Security
Running an AI Gateway with shell access: threat model and practical checklist for minimizing risk
Quick check: `openclaw security audit`
Treat this as a mandatory security check after changing config, exposing network, or installing plugins:
openclaw security audit openclaw security audit --deep openclaw security audit --fix
It focuses on: Gateway auth/exposure, browser control exposure, elevated tool policies, disk permissions and sensitive files, plugin loading, etc.
See also: ''Formal Verification (Security Models)''
Core principles: access control first, then intelligence
Most incidents are not "advanced attacks" but "someone can send messages to the bot, and the bot just does it". Priority order:
- Identity/Entry: Who can trigger the bot (DM pairing/allowlist, group allowlists, @ mention gating).
- Permissions/Scope: Where the bot is allowed to act (tool allowlists, sandboxing, device permissions).
- Model/Prompts: Treat the model as a manipulatable component, rely on hard constraints rather than "asking it to behave".
Priority checklist (which to fix first when warnings appear)
When audit outputs issues, handling them in this order is usually most effective:
1. Any open + tools enabled: Lock down DMs/groups first, then tighten tool policy/sandboxing.
2. Public/LAN exposure (bind=lan, Funnel, missing auth): Fix immediately.
3. Remote browser/node control exposure: Treat as "remote operator access" (tailnet-only, avoid public exposure).
4. File permissions: Ensure state/config/credentials are not readable by group/others.
5. Plugins: Only load plugins and versions you explicitly trust.
Prompt injection: not just from "stranger DMs"
Even if only you can DM the bot, as long as the bot reads untrusted content (web pages, attachments, emails, pasted logs/code), prompt injection can still occur.
Practical recommendations:
- Hand web/attachment reading to a read-only, tool-less "reader agent", only pass summaries to the main agent.
- For high-risk tools (''exec''/''browser''/''web_fetch''/''web_search''), stick to minimal and allowlist.
- Enable sandboxing, move sensitive data away from readable filesystem (don't rely on prompts to "guarantee no leakage").
Incident response (when suspecting intrusion/leakage)
Think of "intrusion" as: someone entered a room that can trigger the bot, token leaked, plugin/tool did unexpected actions.
1) Stop bleeding: Stop Gateway or disable elevated tools; immediately tighten DM/group entry.
2) ''Rotate keys'': Rotate ''gateway.auth'' token/password; rotate hooks token; revoke suspicious node pairings; rotate model provider keys.
3) ''Review evidence'': Check Gateway logs and recent sessions/transcripts; check and clean ''extensions/''.
4) ''Re-run audit'': ''openclaw security audit --deep'' to ensure report is clean.