OpenClaw Setup, Hardening & Deployment
There are two ways to run OpenClaw. The first is to clone the repo, run the installer, and hope nothing goes wrong. The second is to do it right: patched runtime, locked gateway, vetted plugins, and documentation you can hand to your next IT contractor without embarrassment.
We handle the second option. If the security headlines haven't reached you yet, keep reading.
Why OpenClaw is the most exciting, and most dangerous, AI agent right now#
302,000 GitHub stars in 60 days#
OpenClaw crossed 302,000 GitHub stars in roughly 60 days, passing React as the most-starred project on GitHub (Decision Crafters / OpenClaw Blog, March 2026). That growth means millions of installs are happening right now. Most of them without anyone checking what needs to be locked down before the thing goes live.
What OpenClaw actually does (and why that makes it a target)#
OpenClaw is an agentic AI runtime. It connects to your file system, your calendar, your email, your databases. It runs tools and executes code. You can extend it through a plugin marketplace called ClawHub, adding new capabilities in minutes.
That's exactly what makes it dangerous to misconfigure. A compromised OpenClaw instance isn't just an annoyance. It's access to everything the agent can reach.
The security crisis nobody mentioned in the demos#
The viral clips showed agents booking travel, writing reports, managing inboxes. No one in those demos mentioned CVE-2026-25253, or the 135,000 exposed instances logged by security researchers, or the supply-chain operation that put malicious skills in the official marketplace. Those stories came out weeks later in the security press, where most people excited about OpenClaw weren't looking.
The gap between "I saw it work on YouTube" and "I have a secure, working deployment" is real and worth understanding before you install anything.
The three threats most DIY installs leave open#
CVE-2026-25253: one-click RCE on unpatched instances#
CVE-2026-25253 was disclosed February 1, 2026. CVSS 8.8. It's a token exfiltration vulnerability that enables remote code execution through cross-site WebSocket hijacking, and it affects every version of OpenClaw before v2026.1.29.
If your instance is reachable from the internet and you haven't patched, an attacker can take full control without your credentials. SecurityScorecard identified more than 50,000 actively exploitable instances, with 53,000+ correlated with prior breach activity (SecurityScorecard, February 2026).
Patching is not optional. It also isn't the only step: the fix closes one vector, not the full attack surface.
135,000 exposed gateways with no authentication#
OpenClaw's default install exposes a local gateway on a standard port, with no authentication required to reach it. When people follow tutorials showing how to access OpenClaw from a phone or second machine, they often forward that port to the internet.
SecurityScorecard found 135,000+ publicly exposed OpenClaw instances across 82 countries (The Signal Cage / SecurityScorecard, February 2026). Open gateways, no rate limiting, no firewall rules. Any connection accepted from anywhere.
Fixing this means requiring authentication at the gateway before any external access is configured, setting origin validation to reject unapproved sources, and isolating the OpenClaw process from the rest of the host. We do all of this before handoff.
ClawHavoc: 1,184 malicious skills in the official marketplace#
ClawHub is the official OpenClaw plugin marketplace. By March 1, 2026, security researchers had confirmed 1,184 malicious skills in the registry. Koi Security traced 341 of them to a single coordinated campaign they named ClawHavoc (eSecurity Planet / PointGuard AI, March 2026).
The malicious skills had descriptions, version numbers, install counts. Several used names nearly identical to legitimate popular skills. Once installed, they exfiltrated data and established persistence on the host.
ClawHub doesn't protect you by default. Knowing which plugins are safe requires checking permission scope, network behavior, execution paths, and publisher history. That's one of the steps we do before you get a working system.
What a hardened deployment actually involves#
Most setup services run the official installer and hand you the keys. A hardened deployment is different in scope. Here's what it covers.
Hardware: local inference vs. API-orchestrated#
OpenClaw can run with a local model (all inference on your hardware) or API-orchestrated (your instance calls a hosted provider). The hardware requirements are genuinely different.
For local inference, VRAM is the binding constraint. Most usable local models need at least 8 GB, with 16-24 GB for models that handle real tasks reliably. For API-orchestrated setups, a modern CPU with adequate RAM is enough. Before installing anything, we look at what you have and what you want, and give you an honest answer about which path works for your setup.
Clean install on a patched runtime (2026.2.26+)#
We install from a verified source on runtime version 2026.2.26 or later, which includes all security patches through the CVE-2026-25253 disclosure. We don't use one-click installers that may bundle outdated runtimes. The environment is clean before OpenClaw touches it.
Gateway auth, origin validation, and network segmentation#
Authentication goes on the gateway before any external access is configured. Origin validation rejects requests from unapproved sources. If you need access from outside the local network, we set that up with token-based auth rather than an open port.
Network segmentation limits what the OpenClaw process can reach on your host. If the agent is compromised, it shouldn't also mean your host system is.
Plugin vetting and ClawHub trust policy#
We check every plugin against the ClawHavoc attack patterns: permission scope, network behavior, execution paths, publisher history. We also configure a ClawHub trust policy that blocks unapproved installs after handoff, so a malicious skill can't slip in six weeks later when you're not thinking about it.
