ClawHosters
by Daniel Samer
3 min read
Bitdefender's latest advisory doesn't sugarcoat it. Their "Technical Advisory: OpenClaw Exploitation in Enterprise Networks" paints a picture of corporate networks riddled with unauthorized AI agents that nobody in IT approved.
The advisory is built on real GravityZone endpoint telemetry, not theory. And the findings are rough.
What GravityZone Telemetry Found
Bitdefender documented OpenClaw deployments showing up on corporate endpoints across their customer base. Employees, it turns out, can spin up hundreds of AI agents with a single command line entry. Easy, single-line commands that deploy directly onto company machines.
That's the shadow AI problem in a nutshell. Your developers and power users don't wait for IT approval. They just install it.
Here's what Bitdefender's own analysis uncovered on ClawHub: over 800 malicious skills. And 14 legitimate GitHub accounts were compromised specifically to publish those skills. So even people who think they're installing something trustworthy might not be.
The Broader Picture
Bitdefender isn't the only one sounding alarms. Token Security reported that 22% of enterprises have unauthorized OpenClaw deployments running right now. Noma Security found something even wilder: 53% of their enterprise customers gave OpenClaw privileged access over a single weekend.
One weekend. Privileged access. No security review.
On top of that, roughly 135,000 internet-facing OpenClaw instances have been detected. That's a lot of attack surface.
Bitdefender's Recommendation
The primary recommendation from the advisory is pretty direct: "Do not run OpenClaw on a company device."
That's about as clear as enterprise security guidance gets. But for organizations that need AI agents in their workflow, the question becomes how you run them safely, not whether you run them at all.
What You Can Do
The risk is real, but it's manageable with the right setup. Our security hardening guide walks through the specifics. The short version: container isolation, curated skill libraries, and locked-down authentication solve most of what Bitdefender flagged.
If you're weighing your options, the managed vs self-hosted comparison breaks down what you're responsible for in each scenario. Managed hosting plans handle patching, skill vetting, and network isolation by default.
Running OpenClaw on bare corporate hardware with no controls? That's the actual liability. Running it in a properly isolated, managed environment is a different conversation entirely.
