OpenClaw Trojan AI agents give attackers remote control over 28,000 systems

SecurityScorecard discovered over 28,000 OpenClaw AI agent systems exposed online with inadequate security controls, affecting approximately 63% of identified instances. These systems lack proper safeguards, creating significant vulnerability to remote exploitation and unauthorized access. The exposure represents a critical security risk in AI agent deployments, highlighting the urgent need for stronger authentication, access controls, and monitoring mechanisms in production AI systems.

Key Points

• •28,000+ OpenClaw AI agent systems identified with weak or missing security safeguards
• •Approximately 63% of exposed systems lack adequate protective measures
• •Remote control vulnerability allows attackers to compromise affected systems
• •Weak authentication and access controls are primary vulnerability vectors
• •AI agent systems require hardened security configurations before production deployment
• •Exposed systems create supply chain and lateral movement risks across organizations
• •Monitoring and detection capabilities are insufficient in majority of deployments
• •Urgent remediation needed: implement network segmentation, strong authentication, and audit logging

Workflow Diagram

Concepts