Self-hosted AI agents, open to the internet
Tens of thousands of OpenClaw agents were found reachable online, many unpatched. An agent with your keys needs a locked door.
OpenClaw, the open-source personal AI agent that went viral last month, connects to your email, chat apps, files and API keys and acts for you. Researchers at Censys counted more than 21,000 instances reachable from the internet by the end of January, and other scans found more. A one-click bug that could hand over full control of the agent was fixed in version 2026.1.29, but most exposed instances were running older versions.
Exposed agents have leaked API keys, OAuth tokens and saved passwords.
If you run one, or any self-hosted AI tool:
- Don’t expose its web interface to the internet. Bind it to localhost and reach it through a VPN or a tunnel with login.
- Update it. Fast-moving projects ship security fixes weekly.
- Give it separate, limited API keys you can revoke in one place.
- Don’t install community “skills” or plugins without reading them.
An agent is a remote control for your accounts. Don’t leave it on the doorstep.