ClawHosters
by Daniel Samer
3 min read
Microsoft just told enterprises what we've been saying for months. Self-hosted AI agents are a security problem if you don't isolate them properly. Their new guide on the Microsoft Security Blog covers identity management, container isolation, and runtime risk for organizations deploying OpenClaw.
The timing isn't coincidental. Barrack.ai's vulnerability analysis identified 512 total vulnerabilities across OpenClaw deployments, eight of them critical. 93.4% of publicly exposed instances had authentication bypass flaws. That's 42,665 instances across 82 countries, sitting wide open.
What Microsoft Recommends
The guide calls out what it terms "dual supply chain risk." In Microsoft's words: "Self-hosted agents execute code with durable credentials and process untrusted input. This creates dual supply chain risk, where skills and external instructions converge in the same runtime."
That's a specific threat model. Your OpenClaw agent holds your API keys, your database credentials, maybe your cloud provider tokens. And it processes input from users, from the internet, from skills you downloaded off ClawHub. Both attack surfaces meet in the same runtime.
Microsoft's recommendations boil down to five things: role-based access control, short-lived credentials instead of persistent API keys, container isolation, network segmentation, and continuous monitoring. Their strongest guidance? Don't run OpenClaw with your primary work or personal accounts. Deploy in a fully isolated environment.
Why This Matters
This isn't a random blog post. Microsoft publishing enterprise openclaw security guidance signals that companies are deploying these agents at scale and getting burned. Kaspersky's enterprise analysis adds another angle: shadow IT. Employees installing OpenClaw on personal devices and feeding it corporate credentials without IT knowing.
Gartner already classified OpenClaw as "insecure by default." Belgium's CCB and China's MIIT have issued warnings. And now Microsoft is saying: yes, you can use it, but you need proper guardrails.
What ClawHosters Does About This
Every pattern Microsoft recommends, container isolation, credential separation, network segmentation, is something ClawHosters implements by default. Instances run in isolated containers with no shared resources. Credentials never leave the instance boundary. The built-in safety scanner catches known threats before they reach your agent.
If you want to follow Microsoft's guide yourself, our security hardening walkthrough covers the same ground. Or compare the self-hosting trade-offs to see what you'd be taking on.
Microsoft thinks you need managed AI agent security. We think they're probably right.
