OpenClaw Security Breach: 42,000 Instances Exposed

OpenClaw experienced a significant security breach with 42,000 exposed instances and 341 malicious marketplace skills. Five CVEs were identified, indicating the severity of the vulnerabilities. As a response, AgentVault was developed to act as a security proxy that wraps around Claude agents, providing real-time monitoring and management of operations.

Key features of AgentVault include:

• Blocking dangerous commands such as rm -rf and suspicious network requests before execution.
• A real-time dashboard that displays every action attempted by Claude.
• Permission approval mechanisms for risky operations.
• Comprehensive network monitoring, rate limiting, and credential scanning functionalities.
• A full audit trail to track all activities.

This solution utilizes a Node.js proxy, SQLite for logging, and a Next.js-based dashboard. Remarkably, AgentVault was built in a 3-hour session due to the urgency of the situation. Its source code has been made open-source and can be reviewed on GitHub.

The incident and rapid development of AgentVault raise questions about security measures in place for local setups utilizing AI coding agents. What security protocols are you using?