen give you role-based multi-agent choreography; AutoGPT chases full autonomy toward a goal, with the well-known failure mode of spiraling into expensive, unproductive loops when the goal is underspecified.

OpenClaw optimized for something almost nobody else did: channel-native reachability. No other mainstream framework treats "text your agent from your phone through an app you already have installed" as the primary interface. That's not a small UX nicety — it's the entire value proposition. A LangGraph agent is something you build; an OpenClaw agent is something you deploy and immediately start messaging.

The architectural cost of that choice is where things get interesting. To be reachable from WhatsApp or Discord and do things — read files, run shell commands, browse the web, control a phone — the Gateway needs standing, persistent credentials and, by default, host-level tool execution. LangGraph's state-machine model constrains what an agent can do at each step by construction. OpenClaw's model is closer to "give a capable, always-on process your accounts and your shell, then use natural language as the access-control layer." That is a fundamentally different trust model, and it's the one that shows up in the CVE list.

What changed: from "agent demo" to "agent with your credentials, in your pocket"

The comparison worth internalizing isn't OpenClaw vs. LangGraph on a feature grid — it's the shift in what "the agent" has access to. A LangGraph or CrewAI deployment is typically scoped: specific tools, specific API keys, running inside your infra with whatever sandboxing you built. OpenClaw's default posture is closer to a background daemon with messaging-app-triggered execution and, per its own docs, tools that "run on the host unless sandboxing is configured."

That single design decision — trading isolation for reachability — is the throughline connecting the growth story and the security story. It's also not unique to OpenClaw; it's the emerging shape of every "personal AI assistant" product. OpenClaw is just the one that got there first, at scale, in the open.

The CVE list, in order

This is the part most coverage of OpenClaw's star count skips, and it's the part that actually matters if you're deciding whether to run this thing.

CVE-2026-25253 (CVSS 8.8) — one-click remote code execution. Disclosed via The Hacker News and ProArch's advisory, discovered by security researcher Mav Levin and patched in version 2026.1.29 (January 30, 2026). The Control UI trusted a gatewayUrl value from the query string without validating it, and auto-connected on page load — sending the stored gateway token over the WebSocket handshake. Because the Gateway didn't validate the WebSocket Origin header, any website could open a connection and receive that token, bypassing the loopback-only restriction that was supposed to protect local instances entirely. With a stolen token carrying operator.admin and operator.approvals scope, an attacker could flip exec.approvals to off, set tools.exec.host to gateway to escape the Docker sandbox, and run arbitrary commands directly on the host — all from a single crafted link a user had to do nothing more than click.

That last one is the category-defining risk for this class of tool, and it's structural rather than a bug you patch once. Because OpenClaw translates natural language directly into shell commands and file operations, any text the agent reads — an email, a webpage, a Slack message from someone outside your org — is untrusted input that can steer its behavior. Giskard's security research on OpenClaw documents indirect prompt injection severe enough to rewrite a user's stored memories or force the agent to respond only in all caps across every future session, purely from content the agent was asked to summarize. HiddenLayer's independent research and two arXiv papers (2605.25435 and 2605.23330) reach the same structural conclusion: the risk isn't one exploit, it's the fact that the trust boundary between "content the agent reads" and "commands the agent executes" barely exists by default.

The exposure numbers make this concrete rather than theoretical. SecurityScorecard's February 2026 internet scan found 40,214 OpenClaw instances reachable from the public internet, of which 35.4% were running versions flagged as vulnerable at scan time. That's roughly 14,000 exposed, exploitable agents with shell access sitting on the open internet at a single point in time — not a hypothetical worst case, a measured one.

What Microsoft told its own security teams

The most useful primary source here isn't a blog take — it's Microsoft's internal security guidance for running OpenClaw, published on its security blog. The framing is unambiguous: treat OpenClaw as untrusted code execution with persistent credentials, and — direct quote — "it is not appropriate to run on a standard personal or enterprise workstation."

Their minimum safe operating posture, condensed:

  • Isolation — dedicated VM or separate physical machine only. Never co-located with daily-work access or sensitive data. Treat the environment as disposable.
  • Dedicated credentials — accounts and tokens created solely for the agent, rotated regularly, with the assumption that compromise is possible rather than unlikely.
  • State monitoring — regularly audit saved instructions and persistent rules for drift, since a compromised agent's "malware" often looks like a quietly edited memory file, not a binary.
  • Backup and recovery — snapshot .openclaw/workspace/ (excluding credentials) so a compromised instance can be discarded and rebuilt rather than cleaned.
  • Planned rebuilds — reinstalling from scratch is treated as a normal operational control, not a failure response.

On top of that: enforce least privilege and conditional access through an identity provider (Microsoft's own example uses Entra ID), prefer short-lived tokens over long-lived API keys, and restrict outbound network access to a known allowlist — ideally with endpoint-level web filtering, since an agent that can browse arbitrary URLs on your behalf is also an agent that can be pointed at arbitrary URLs by a prompt injection.