MCP integrations#
We set up MCP integrations for the tools that matter to your workflow: Google Workspace, Notion, GitHub, Slack, or your own internal APIs. Each integration is scoped with minimum necessary permissions.
Handoff documentation and patch support#
When we're done, you get written documentation covering your exact setup: runtime version, gateway configuration, installed plugins with their approved permission scopes, and maintenance instructions. We include a support window for questions after handoff, and optional ongoing patch monitoring if you want to be notified when new security releases require action.
Personal vs. business deployments#
We offer two structured service tiers. If you're not sure which fits, the intake form will help sort it out.
Personal: single-user home setup ($399-$999)#
For individuals who want a capable, secure OpenClaw instance for personal use: tasks, research, writing, home automation.
Includes:
- Hardware assessment and model selection recommendation
- Clean install on a patched runtime
- Gateway authentication and basic network hardening
- Plugin vetting for up to five skills
- Up to three MCP integrations (e.g., Google Drive, Notion, GitHub)
- Written handoff documentation
- 14-day support window via email
Typical turnaround: 2-3 business days
View full scope on the personal setup page.
Business: multi-user, compliance-aware, integrated ($2,500-$6,000+)#
For small businesses and teams running OpenClaw in a shared environment, integrated with business systems, and configured to meet basic data handling requirements.
Includes everything in Personal, plus:
- Multi-user access control with role-based permissions
- Plugin vetting for full initial stack (no cap)
- Integration with business tools: CRM, ticketing, internal databases, Slack, or custom APIs
- Network segmentation design for production environments
- Compliance-aware configuration (data residency, access logging)
- Team onboarding session
- 60-day support window with priority response
- Quarterly patch check-in (first quarter included)
Typical turnaround: 3-5 business days
View full scope on the business setup page.
How the process works#
Step 1: hardware and goal assessment#
You fill out a short intake form: what hardware you have, what you want OpenClaw to do, which tools you need connected, whether you've already tried an install. We review your answers and send back a recommendation covering which tier fits, any hardware considerations, and a timeline. No sales call required unless you want one.
Step 2: remote or on-site installation#
Most deployments are done remotely via screenshare, where you control what we can see. We walk through the installation together, or you can grant temporary access for the technical steps. For business deployments in the Seattle metro area, on-site is available at no added cost.
Step 3: hardening, testing, and plugin review#
After the base install, we work through the hardening checklist: runtime version, gateway auth, origin validation, network segmentation, plugin review. We test the gateway from an external connection to confirm it's behaving correctly. We check each approved plugin against its documented permissions. You don't get a handoff until it passes.
Step 4: handoff, documentation, and support window#
You get the documentation package for your exact setup. We walk through it on a short call. Your support window starts at handoff: questions and unexpected issues get a response within one business day.
FAQ#
How much does it cost to have someone set up OpenClaw?
Personal installs start at $399. Business deployments with compliance requirements and deep integrations run up to $6,000+. The intake form gives us enough information to quote accurately before any work starts.
Is OpenClaw safe to run without hardening?
Not if it's reachable from outside your local network. CVE-2026-25253 (CVSS 8.8) enables one-click remote code execution on unpatched instances, and the default gateway requires no authentication. SecurityScorecard found over 135,000 exposed instances in early 2026. Running on an isolated local machine with no port forwarding is lower risk, but plugin vetting still matters given the ClawHavoc supply-chain attack.
What hardware do I need to run OpenClaw locally?
For a local inference setup, you'll want a GPU with at least 8 GB of VRAM for basic models, and 16-24 GB for models that handle complex tasks reliably. For an API-orchestrated setup, a modern CPU with 16 GB of RAM is typically enough. We assess your hardware in Step 1 and give you a specific recommendation.
What is CVE-2026-25253?
A token exfiltration vulnerability rated CVSS 8.8, disclosed February 1, 2026. It enables remote code execution via cross-site WebSocket hijacking and affects all OpenClaw versions before v2026.1.29. If you installed before late January 2026 and haven't updated, your install is likely vulnerable. We verify runtime version and patch status on every deployment.
Can someone set up OpenClaw for me remotely?
Yes. Personal setups typically take 1-2 hours over screenshare. Business deployments are split across two sessions. You stay in control of your machine throughout: we guide the process, we don't take unsupervised access.
Do you handle ongoing maintenance after setup?
The personal tier includes a 14-day support window. The business tier includes 60 days plus a first-quarter patch check-in. Ongoing patch monitoring is available as an add-on for either tier: you get a notification when a new security release requires action, with instructions or a quote for handling it.
What if I've already installed OpenClaw and just want it hardened?
We can work from an existing install. The intake form has a field for this. Depending on what's already in place, we'll tell you whether hardening on top makes sense or whether a clean reinstall is faster. Either way, the hardening scope is the same.
Get a quote#
Tell us your hardware, your goals, and whether you've already started. We'll send back a firm quote within one business day.
For context on how OpenClaw fits into a broader self hosted AI setup, see our self hosted AI infrastructure services. If you want the technical background on the CVEs and attack patterns before committing, the OpenClaw security hardening guide covers them in detail.
