> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coral.inc/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> Understand the OpenClaw exposure crisis and what you can do about it

In early 2026, a security researcher discovered over 42,000 publicly exposed OpenClaw instances via a passive internet scan. By March 2026, that number had grown to **258,305** — tracked in real time on a [public watchboard](https://openclaw.allegro.earth/). Of the instances that were actively verified, [93.4% had critical authentication bypass vulnerabilities](https://maordayanofficial.medium.com/the-sovereign-ai-security-crisis-42-000-exposed-openclaw-instances-and-the-collapse-of-1e3f2687b951).

This section covers what to do if you're running a self-hosted OpenClaw instance.

<Warning>
  If your server's IP appears on the [OpenClaw Exposure Watchboard](https://openclaw.allegro.earth/), your instance is publicly reachable from the internet right now. Treat it as potentially compromised and follow the steps in this section immediately.
</Warning>

## What happened

OpenClaw was designed as a local-first personal assistant. When users deployed it to cloud VPS providers for always-on availability, the gateway port (18789) became internet-accessible — often without a firewall or authentication configured. Security researchers later found that [ClawHub, the skill marketplace, contained 1,184 malicious skills](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting), and a WebSocket vulnerability ([CVE-2026-25253, "ClawJacked"](https://thehackernews.com/2026/02/clawjacked-flaw-lets-malicious-sites.html), CVSS 8.8) allowed malicious websites to hijack local instances without user interaction.

For a detailed timeline and analysis, see the Coral blog: [The OpenClaw Security Crisis of 2026](https://coral.inc/blog/2026-03-07-openclaw-security-crisis-2026).

## Choose your path

<CardGroup cols={3}>
  <Card title="Harden Your Instance" icon="shield-check" href="/security/hardening-self-hosted">
    Keep your self-hosted OpenClaw instance and secure it with step-by-step hardening instructions.
  </Card>

  <Card title="Terminate Your Instance" icon="power-off" href="/security/terminate-instance">
    Shut down your exposed instance entirely. Step-by-step instructions for every major cloud provider.
  </Card>

  <Card title="How Coral Protects You" icon="lock" href="/security/architecture">
    See Coral's security architecture: dedicated VMs, authenticated proxy layer, and server-side credential isolation.
  </Card>
</CardGroup>