How to Set Up OpenClaw Safely: A Real Beginner’s Guide (Not the Naive Version)

OpenClaw is a self-hosted AI agent: you give it API keys, connect it to messaging apps like Telegram or WhatsApp or Slack, and it acts as an always-on assistant across those channels. It’s genuinely capable, and it’s also had a rough security record — a patched one-click remote code execution flaw (CVE-2026-25253), over 21,000 instances found sitting exposed on the public internet with no authentication, and independent audits turning up hundreds of malicious add-ons in its skill marketplace. None of that means don’t use it. It means set it up differently than a typical weekend-project tutorial would tell you to.

This guide walks through installing OpenClaw with isolation, account separation, and update discipline built into the process from step one — not bolted on afterward. If you’ve already read a “get OpenClaw running in 10 minutes” post, this one adds the parts that post left out.

If you want the deeper background on what OpenClaw is and why the risk profile looks the way it does, DropGB has a companion piece at /what-is-openclaw-ai-agent/. This article assumes you’ve decided to go ahead and just want to do it properly.

Why the standard install instructions undersell the risk

Most quick-start guides reduce OpenClaw setup to one Docker command and a wizard, following the same basic steps in the official Docker installation docs. Functionally, that’s accurate — it really is that fast. The problem is what that default configuration leaves exposed. By default, OpenClaw’s gateway binds to 0.0.0.0, meaning it listens on every network interface on the machine, including whatever public IP that machine has, not just localhost. Security researchers scanning the public internet found more than 21,000 instances running this way: reachable from anywhere, no login required.

Separately, a vulnerability tracked as CVE-2026-25253 (CVSS 8.8) let an attacker exfiltrate a running instance’s auth token through a single malicious link, because the gateway accepted new WebSocket connections without confirming where they came from. It was patched in version 2026.1.29, released January 30, 2026. If you’re installing today, you’re on a fixed version by default — but only if you actually update, and only if you keep updating.

Then there’s ClawHub, OpenClaw’s marketplace for third-party “skills” (plugins). A security audit by Koi Security reviewed all 2,857 skills listed and found 341 were malicious, 335 of them tied to a single campaign — nicknamed ClawHavoc — that used fake dependency instructions to trick people into installing the Atomic Stealer (AMOS) malware on macOS. That’s roughly 12% of the entire marketplace. ClawHub has since added scanning via VirusTotal and a tool called ClawScan, but researchers have continued finding evasive malicious skills slipping past those checks months later.

None of this is a reason to avoid OpenClaw. It’s a reason to treat the setup steps below as the actual tutorial, not optional extras.

Before you install anything: decide on isolation

Do this first, not after something goes wrong. OpenClaw should run somewhere that isn’t your everyday laptop or your primary home server.

1. Pick a VM or a dedicated container host. A cheap cloud VM (a $5–6/month droplet-class instance works fine for testing) or a spare machine on your network both work. The goal is that if the agent or a bad skill misbehaves, it can’t reach your personal files, browser sessions, or SSH keys, because they were never on that machine to begin with.
2. If you’re running it locally, containerize it properly — don’t just run the binary directly on your host OS. Docker with volume mounts scoped only to OpenClaw’s own state directory is the baseline, not an upgrade.
3. Give it its own network segment if you can. A VLAN, a firewall rule, or even just running it on a VM with no access to your home network’s other devices all reduce blast radius if something goes wrong.
4. Never expose it to the public internet directly. No port-forwarding 18789 on your router. If you need remote access, put a VPN (Tailscale and WireGuard are common, low-effort choices) or an authenticated reverse proxy in front of it — never the raw gateway port.

