Are you one of the 245,000 Exposed ?

245,000 OpenClaw Servers Are Sitting Open Online.
What that means for You.

Picture a normal Sunday. You set up an OpenClaw agent to handle messages on WhatsApp, it works on the first try, and you close the laptop feeling clever. What you do not see is that the same agent is now reachable by anyone on the internet, and it may be handing your API keys to complete strangers.

That is not a hypothetical. In mid-May, security researchers scanned the internet and found roughly 245,000 OpenClaw servers sitting out in the open.

What the researchers actually found

The report, nicknamed "Claw Chain", combined scans from tools that map the public internet. The headline number was about 245,000 reachable OpenClaw instances, and a large share of them had no password at all. An earlier scan by a separate firm found more than 21,000 servers bound straight to the open internet with authentication switched off, quietly leaking Anthropic keys, Telegram tokens, and Slack logins to anyone who looked.

Researchers also chained four separate flaws together. On its own, each one is a headache. Stacked together, they let an outsider run commands on your server, read your saved credentials, take full control, and then quietly stay there. The most serious of the four carried a severity score of 9.6 out of 10.

If that sounds technical, here is the plain version. A stranger can take over your agent, spend your AI budget, and read your conversations, and you might never notice.

Why a missing password matters more than you think

Most people assume "I am small, nobody cares about my little bot." Attackers do not work that way. They scan the whole internet automatically, find every open door, and walk through all of them at once. Your setup does not have to be interesting. It only has to be reachable.

And the prize is real. OpenClaw runs on your own AI keys, the "bring your own key" model. If someone lifts those keys, they can run their own workload on your account. People have woken up to four-figure API bills they never made. One well-known case saw a single power user run up 1.3 million dollars in tokens in a single month. Now imagine a slice of that landing on your card instead.

How someone gets in, in plain English

1. They scan the internet and find your OpenClaw address.

2. There is no password, or a known flaw lets them skip it.

3. They run a command that hands them the keys and tokens you saved.

4. They install a quiet way back in, so even if you patch later, they are still there.

The whole sequence is automated. It can happen minutes after you go live, while you are still admiring your new agent.

This is not just an "old version" problem

It would be comforting to say "just update and you are fine." The trouble is that the updates never stop. OpenClaw shipped its newest stable version, 2026.6.1, on June 3, only days ago. The project has issued well over a hundred security advisories in roughly two months. Even the official documentation now recommends running the gateway on its own separate server, because a known memory bug can crash it.

For a business owner who set up a bot once and moved on, keeping that pace is a second job. Miss one update window and you are back on the exposed list.

How to check and protect your setup today

You do not need to panic. You need a short checklist. Run through this:

• Turn authentication on. If your agent has no login, fix that first.

• Do not bind it to 0.0.0.0, the setting that means "open to the whole internet." Bind to localhost or a private network instead.

• Put a firewall in front of it and open only the ports you actually use.

• Update to the latest version, then keep updating.

  

• Run the gateway on its own server, so one crash does not take everything down with it.

• Rotate your API keys if there is any chance they were exposed.

• If you are not sure whether your server is reachable from outside, assume it is, and check.

Even doing the first three closes the door on the large majority of these automated attacks.

Or skip the whole thing and let us handle it

Here is the honest tension. OpenClaw is genuinely useful, and self-hosting gives you full control. But "full control" also means you are the security team, the update team, and the on-call team, all at once, forever. The 245,000 servers on that exposed list have one thing in common. Every single one is run by someone going it alone.

This is exactly the problem we built OneClickClaw to remove. Authentication is on by default. Your server is never left open to the internet. We apply the updates and patches the day they ship, and we isolate the gateway the way OpenClaw's own docs ask. It all runs on European servers, using your own keys, so the convenience never costs you your privacy.

Put plainly: when the next scan of 245,000 exposed servers goes out, our customers are not on it, and they never had to lift a finger to stay off it. That is the entire point of paying someone to run it for you. You get the agent that works, without the open door behind it.

The bigger picture

OpenClaw crossed into the mainstream fast. Half a million installations are running it today. That popularity is exactly why the attackers showed up. A tool that this many people run, most of them without a security background, is an enormous and easy target.

The fix is not fear. It is a password, a firewall, and someone keeping the thing patched. You can do all of that yourself, every Sunday, forever. Or you can let us do it and never think about it again. Either way, do not be one of the 245,000. And if you would rather skip the problem entirely, deploying a locked-down OpenClaw on OneClickClaw takes about a minute.

Frequently asked questions

How do I know if my OpenClaw server is exposed? If you can reach your agent's address from a different network without logging in, so can a stranger. Treat anything bound to 0.0.0.0 with no password as already being scanned.

Does adding a password fix everything? It closes the most common door, which is the one most of the exposed servers left open. You still want a firewall, current updates, and rotated keys, but turning authentication on is the single biggest win.

Is self-hosting OpenClaw a bad idea now? No. Self-hosting is fine if you treat security as an ongoing task. The real risk is setting it up once and forgetting it, which is what most of the exposed servers did.

What is the safest way to run OpenClaw? Either harden it yourself with the checklist above and stay on top of every update, or use a managed host that keeps it locked down and patched for you. That is exactly what OneClickClaw does by default, on European servers, with your own keys. The wrong answer is leaving it open and hoping.