KEY OPENCLAW RISKS, CLAWDBOT, MOLTBOT

Summary from the TLDR InfoSec newsletter

OpenClaw, previously known as Clawdbot, is a viral open-source AI assistant flagged as a major insider threat due to security flaws such as CVE-2026-25253 (CVSS score 8.8), insecure defaults (e.g., disabled authentication), plaintext secret storage, and a malicious skills ecosystem targeted by infostealers such as RedLine and AMOS. Its design includes privileged host access, exposure to untrusted data, and external communication capabilities. Organizations should detect OpenClaw through specific file paths, network signatures, and unusual OAuth activity, while reducing shadow AI risks with application allowlisting, least-privilege policies, isolated deployments, and transparent usage policies with staff training.