OpenClaw: 7,617 Files, 250K Stars, and 8 CVEs
A Source Code Investigation of the Fastest-Growing AI Agent Framework
This investigation is based on a complete source code review of OpenClaw's GitHub repository (7,617 files, depth-1 clone of commit 2026.3.3). No code was executed. Findings were cross-referenced with 20+ external sources including CVE databases, vendor security reports, and academic research.
Risk Assessment
By the Numbers
Should You Use OpenClaw?
ClawJacked (CVSS 8.8) allowed remote WebSocket hijacking. Default configuration exposed 135,000+ instances to the open internet. The ClawHavoc campaign planted 824+ malicious skills in ClawHub, with 36% containing prompt injection vectors.
Peter Steinberger joined OpenAI in February 2026, barely three months after launch. Open source projects can survive founder departure, but the timing—mid-security crisis—is concerning.
22+ messaging channel integrations means 22+ attack vectors. The skill marketplace (ClawHub) is a supply chain attack surface. Every integration point is a potential vulnerability.
Timeline
Bottom Line
Impressive engineering. Unacceptable risk for enterprise use.
OpenClaw proves massive demand for personal AI agents. But the gap between “technically possible” and “enterprise ready” remains wide. Watch the project. Don't deploy it in production. Yet.