Blog · Published · Updated
Is OpenClaw safe? Check the settings
Short answer
OpenClaw has sensible defaults: the Gateway listens only locally, and an unknown sender gets a pairing code. Tool isolation is off by default, though, so commands can run on the server. Before company data, switch isolation on, narrow the tools and require approval for writes. Approving only writes at 600 actions a month means 1.5 hours of checks instead of 10.
How we workDetails ↓
- 01Call30 minutes with an engineer, free
- 02PrototypeA working system on your process and data, free
- 03ImplementationTarget and fixed price in the contract; 50% at signing
- 04Acceptance50% once the agreed target is met
- net per agent for one process, paid once
- from €3,000
- from signing the contract to acceptance
- 6–16 weeks
- free prototype on your cases
- €0
We belong to the OpenAI and Anthropic partner programmes and learn through their official courses. What this means ↓
Author: Syntalith · 3 min read
Statistics
AI agent security: statistics 2026
8.5 h
fewer hours of checks a month at 600 agent actions, when only the 15% of operations that write need approval, at a minute per approval. Reads run without asking. Scenario.
No. 1
According to OWASP (2025), prompt injection holds first place on the Top 10 list of risks for applications built on language models, as LLM01:2025.
392,716
According to GitHub (2026), the OpenClaw repository has 392,716 stars and 82,549 forks, and the project started on 24 November 2025.
40%
According to Gartner (2025), over 40% of agentic AI projects will be cancelled by the end of 2027 because of costs, unclear value or weak risk controls.
48.8%
According to Eurostat (2025), 48.8% of EU companies that considered AI and did not use it named concerns about data protection and privacy.
Source: Eurostat, Use of artificial intelligence in enterprises (2025) ↗
Figures checked: 22 October 2026
What works by default and what you have to switch on
The OpenClaw security documentation describes cautious starting settings. In an ordinary installation the Gateway listens only on the local address. Most chat channels answer an unknown sender with a pairing code instead of processing the message, and access in groups needs an allowlist and usually a mention. The exceptions are documented: container images expose a port outside by default, and some channels trust members of the workspace.
| Area | Default state | What to set before company data |
|---|---|---|
| Access to the Gateway | local only | remote through SSH or Tailscale, with no open port |
| An unknown sender | a pairing code | known accounts or an explicit list |
| Tool isolation | off | on for sessions that read outside content |
| Messages between conversations | allowed with the message tool | limited to the current conversation when the process needs it |
| Writing, sending, deleting | no extra approval | a person's approval |
Isolation is off by default. When you switch it on, tool execution moves into a container, and the Gateway itself stays on the server. The tools.elevated setting runs commands outside isolation, so in a company environment keep it off, and block the exec command with a tool rule when the process does not need it.
One trust boundary per Gateway
OpenClaw assumes one trusted operator, or a team whose members trust each other. It is no barrier between users who do not trust each other and share one agent. When the sales team and HR are both to use agents, they need separate Gateways and credentials, ideally on separate system accounts or servers. A session identifier routes a conversation, and it does not replace permissions.
Prompt injection and OpenClaw security
According to OWASP (2025), prompt injection is in first place on the list of risks for applications built on language models (LLM01:2025). An email, a web page or a document can contain text that tries to change the agent's instructions. The effect depends on the tools: an agent that only reads will produce a wrong summary. The same agent with access to email, a terminal and a drive can leak data or run an unwanted command.
- An agent that reads untrusted content has no tools with write rights
- Separate API tokens, each with the smallest scope needed
- A person's approval before sending, deleting and changing data
- Browser, terminal and page fetching switched off where the process does not need them
- Tests with instructions hidden in emails, files, images and web pages
What the checks cost
- Approval for every action: 600 × 1 min
- 10 h × €34.90 = €349
- Approval only for writes, 15% of actions: 90 × 1 min
- 1.5 h (€52)
- Reads and drafts without approval, with a history of actions
8.5 h (€297) fewer hours of checks a month
The number of actions, the share of writes and the approval time are the scenario's assumptions. €34.90 an hour is the EU average hourly labour cost for 2025 according to Eurostat.
Approval for everything quickly turns into reflexive clicking, so we draw the line at operations that change something outside the agent. After installation and after every change, run openclaw security audit. The audit checks the Gateway, the tools, file permissions and network exposure, and it does not test the company's process: check separately whether the agent reads data outside its scope or sends a message without approval.
- 01Installationtest data, one channel, the Gateway local only
- 02Isolationa container for tools, a working folder without the rest of the disk
- 03Toolsonly the commands needed, separate tokens with a narrow scope
- 04Approvalssending, deleting and changing data wait for a person
- 05Auditopenclaw security audit and a test with an instruction hidden in an email
Six questions before production data
| Question | Expected state |
|---|---|
| Who can write to the agent? | known accounts, pairing or an explicit list |
| Where do the tools run? | a named server or an isolated container |
| Which secrets can the process see? | separate credentials with the least rights |
| What needs approval? | sending, deleting, payments and changing data |
| What does the history record? | the source, the tool, the effect and the person's decision |
| Who responds to an incident? | a named person and a way to cut off access |
No answer to the last two questions rules out connecting production data. We build an agent with permissions, approvals and a history of actions as part of AI agents from €3,000 net, and for the free process review a description of one task and the tools the agent should reach is enough.
