Over 220,000 OpenClaw Instances Now Exposed to Internet — Up From 135K in February

Penligent research finds over 220,000 OpenClaw instances exposed to the internet as of May 2026, up from 135K in Bitdefender February audit. Many originate from corporate IP space. Default bind to 0.0.0.0:18789 remains root cause.

Product Idea from this Signal

A background service that continuously scans your OpenClaw instance for misconfigurations, unpatched CVEs, and exposure to the public internet, then auto-remediates or alerts

900 ▲

220,000+ OpenClaw instances are exposed to the internet because the default config binds to 0.0.0.0:18789 on all interfaces. Many are on corporate IP space, not hobby servers. Meanwhile, OpenClaw ships 2.6 new CVEs per day and critical vulns like CVE-2026-43534 (CVSS 9.1) go unpatched for weeks on most deployments. This service runs alongside your OpenClaw instance, checks binding config, open ports, installed version against the CVE database, plugin integrity against the ClawHavoc malware list, and either auto-fixes safe remediations (rebind to localhost, block known-bad skills) or sends alerts for manual intervention.

SECURITYBACKGROUND-SERVICEOPEN-SOURCEDEVTOOLOPENCLAW

CompetitiveView Opportunity →