ClawHosters
by Daniel Samer
4 min read
The Autoriteit Persoonsgegevens just became the first European government body to formally target OpenClaw by name. On February 12, 2026, the Dutch Data Protection Authority issued a formal warning calling OpenClaw a "Trojan Horse" and an "attractive target for abuse."
That's not a blog headline. That's an official government position.
What the Dutch DPA Actually Found
The warning identified four risk categories, and honestly, none of them are surprising if you've been paying attention:
- Malware-laced plugins. Roughly 20% of publicly available OpenClaw plugins steal credentials or crypto. One in five.
- Indirect prompt injection. Attackers can manipulate OpenClaw agents through websites, emails, and messages the agent processes.
- Remote code execution. Multiple CVEs have been documented, giving attackers full system access on unpatched instances.
- Misconfiguration. The DPA found over 42,000 OpenClaw instances publicly accessible. Of those, 93% had critical authentication bypass vulnerabilities.
The DPA recommended not deploying OpenClaw on systems with sensitive data and called for the EU AI Act to cover autonomous AI agents.
Their exact words: "Innovation and open source do not discharge the obligation to limit risks in advance."
Why This Matters for OpenClaw Users
This warning changes the regulatory conversation around AI agents in Europe. If the EU AI Act gets extended to cover tools like OpenClaw, operators could face compliance obligations similar to those for high-risk AI systems.
But the more immediate concern is practical. Those four risk categories? A properly managed deployment addresses every single one of them.
Container isolation prevents malware plugins from reaching your host system. Curated skill libraries eliminate the plugin malware problem entirely. Locked-down configurations with proper authentication close the misconfiguration gap that exposed those 42,000 instances. And keeping your instance patched and behind proper access controls handles the RCE vulnerabilities.
If you're self-hosting OpenClaw, this is worth a hard look at your setup. Our security hardening guide covers the specific steps.
What Comes Next
The Dutch DPA's position will probably influence how other EU member states approach OpenClaw regulation. Whether the EU AI Act actually gets extended to autonomous agents is still an open question, but the pressure is building.
For now, the takeaway is straightforward. Run your OpenClaw instance like someone is watching, because a government regulator just started.