That's a lot of infrastructure discipline for something whose entire pitch is "no orchestration code, just deploy it." The gap between the marketing surface (five-minute setup) and the operational reality (dedicated VM, rotated credentials, planned rebuilds, outbound filtering) is the single most important thing this article can tell you if you're evaluating OpenClaw for anything beyond a sandboxed experiment.

Where OpenClaw actually wins

None of the above means the project is badly engineered or that the growth is fake hype. Strip away the security conversation and the core insight is sound: for a large category of personal-automation use cases — "text my agent to check my calendar," "forward this email thread and have it draft a reply," "ping me on Discord when this cron job needs attention" — the messaging-native interface is a genuinely better fit than a web dashboard or a CLI. Reachability from ten-plus platforms with one deployment, persistent memory across channels, and a real plugin ecosystem (the community awesome-openclaw-agents repo alone lists 162 production templates across 19 categories) is not a trivial engineering achievement, and it explains the organic growth better than hype cycles do.

It's also worth separating two different audiences OpenClaw currently serves, because the honest recommendation is different for each:

  • Hobbyists running it on a spare machine or a throwaway VPS for personal automation, where the blast radius of a compromise is "my own accounts and files." Here, the trade-off is legitimately closer to acceptable, provided you follow the isolation basics — dedicated box, dedicated credentials, no production data anywhere near it.
  • Teams considering it for anything touching company systems, customer data, or shared infrastructure. Here, the CVE history and exposure numbers should be disqualifying until the project's default security posture — not just its optional hardening docs — catches up to its default reachability.

OpenClaw vs. the rest of the agent-framework field

OpenClaw LangGraph CrewAI / AutoGen AutoGPT
Primary interface Messaging apps (WhatsApp, Slack, Discord, etc.) Code / API Code / API CLI / goal prompt
Setup model Deploy, no code required Build with a graph-based SDK Build with role-based agent config Deploy, minimal config
Control model Natural-language-gated execution Explicit state machine Role/task orchestration Autonomous loop toward a goal
Default execution scope Host-level, unless sandboxed Whatever you scope in code Whatever you scope in code Host-level
Multi-agent support Limited (single assistant, multi-skill) Strong (sub-graphs per agent) Strong (core design purpose) Weak
Production predictability Low by default; improves with hardening High — that's the point of the state machine Medium Low (known cost/loop runaway issues)
Known CVE history 5 disclosed CVEs incl. CVSS 8.8 RCE (2026) No comparable public CVE track record No comparable public CVE track record No comparable public CVE track record

The honest read of that table: LangGraph exists for people who need an AI-assisted process to behave like production software, with all the up-front design work that implies. OpenClaw exists for people who want a visible, always-reachable operator sitting in a bounded environment — and it's the only option that gets you there without writing orchestration code. Neither one is "better." They're answering different questions, and OpenClaw's question — "how do I make an agent reachable from my phone with zero glue code" — is one nobody else in this table has seriously attempted.

Decision framework

Try it (sandboxed, this weekend): if you're curious about messaging-native agents and want to see the pattern firsthand. Spin it up on a disposable VM, no real credentials, no production data. This is genuinely the best on-ramp to understanding where agent UX is heading.

Adopt it (with Microsoft's checklist, not the default install): if you have a specific personal-automation workflow, you're comfortable maintaining a dedicated isolated VM, rotating credentials, and rebuilding on suspicion of compromise. Budget the operational overhead — it is real and it is not optional despite what the five-minute install implies.

Wait: if you want the messaging-native pattern for a team or company use case. The core idea is right; the default trust model isn't there yet. Watch the CVE cadence over the next two or three releases — a project moving this fast that also closes vulnerability classes quickly (rather than just patching individual CVEs) is the signal that would change this recommendation.

Ignore it, for now: if your use case involves customer data, production credentials, or shared infrastructure of any kind, regardless of team size. Use LangGraph, CrewAI, or a scoped custom agent where you control the execution boundary directly instead.

The actual takeaway

OpenClaw's growth chart and its CVE list are not a contradiction — they're the same story told twice. The thing that made it grow faster than any repository in GitHub's history (zero-code deployment, standing host access, natural language as the only gate between "read this message" and "run this command") is exactly the thing that produced a CVSS-8.8 one-click RCE, a prompt-injection class of vulnerability that isn't fixable with a single patch, and 14,000-plus exploitable instances found sitting on the open internet in a single scan.

That's not a reason to dismiss the project. It's a reason to treat "npm install and you have a personal AI assistant" and "this needs a dedicated VM, rotated credentials, and a rebuild plan" as the same sentence, not two separate conversations — because right now, most of the people running it are only hearing the first half.

Would you run something with this access profile outside an isolated VM? And if you've already deployed OpenClaw or something like it for real workflows, where did you land on the isolation-vs-convenience trade-off?

Sources:

Top comments (0)