OpenClaw proved everyone wants custom AI agent development
It also proved that nobody should be building it on their own. OpenClaw confirmed what we already knew: the demand for AI agents is real. What it also proved is that when you give an agent root access to your systems, it’s not long before they do exactly what you expect an agent with root access to do: install whatever they like, wreak whatever havoc they please, and make whoever’s watching them think it’s all on purpose. 512 vulnerabilities. 135,000 exposed instances over 82 countries. 9,000 compromised installations in a single supply-chain attack. Custom AI agent development with the right architecture on Day 1 means none of that shit for you.
OpenClaw reached 250,000 GitHub stars in 60 days. It also exposed everything it touched.
OpenClaw surpassed 250,000 GitHub stars faster than React, Linux, or any other repository in the history of the platform. It also disclosed 135,000 open internet connections, exposed plaintext API keys to 82 countries, and allowed users’ agents to take actions on their behalf they never authorised, including, as widely reported, one that made a dating profile and began swiping matches without its owner’s knowledge. If your company is thinking of putting its own AI agent out into the world, this is the story you should read first.
The demand is there. People want AI that does things, not just AI that suggests things and OpenClaw proved that in just three months. But it proved something else, too: granting an AI agent root access to your machine, Slack, email, and calendar, and then plugging it into an unvetted skill marketplace is about as safe as it sounds. We create custom AI agents at Pixelfield for companies that require it, not for demo purposes. And everything that has transpired with OpenClaw reaffirms what we always shared with clients: the technology is ready. DIY is not.
512 vulnerabilities and counting
A Kaspersky security review of OpenClaw in late January 2026 found 512 vulnerabilities, eight of them critical. This was before the ClawJacked vulnerability (CVE-2026-25253, CVSS 8.8) was found. It allows any malicious website to take over a local-based agent in just milliseconds with a single click. SecurityScorecard’s STRIKE team discovered more than 135,000 OpenClaw installations exposed on the open internet. More than 15,000 of these were immediately exploitable through remote code execution. One example is when a security researcher obtained API keys and bot tokens, Slack credentials, and months of unredacted chat history from a misconfigured instance of OpenClaw and was then able to send messages and execute commands with full admin privileges.
The supply-chain attack that followed
Last but not least: ClawHavoc. In January 2026, 341 harmful skills hit ClawHub, an OpenClaw user-created skill marketplace, affecting more than 9,000 installations. These skills were sold as trading bots or productivity software. In truth, these posts delivered the Atomic macOS Stealer (AMOS) — which steals cryptocurrency wallet information, browser passwords, macOS Keychain information, and cloud login credentials. An analysis by Bitdefender later found more than 824 malicious skills on ClawHub alone, comprising approximately 20% of all skills stored there. Even the project’s own documentation admits there’s no such thing as a “perfectly secure” installation. As Cisco’s AI security research team found when they tested third-party skills: the platform was, at a structural level, a security nightmare.
But the thing about all this is that it’s all old news. We’ve embedded agents in manufacturing plants and oil rigs and delivery trucks and warehouses all over the world. The failure modes OpenClaw encounters – overly permissive process privilege, untrusted execution, unvetted browser extension, no effective cost guardrail – these are the failure modes you anticipate on day one of a true, bespoke AI agent development initiative. OpenClaw didn’t unearth any new vulnerabilities. It just amplified existing ones to the point of visibility.
Why custom AI agent development matters more than ever
The issues of OpenClaw are not unique to OpenClaw. Any DIY agent deployment will eventually hit these problems, and they will prove to be fatal in any serious application. This is precisely why custom AI agent development, done right, remains a legitimate category.
Privilege scope
OpenClaw executes shell commands, reads/writes files, browses the web, sends emails, and maintains calendar events – all as a single Node.js process with shared memory. If one of those links is exploited – malicious link, prompt injection, misconfigured port – the attacker takes over everything. This is exactly what SecurityScorecard’s VP of threat intelligence described as “giving a random person access to your computer.”
Cost visibility
A Reddit user calculated the cost of sending one ‘hi’ message through OpenClaw, a premium model, which costed him $11. Someone else said they woke up to a $1,100 bill overnight. Zero conversation-level cost breakdown. No spending alert. Zero model-level cost analysis. You discover the cost of all of this the next morning on your OpenAI invoice. In contrast, the global agentic AI market is projected to reach more than $93 billion by 2032, up from $7.06 billion in 2025, according to MarketsandMarkets and the number of companies lighting their money on fire on uncontrolled agent deployments is about to skyrocket.
Extensibility without accountability
OpenClaw’s extensibility is also one of its most glaring vulnerabilities. Cisco found popular skills on the ClawHub that exfiltrated Discord users’ entire message history in Base64 text with no pre-verification, no sandboxing, and no oversight at all. The VirusTotal partnership, announced post-ClawHavoc, can alert you to known malware signatures, but will not catch logic-layer abuse, prompt injection payloads or data exfiltration masquerading as API calls.
