PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why Trying to Secure OpenClaw is Ridiculous

aikido.dev | blog | #ai-security | #agentic-ai | #ai-agents | #risk-analysis | #permissions | #openclaw
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OpenClaw hands an AI your full permissions—files, email, calendar, internet—by design. Aikido argues fully securing it is a lost cause: remove the claws and you've rebuilt ChatGPT with extra steps.
Published
Collected

Related coverage

blog · jfrog.com
Giving OpenClaw The Keys to Your Kingdom? Read This First
JFrog security researchers review OpenClaw, the viral personal AI assistant: granting it filesystem, bash and API-key access hands over 'the keys to your kingdom' while its security model evolves.
tool · github.com
SpecterOps Skills: Open-Source LLM Agent Skills & MCP Plugin Marketplace for Red Teaming and AppSec
As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.
research · certik.com
Skill Scanning Is Not a Security Boundary
This article argues that scanning third-party OpenClaw skills (e.g. Clawhub's VirusTotal and AI review pipeline) is not a security boundary, since skills execute with full privileged-runtime access.
blog · aikido.dev
AI agent security in Kubernetes: Why prompt injection isn't the right term
This post is based on Mackenzie's conversation with Abdel Sghiouar on The Secure Disclosure podcast. Listen to the full episode or watch below.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
Back