Personal AI Agents like OpenClaw Are a Security Nightmare

This blog is written in collaboration by Amy Chang, Vineeth Sai Narajala, and Idan Habler

Over the past few weeks, Clawdbot (then renamed Moltbot, later renamed OpenClaw) has achieved virality as an open source, self-hosted personal AI assistant agent that runs locally and executes actions on the user’s behalf. The bot’s explosive rise is driven by several factors; most notably, the assistant can complete useful daily tasks like booking flights or making dinner reservations by interfacing with users through popular messaging applications including WhatsApp and iMessage.

OpenClaw also stores persistent memory, meaning it retains long-term context, preferences, and history across user sessions rather than forgetting when the session ends. Beyond chat functionalities, the tool can also automate tasks, run scripts, control browsers, manage calendars and email, and run scheduled automations. The broader community can add “skills” to the molthub registry which augment the…