Governance
When employees put OpenClaw on corporate machines and connect it to Slack, Google Workspace, and internal APIs, the security team has no idea. The researchers at Trend Micro said the result was “shadow AI with elevated privileges.” In March 2026, the Chinese government started to stop government agencies and state-run companies from using OpenClaw in the workplace.
What production-grade custom AI agent development looks like
All of the above issues can be fixed. There are fixes to them. They are not difficult. But they require deliberate architecture and that is the very point of building a custom-developed artificial intelligence agent system.
Sandboxed execution
Isolated environment. Each task is running in an isolated environment. Access to the shell is restricted to the necessary workspaces. By default, the system directories are blocked as well as sensitive dotfiles. The agent could not do something it should not do even if it wanted to. Even Microsoft’s own security guidance for OpenClaw in February 2026 suggested full isolation, the recommendation: deploy it in a dedicated VM, use non-privileged credentials, and limit access to non-sensitive data only. This is a basic requirement of any custom AI agent development project.
Model routing
Not every request needs a frontier model. Classification and memory extension run at a much lower cost on $0.25 per million tokens. Difficult inferences go to Claude or GPT-4. Smart routing alone allows you to cut inference costs by 60–80%. That’s the difference between a sustainable product and a money pit.
Observability from day one
When something fails in the middle of the night, you want an audit trail. You don’t want a bill for $125 that includes one number, because there is no documentation anywhere of what happened or how it happened. That’s where a hacked-together agent and a production-grade agent differ.
Governance controls
Role-based access control. SSO and SAML integration. Data residency rules. Comprehensive audit logs. The same security standards as any other system that handles customer data. We build all of this into our agents at Pixelfield. The architecture isn’t sexy, but it’s custom software engineering applied to a new category of tool. And that’s precisely why it’s so successful.
OpenClaw’s creator left. The lesson stays.
Peter Steinberger, an Austrian developer and the creator of OpenClaw, said on February 14, 2026 that he would be joining OpenAI. As Sam Altman described him: “Peter is a genius with a lot of amazing ideas about the future of very smart agents.” He then handed over the project to an open-source foundation whose governance model remains unknown. There isn’t any obvious business model or dedicated security team. Bloomberg reported this week that Chinese firms are rushing to deploy OpenClaw at scale. According to this story, managers are even threatening employees to begin using it immediately. Fortune has written more on the wider ramifications. The noise is just doing what noises do, but the firms actually deploying AI agents into real work ought to be asking very different questions.
Need a wildly viral open-source project with no security team, no SLA and no roadmap? You got it. Want an agent designed around your workflow, built to be boring, built to survive? No problem. You also want it for free? That, too, can be arranged. All I have is a single question for you, though. Where is your workflow breaking, killing, wasting time, making you insane? Not ten. Just the one. We’d know which one. Scoping it tightly. Building it just that way. Scaling it on data, not hype. Because when all you hear from your team is “should we just roll out OpenClaw?” is a lie. And the truth is not in OpenClaw. It is somewhere else. Somewhere you have already found.
Talk to us instead. We can tell you whether you actually need custom-made AI agent development, a less complex automation, or nothing at all. The best project is sometimes the project that you never undertake.
Frequently asked questions
Is OpenClaw safe to use for business?
No. Cisco, Kaspersky, CrowdStrike, and SecurityScorecard have all published reports detailing critical vulnerabilities across the platform. In case of a business workflow that needs to work with customer data or internal systems, you should be using a governed, sandboxed alternative. It is explicitly stated in the project’s own documentation that no “perfectly secure” setup exists.
How much does custom AI agent development cost?
Depends on scope. A sandboxed, single-workflow agent with execution and observability sandboxes typically takes 6-8 weeks and starts at €10K. DIY cost comparison: uncontrolled API bills (reports of $1,100 for one overnight), incident response on something that breaks (let’s just say it’s thousands), and continuing engineering time to shore up an ever-expanding list of new vulnerabilities. We always scope first in our design sprint before writing a line of code.
What’s the difference between OpenClaw and a custom-built AI agent?
OpenClaw is a general-purpose, open-source agent which runs with broad system access on your machine. A custom-built AI agent is purpose-built for a specific workflow, with sandboxed execution, cost-aware model routing, full observability and governance controls that aligns to your organisation’s security requirements. The architecture difference is the same as the difference between running a random script you found on GitHub and deploying a production application.
Can AI agents replace human employees?
Really depends on the scope, but we better look at it as supercharging the company with replacing the weak or overpriced links. Our production bots are doing repetitive, data-heavy tasks, document processing, ticket routing, data quality checks. Things that are easy to automate and painful for humans to do all day. They complement humans. We’re automating the bits that don’t need a human brain, so your humans can focus on the bits that do.
