How to Harden OpenClaw in 45 Minutes and Prove It

Hello builders,

An OpenClaw agent that reads your email and holds your calendar is worth running, and you can lock it down in about 45 minutes and prove it with one command that prints 0 critical. The reason to bother is a bug Oasis Security found: before release 2026.2.25, any web page you opened could reach the OpenClaw gateway on your own laptop and guess its password at hundreds of attempts per second. OpenClaw security hardening comes down to ten settings we type once, and openclaw security audit grades all of them in one line.

So why doesn’t your home router stop that attack? The attacker never touches your network. Here’s how Oasis Security explained it:

here’s the key issue with WebSockets: any website you visit can open one to your localhost. Unlike regular HTTP requests, the browser doesn’t block these cross-origin connections.

Oasis called it ClawJacked. The OpenClaw team rated it High, NVD scores CVE-2026-32025 at 7.5, and the first control is the boring one: update, because 2026.2.25 closed it. The number worth noticing is the size of the list it came from. The project’s security advisories page shows 722 published advisories, and filtering by severity leaves 14 rated critical. I am not going to tell you we can close every one of those, and I would be suspicious of anyone who does. What we can do is make sure the next one reaches as little as possible.

Ten controls, four ways in

Read the picture one row at a time, because each row is a different way in. A malicious skill is stopped by isolation, shell off, scoped keys, skill vetting and logging. Prompt injection, meaning instructions hidden in a page or a message the agent reads, is stopped by isolation, shell off, locked web access and isolated sessions. The orange row is ClawJacked, a direct attack on the gateway, and its three dots sit under isolation, isolated sessions and an authenticated gateway. Credential sprawl, which is every key you’ve handed the agent, gets scoped keys and logging. Watching spend and backing up the config carry no dots at all, and they stay on our list because they are what saves us after something gets through.

The 45-minute pass

Run this top to bottom on the machine the agent lives on. The numbers in the comments match the columns in the picture.

openclaw security audit                                        # baseline: write the counts down
openclaw config set agents.defaults.sandbox.mode all           # 1 isolate (needs Docker)
openclaw config set commands.bash false                        # 2 shell off
openclaw config set tools.fs.workspaceOnly true                #   files stay in the workspace
openclaw config set browser.enabled false                      # 5 skip this if the agent must browse
openclaw config set session.dmScope per-account-channel-peer   # 6 isolate sessions
openclaw config set tools.loopDetection.enabled true           # 7 the runaway guard
openclaw config set gateway.auth.mode token                    # 8 authenticate the gateway
openclaw doctor --generate-gateway-token
openclaw config set plugins.allow '["<ids you trust>"]' --strict-json   # ids: openclaw plugins list
openclaw backup create --verify                                # 10 back up config
openclaw config validate
openclaw gateway restart
openclaw security audit                                        # target: 0 critical

What about the three we can’t do from a terminal? Scoped keys means one API key per agent, so one leak is not all of them. For spend, we set a hard monthly cap on the provider’s dashboard, since OpenClaw has no spend limit of its own and the loop guard only catches an agent that is stuck repeating itself. Vetting skills means reading the source before you install, because researchers have already shown ClawHub’s scanning can be slipped past.

Every config set tells us whether it needs a restart, and this is where your release matters. Which one are you on? On 2026.9.6, gateway.auth.mode and browser.enabled answer “Restart the gateway to apply.” while commands.bash answers “No gateway restart needed.” On extended-stable 2026.7.35, commands.bash asks for a restart as well. The book’s logging line, openclaw config set logging.redactSensitive tools, works on 2026.7.35 and fails on 2026.9 with Unrecognized key: "redactSensitive", because redaction is always on there. The block leaves it out so it runs clean on either.

Did it hold? I ran the whole block on a fresh test config under both releases. The baseline read Summary: 2 critical · 2 warn · 1 info and the last line read Summary: 0 critical · 1 warn · 1 info. The warning left was gateway.trusted_proxies_missing, which only matters if you put a proxy in front of the gateway. On 2026.9.6 the token command also prints a note about --fix, and the token was written anyway, which is exactly why we end on the audit and not on a message. Aim for zero critical, and read every warning before you decide to keep it.

This is also the part I’d show a client. Run openclaw security audit in front of them, point at the zero, and then tell them the honest bit: the advisory list is long, you watch it (Watch, then Custom, then Security alerts on the repo), and you’ll call when something needs a patch. In my experience that sentence closes more work than any promise of a sealed box, and it has the advantage of being true.

Now go build something this weekend!

John Cook