Tools: Latest What Openclaw Teaches Us About Personal AI Security 2026

OpenClaw and gharasathi are both local-first AI assistants. Both run on your own hardware. Both handle personal data. In February 2026, OpenClaw had a very bad month — and the lessons aren't what you might expect.

gharasathi runs on a ByteNUC mini PC using Talos Linux — an immutable, minimal OS built for Kubernetes. No SSH. No shell. No package manager.

LAN only. No port forwarding. No public IP. The only way to reach these services is to be on my home Wi-Fi.

OpenClaw (formerly Clawdbot) is an open-source AI agent that went viral in early 2026 — 150K+ GitHub stars. It's also local-first: you install it on your machine, it stores data locally, and it connects to LLMs for task automation.

But OpenClaw is far more ambitious than gharasathi. It can execute shell commands, control browsers, send emails, and automate multi-step workflows. It integrates with WhatsApp, Telegram, and Slack. It has a community marketplace (ClawHub) for third-party skills. gharasathi just queries a database and explains the results in natural language.

That difference in scope turned out to matter a lot. In February 2026, multiple security teams published findings within days of each other:

A browser-based attack that let attackers hijack any OpenClaw instance — even ones running only on localhost. A user visits a crafted webpage, JavaScript steals the gateway token via WebSocket, and the attacker gains full operator access: disable security features, escape Docker containers, execute arbitrary commands on the host. (The Hacker News)

This is worth pausing on. OpenClaw was running locally. It was listening on localhost. And it was still compromised — because the victim's own browser initiated the connection. "Local" alone doesn't mean "secure."

Users who exposed their OpenClaw instances to the internet — against best practices — were found leaking API keys, chat histories, and credentials. Some had zero authentication. (Trend Micro)

Security researchers found 341 malicious packages on ClawHub, OpenClaw's community marketplace. These impersonated legitimate tools but contained Atomic Stealer malware and ClawHavoc C2 implants — harvesting SSH keys, browser passwords, crypto wallet keys, and API tokens. (The Hacker News, The Register)

Source: Dev.to