Welcome to AgentSec — Issue #1: Your OpenClaw Is Probably Leaking API Keys Right Now

Welcome to AgentSec!

Here is your first issue:

# Issue #1: Your OpenClaw Is Probably Leaking API Keys Right Now

**Subject line options:**
- "Your OpenClaw is leaking. Here's how to check."
- "I audited 50 OpenClaw setups. Most were wide open."
- "The #1 security mistake every OpenClaw user makes"

---

Hey —

I'm Charles, an IT security consultant who runs penetration tests for a living. I also run OpenClaw daily. And after helping dozens of people set up their agents, I can tell you this:

**Most OpenClaw installations are leaking sensitive data.**

Not hypothetically. Right now. Let me show you.

## The 3 Most Common Leaks

### 1. API Keys in TOOLS.md / AGENTS.md

Your workspace files (TOOLS.md, AGENTS.md, MEMORY.md) are where your agent stores everything — including API keys, passwords, and credentials. If your gateway is exposed to the internet without proper auth, anyone who connects can read these files.

**Check now:**
- Open your `openclaw.json`
- Is `gateway.auth.mode` set to `"token"`? If not, your gateway is open.
- Is `gateway.bind` set to `127.0.0.1`? If it's `0.0.0.0`, you're exposed to your entire network.

**Fix:**
```json
"gateway": {
"auth": { "mode": "token", "token": "<random-64-char-string>" },
"bind": "127.0.0.1"
}
```

### 2. Discord/Telegram DM Policy Set to "open"

If your channel config has `"dmPolicy": "open"`, **anyone** who shares a Discord server with your bot can DM it and interact with your agent. That means access to your tools, your files, your exec commands.

**Fix:** Use `"allowlist"` with your specific user ID:
```json
"discord": {
"dmPolicy": "allowlist",
"dm": { "allowFrom": ["YOUR_DISCORD_USER_ID"] }
}
```

### 3. Exec Tool Running Without Sandbox

By default, OpenClaw's exec tool can run any shell command on your machine. If someone gets access to your agent (through an open gateway or DM policy), they can run `rm -rf /`, read your SSH keys, or install malware.

**Fix:** Set `tools.exec.security` to `"allowlist"` and define exactly which commands your agent can run. Or use `sandbox.mode: "all"` to isolate everything.

## The 60-Second Security Audit

Run this right now:

```bash
openclaw security audit --deep
```

This will tell you exactly what's exposed. If you see any `CRITICAL` or `WARN` items — fix them before your next coffee.

## Why This Matters

OpenClaw agents have access to your email, calendar, files, browser, shell, and messaging accounts. A misconfigured agent isn't just a tech problem — it's a **personal security breach waiting to happen.**

I'm starting this newsletter because nobody's talking about this. The OpenClaw docs cover features. The Discord covers troubleshooting. But nobody covers **operational security for AI agents.**

Every week, I'll send you:
- One hardening tip you can apply in 5 minutes
- Config snippets you can copy-paste
- Vulnerability alerts when new versions drop
- Honest skill reviews (is this community skill safe to install?)

If you're running an AI agent with access to your life, you should know how to lock it down.

— Charles Skalet
IT Security Consultant | OpenClaw Daily Driver

---

*Next issue: "The 5-Minute OpenClaw Hardening Checklist" — a printable, step-by-step guide to securing your setup.*