More than 21,000 publicly accessible instances of an open-source personal AI assistant called OpenClaw have been identified online, exposing potentially sensitive user configurations and personal data.
🧠 What is OpenClaw?
OpenClaw is a fast-growing personal AI assistant created by Austrian developer Peter Steinberger. Since late January 2026, the project has exploded in popularity — growing from ~1,000 to over 21,000 deployments in under a week.
Originally launched as Clawdbot, then renamed Moltbot due to trademark issues, the project ultimately settled on OpenClaw.
⚙️ Why this matters
Unlike traditional chatbots, OpenClaw can execute actions, not just respond to prompts. It integrates directly with:
📧 Email
📆 Calendars
🏠 Smart-home platforms
🍔 Food delivery services
This autonomy significantly raises the blast radius if an instance is misconfigured.
🌐 Exposure details
- OpenClaw runs locally on TCP/18789 with a browser-based UI
- Official docs recommend SSH tunneling for remote access
- Despite this, 21,639 exposed instances were identified by Censys as of Jan 31, 2026
- Most deployments appear on U.S., Chinese, and Singaporean infrastructure
- ~30% of visible instances run on Alibaba Cloud (likely visibility bias)
🔐 Even when authentication tokens are required, instance discovery and enumeration alone provide valuable reconnaissance opportunities for attackers.
⚠️ Risk assessment
Exposed instances may leak:
- Integration configurations
- Credentials and tokens
- Access paths to connected third-party services
The rapid rise of autonomous agent platforms highlights a widening gap between development speed and security maturity.
🛡️ Bottom line
Organizations experimenting with personal AI agents must treat them like production systems, not side projects — with proper access controls, network segmentation, and continuous monitoring from day one.
