5 Security Rules to Follow Before Running OpenClaw

OpenClaw is a local-first AI assistant platform with a Gateway that connects models, sessions, messaging channels, and tools. Depending on its configuration, an agent can read or modify files, run commands, browse the web, contact people, or trigger external services. Treat it as privileged infrastructure, not as a harmless chat window.

The safest starting point is one operator, a loopback-only Gateway, minimal tools, no unreviewed extensions, and no access to valuable accounts. Expand that boundary only after testing and auditing the exact configuration.

1. Understand the one-operator trust model

OpenClaw's documented model is a personal assistant for one trusted operator, not a multi-tenant service that isolates mutually untrusted users inside one Gateway. An authenticated Gateway caller is treated as a trusted operator, and session identifiers route work rather than creating user-level authorization boundaries.

If several people need their own private agents, separate them by trust boundary: ideally one host or VPS and one Gateway per user. Do not put adversarial users on a shared Gateway and assume their sessions, files, or tools are isolated.

The project's security policy and trust model also says the model itself is not a trusted principal. Prompt injection can manipulate an agent; real boundaries must come from authentication, tool policy, sandboxing, allowlists, and approvals.

Keep the web interface local by default

Bind the Gateway to loopback, which is the recommended default, and do not expose its Control UI or HTTP endpoints directly to the public internet. For remote access, follow the project's supported exposure guidance, such as a carefully configured SSH tunnel or private network, while retaining strong Gateway authentication.

openclaw gateway run --bind loopback

A firewall is useful but does not replace application authentication. Anyone who obtains the Gateway operator secret may gain broad operator capabilities.

2. Restrict tools and enable sandboxing deliberately

OpenClaw's main session can run tools on the host, and sandbox mode may be off unless you enable it. That is convenient for a single trusted owner, but it gives a successful prompt injection or mistaken command a large blast radius.

• Use the smallest tool profile that can complete the job.
• Deny shell, browser, node, cron, and messaging actions unless they are required.
• Enable sandboxing for untrusted or non-main sessions.
• Mount only the necessary workspace rather than a home directory or entire drive.
• Run the process as a dedicated non-administrator operating-system user.
• Keep destructive or external actions behind an explicit approval step.

A container can reduce exposure, but it is not automatically secure. Avoid privileged mode, drop unnecessary Linux capabilities, use a read-only filesystem where possible, and mount narrow data volumes. Do not place host sockets, SSH directories, browser profiles, or cloud credentials in the container unless the agent truly needs them.

Treat every inbound message as untrusted

Email, chat messages, web pages, documents, and tool output can contain instructions intended to redirect the agent. Limit who can trigger a channel, require pairing or allowlists, and use mention gates in groups. Separately limit what tools that channel's sessions can use.

3. Audit skills and plugins as supply-chain code

OpenClaw plugins are loaded into the Gateway process and are part of its trusted computing base. A trusted plugin can read environment variables and files or run host commands with the OpenClaw process's privileges. Skills can also contain instructions, scripts, or references that cause privileged tools to act. Installing an extension is therefore a security decision.

• Install only extensions needed for a defined workflow.
• Verify the repository, publisher history, license, release tag, and source.
• Pin an exact version when reproducibility matters.
• Inspect install scripts, dependencies, shell commands, network destinations, and requested files.
• Prefer an explicit plugin allowlist.
• Test new extensions in an isolated account with disposable credentials.

Marketplace presence, popularity, or a clean automated scan does not prove safety. Obfuscated download commands, instructions to disable protections, unsigned binaries, or requests for wallet and browser-profile access are reasons to stop.

After changes, run OpenClaw's audit. The --deep mode adds plugin and skill code scans plus live Gateway probes:

openclaw security audit
openclaw security audit --deep

The optional --fix action applies a limited set of safe remediations; review its findings and resulting configuration rather than assuming it hardens every risk. See the official OpenClaw security guide for current checks and response steps.

4. Protect and minimize secrets

An agent often runs close to model API keys, messaging tokens, Gateway credentials, browser sessions, and cloud accounts. If one leaks, an attacker may not need to exploit OpenClaw at all—they can reuse the credential directly.

• Use the platform's supported secret mechanism or a dedicated secret manager.
• Do not put credentials in prompts, workspace memory, skill documentation, repositories, or logs.
• Give each service account only the permissions required for its workflow.
• Use separate development and production credentials.
• Set spending limits and provider alerts where available.
• Review file permissions on ~/.openclaw and configuration includes.
• Redact transcripts and logs before sharing them for troubleshooting.

Environment variables are better than committed plaintext, but any in-process plugin may still be able to read them. Isolation and least privilege remain necessary.

If a secret may have been exposed, rotate it; deleting it from a file does not invalidate the copied credential. Rotate Gateway authentication, remote-client credentials, model keys, and connected-service tokens as applicable, then inspect sessions and logs.

5. Gate voice, messaging, and other external actions

Sending a message, making a call, publishing content, running a deployment, or completing a purchase affects people and systems outside the local workspace. Treat these as high-impact operations with stricter controls than reading a file.

OpenClaw's voice-call capability is an optional plugin with providers such as Twilio, Telnyx, and Plivo. It can support outbound notifications, conversations, and inbound calls, which means it can also incur cost, contact the wrong person, or disclose information.

• Allowlist recipients and inbound callers.
• Require human approval before the first contact or any sensitive message.
• Show the exact recipient and content in the approval request.
• Set time windows, rate limits, call-duration limits, and spending caps.
• Use a mock provider or test account before a live telephony provider.
• Log actions without storing unnecessary message or call content.
• Provide an immediate way to disable the channel and revoke its token.

The same pattern applies to email, Slack, social posts, calendar invitations, and financial actions. Drafting is lower risk than sending; searching is lower risk than modifying; preparing a deployment is lower risk than releasing it.

Pre-deployment checklist

Model quality can reduce ordinary mistakes, but no model is a security boundary. Safe operation comes from limiting what the agent can reach and making consequential actions visible, reviewable, and reversible.