OpenClaw Surpasses React as GitHub's Most-Starred Project, Then Triggers a Cascading Security Crisis
The open-source AI agent went from zero to 250,000 GitHub stars in four months, but critical vulnerabilities exposed over 135,000 instances across 82 countries.
Overview
OpenClaw, an open-source personal AI agent that runs locally on users’ hardware, has become the most-starred non-aggregator software project on GitHub, surpassing React’s decade-long reign with over 250,000 stars accumulated in roughly four months. The meteoric rise has been accompanied by an equally dramatic security reckoning: researchers have identified more than 135,000 publicly exposed instances across 82 countries, with over 15,000 directly vulnerable to remote code execution.
The project’s trajectory illustrates a tension that is becoming central to open-source development in 2026: viral adoption of powerful autonomous software can outpace the security infrastructure needed to contain it.
What We Know
From Weekend Hack to Record-Breaking Growth
Peter Steinberger, the founder of PSPDFKit, published the first version of the project in November 2025 under the name Clawdbot, describing it as a weekend hack designed to let users text an AI and have it actually perform tasks. The project was renamed to Moltbot on January 27, 2026, then to OpenClaw three days later following trademark disputes.
By January 25, the project had accumulated 20,000 stars in its first 24 hours of viral growth. It surpassed Linux on GitHub’s all-time leaderboard by February 24 and overtook React’s 243,000 stars by early March. React had held that position for years.
Steinberger subsequently joined OpenAI to work on next-generation AI agents, while OpenClaw transitioned to an independent foundation structure.
What OpenClaw Does
Unlike cloud-based AI assistants, OpenClaw runs entirely on local hardware. It connects to messaging platforms including WhatsApp, Telegram, Slack, Discord, Signal, and iMessage, operating autonomously around the clock. The agent has full access to files, email, calendars, cloud documents, OAuth tokens, shell commands, and browser control — a capability profile that makes it extraordinarily useful and, when misconfigured, extraordinarily dangerous.
A Cascading Security Crisis
The security problems began surfacing in late January. A Kaspersky audit identified 512 vulnerabilities, eight of them critical. The most severe, dubbed “ClawJacked” and disclosed by Oasis Security on February 25, was a zero-click exploit that allowed attackers to hijack an OpenClaw instance simply by getting a user to visit a malicious webpage.
The attack exploited a fundamental design decision: OpenClaw bound to 0.0.0.0:18789 (all network interfaces) rather than 127.0.0.1 (localhost only), and the gateway automatically trusted local connections. Malicious JavaScript could silently open a WebSocket connection, gain full control, and access everything the agent could reach.
The vulnerability disclosure timeline reveals the scale of the problem:
- January 29: CVE-2026-25253 (authentication token theft, CVSS 8.8) patched
- February 7: OpenClaw partners with VirusTotal; 3,016 malicious samples removed from ClawHub
- February 12: Version 2026.2.12 patches 40-plus vulnerabilities
- February 18: Six additional CVEs disclosed; Cisco demonstrates live skill exploitation
- February 25: ClawJacked flaw disclosed; patched within 24 hours in v2026.2.25
- March 1: Stable release v2026.2.26 ships with accumulated fixes
Additional CVEs included command injection (CVE-2026-24763, CVE-2026-25157), prompt injection via messaging (CVE-2026-25475), SSRF in the Gateway tool (CVE-2026-26322), missing webhook authentication (CVE-2026-26319), and path traversal in browser uploads (CVE-2026-26329).
The Plugin Marketplace Problem
OpenClaw’s plugin marketplace, ClawHub, became a major attack vector. Researchers found that out of 10,700 listed skills, more than 820 were malicious — roughly 7.7 percent of the entire marketplace. The partnership with VirusTotal resulted in the removal of thousands of malicious samples, but the episode exposed the difficulty of securing an open plugin ecosystem for autonomous agents.
Government Response
Chinese government agencies issued two official security alerts on March 8 and 10, warning of prompt injection attacks, data theft risks, and the dangers of publicly exposed instances. These represent the first major formal government warnings issued specifically about an AI agent platform.
The warnings came against a backdrop of significant Chinese adoption: Tencent, Alibaba, and Baidu offered deployment options, Xiaomi launched a device-integrated variant called “miclaw,” and Shenzhen’s Longgang district offered subsidies of up to 2 million yuan (approximately $290,000) for OpenClaw-based projects.
What We Don’t Know
Several questions remain unanswered. The actual number of compromised instances — as opposed to merely exposed ones — has not been publicly quantified. It is unclear how many of the 820-plus malicious ClawHub skills were installed before removal, or what data they exfiltrated. The independent foundation’s governance structure and funding model have not been fully detailed, raising questions about long-term security resourcing for a project of this scale.
Whether the binding-to-all-interfaces default was a deliberate design choice for ease of use or an oversight has not been addressed by the maintainers.
Analysis
OpenClaw’s trajectory compresses into four months a pattern that usually plays out over years: explosive open-source adoption, followed by a painful reckoning with the security implications of that adoption. The difference is one of kind, not just degree. Traditional open-source projects like React or Linux achieve wide deployment through integration into other systems, with layers of infrastructure mediating access. OpenClaw, by contrast, operates as an autonomous agent with direct access to a user’s most sensitive data and systems.
The 7.7 percent malware rate in ClawHub echoes problems that npm, PyPI, and other package registries have faced, but with higher stakes: a malicious OpenClaw skill does not just run code on a developer’s machine during a build step. It runs continuously, with access to messaging, email, files, and credentials.
The Chinese government’s response — issuing formal warnings while municipalities simultaneously subsidize adoption — captures the regulatory ambivalence that AI agents are likely to provoke across jurisdictions. The technology is simultaneously too useful to restrict and too powerful to leave unsecured.
For the open-source ecosystem, OpenClaw’s rise poses a structural question: whether the community-driven security model that works for libraries and frameworks can scale to autonomous agents that operate with the privileges of a human user.