China's CNCERT/CC warns of security risks from the popular OpenClaw software, highlighting vulnerabilities that could lead to serious data breaches.
As OpenClaw gains traction in China, the National Computer Incident Response Center (CNCERT/CC) has raised alarms about significant security vulnerabilities associated with the software. The agency highlighted that the default security settings of OpenClaw are alarmingly weak, which could allow attackers to easily seize control of user systems.
CNCERT/CC's warning detailed several critical risks:
- Prompt injections, where hackers can embed harmful commands on web pages, potentially compromising user system keys;
- Erroneous actions stemming from misinterpretation of commands, risking the deletion of essential data;
- Infection risks through third-party plugins that may introduce malware and backdoors;
- Existing vulnerabilities, some classified as medium to high severity, which could lead to major data breaches.
The agency cautioned that individual users might experience theft of personal data, payment accounts, or API keys, while sectors like finance and energy could face even graver consequences.
Security Guidelines
To mitigate these risks, CNCERT/CC advised both organizations and end-users to take several precautionary measures:
- Enhance network security by restricting management ports from internet access and ensuring robust authentication;
- Improve management of credentials by avoiding plaintext storage and maintaining detailed logs;
- Exercise strict control over plugins, disabling automatic updates and only using trusted extensions;
- Stay updated with the latest security patches.
Growing Interest in OpenClaw
The excitement surrounding OpenClaw is palpable, with citizens queuing for assistance with installations and local IT firms racing to offer related services. Educational events promoting the software have seen overwhelming turnout, with limits imposed due to space issues, according to journalist Afra Wang.
In response to this trend, major companies like Alibaba and Baidu have launched products aimed at simplifying AI agent configuration for users without programming knowledge. Alibaba's JVS Claw app, for instance, allows easy installation of OpenClaw on mobile devices.
This surge in interest has reportedly boosted the market capitalization of related Chinese firms by over $100 billion since early March, reflecting widespread engagement across various demographics.
Local governments are backing this technological shift financially, with significant subsidies available for developers and businesses. In Shenzhen's Longgang district, companies can receive up to 2 million yuan ($300,000) for developing AI capabilities, along with various discounts and investment opportunities.
Public Sector Restrictions
In light of the warnings from CNCERT/CC, Chinese authorities have imposed restrictions on the use of OpenClaw within state-owned companies and institutions. Government agencies have been directed not to install the software on work devices, a measure also extending to military personnel's families. This caution follows incidents like February's deletion of a Meta researcher’s email by OpenClaw despite specific instructions to refrain from such actions.