Step-by-step: install with security decisions baked in

1. Provision the isolated host first. Spin up your VM or confirm your container host is separate from anything holding sensitive data. Confirm it has Docker 24+ with Compose v2, per OpenClaw’s documented requirements.
2. Create a burner identity for every connected account. Before you install anything, set up a new email address, a new Telegram or Discord account, whatever channel you’re planning to connect. Do not connect OpenClaw to your primary email, your main WhatsApp number, or any account tied to your real identity. If the agent gets compromised or a skill misbehaves, you want the blast radius contained to an account you can abandon without consequence.
3. Pull the image and run it bound to localhost only — for example, mapping the port as 127.0.0.1:18789:18789 rather than exposing it on all interfaces, then reaching it only through SSH tunnel or VPN. This single change is the difference between being one of the 21,000 exposed instances and not being one.
4. Run the setup wizard, but stop at API keys. Connect one model provider (Anthropic, OpenAI, Google, or OpenRouter) using a fresh, scoped API key — not a key that also powers other production systems you rely on. Set a spending cap with your provider if one is available.
5. Connect exactly one burner messaging channel to start, not all of them. Verify it works end to end before adding more surface area.
6. Install zero third-party skills at this stage. Get comfortable with OpenClaw’s built-in functionality first. Every skill you add from ClawHub is a new piece of code with broad local system access that you didn’t write and can’t fully audit — and given that roughly 1 in 8 skills reviewed in the Koi Security audit was malicious, “zero skills” is a genuinely reasonable place to stay for a while, not just a beginner’s stepping stone.
7. Set update notifications on and check for new releases weekly. The CVE-2026-25253 patch only protects you if you’re running it. Subscribe to the project’s release notes or changelog rather than assuming you’ll hear about the next one.
8. Only after all of the above, evaluate specific skills one at a time — check the publisher’s history, read the actual skill code if you can, and watch for the fake-prerequisite pattern the ClawHavoc campaign used (instructions telling you to install some unrelated “required” tool before the skill will work).

What to check before installing any ClawHub skill

Keeping it running safely, not just installing it safely

Setup is the beginning, not the finish line. A few ongoing habits matter as much as the install steps: update promptly whenever a new release ships, since the whole point of the CVE-2026-25253 patch is that it only helps people who applied it; rotate your API keys and messaging tokens periodically, and immediately if you ever suspect anything odd; keep monitoring outbound connections from the host if you’re comfortable doing so, since unexpected outbound traffic is often the first sign a skill is doing something it shouldn’t; and resist the urge to reconnect your main accounts later “just for convenience” — the burner-account principle only works if you stick with it. If you’re also weighing how OpenClaw fits alongside other agent frameworks and protocols, DropGB’s explainer on MCP vs. A2A covers how these pieces connect.

FAQ

Is OpenClaw actually installed correctly if I skip all the isolation steps?

It’ll run, and for a lot of people it does, which is exactly how 21,000+ instances ended up exposed on the open internet with no authentication. “Works” and “set up safely” are different bars, and this guide is aimed at the second one.

Do I really need a burner email and messaging account?

Given that a one-click RCE vulnerability existed in the wild and that roughly 12% of marketplace skills were found malicious in one audit, yes. The burner account is what limits the damage if either of those categories of problem happens to you, rather than depending on nothing ever going wrong.

Is it safe to use ClawHub skills at all?

Not never, but not by default either. Start with zero skills, get comfortable with the base agent, and vet each addition individually using the risk signals above. Treat the marketplace’s own scanning (VirusTotal integration, ClawScan) as a helpful filter, not a guarantee, since evasive malicious skills have continued surfacing after those tools launched.

What if I already installed OpenClaw the naive way?

Check your version against 2026.1.29 or later first, and update immediately if you’re behind. Then rotate any API keys and tokens that were active while unpatched, move the gateway off 0.0.0.0 to localhost-only, and review whatever skills you’ve already installed against the risk signals above before continuing.

How is this different from just reading OpenClaw’s own docs?

The official docs cover configuration options; they don’t necessarily foreground the isolation and account-separation choices as load-bearing steps. This guide treats them as unskippable rather than optional hardening you can do “later.”

Bottom line

OpenClaw is a capable self-hosted agent, and it’s also had a genuinely bad run of security disclosures in a short window — a critical RCE, tens of thousands of exposed instances, and a marketplace where roughly 1 in 8 audited skills turned out malicious. None of that has to stop you from running it. Do it inside an isolated VM or container, on burner accounts, off the public internet, with zero third-party skills until you’ve built trust in the base setup, and keep it updated. That’s not the cautious version of the tutorial — treat it as the only version worth following.