OpenClaw (formerly known as Clawdbot/Moltbot) is powerful because it does real work: it can connect to services, run tools, and automate workflows. That power also changes your threat model. If attackers reach your gateway, they may not just “view a dashboard.” They may pivot into credentials, integrations, local files, and potentially command execution, depending on how you run it.

This guide breaks down what’s driving the “OpenClaw + security + IP address” searches right now: exposed instances, risky defaults, and the ClawJacked-style browser-to-local takeover problem that affects localhost deployments too. We’ll also cover a practical hardening checklist you can apply in under an hour, plus how LycheeIP can fit into a safer automation stack when you need controlled outbound IP behavior.

Security note: This is defensive guidance for securing your own systems. If you’re running OpenClaw in production, treat it like privileged software and follow your organization’s security policies.

               Secure egress IPs with LycheeIP

What is OpenClaw (and why it changes your threat model)

OpenClaw is an open-source, self-hosted AI agent platform designed to act as a “do things” assistant with a local-first gateway that coordinates tools, sessions, channels, and events. It’s commonly self-hosted on a workstation or a VPS and can integrate with chat apps and services, which often means it handles tokens, API keys, and persistent access.

Because it can bridge between the internet, your local machine, and integrated services, multiple security teams and researchers have warned that it should be isolated and treated like high-risk code execution if misconfigured.

The two exposure problems you must solve

1) Public exposure: binding the gateway to the internet

A recurring issue is OpenClaw instances accidentally exposed to the public internet (often via a management UI or gateway on port 18789). Some research reports attribute this to defaults or common deployment mistakes where the service listens on 0.0.0.0 (all interfaces) instead of 127.0.0.1 (localhost only).

SecurityScorecard reported observing 40,000+ exposed instances in a short window, highlighting how often this misconfiguration happens in real deployments.

2) Localhost exposure: “browser to local gateway” takeover (ClawJacked)

Even if you bind the gateway to localhost, recent reporting shows a high-severity issue (popularized as ClawJacked) where a malicious website can interact with a locally running gateway via browser-accessible local connections and then attempt to gain control (for example, by abusing login flows / brute-force protections). A fix was released in OpenClaw version 2026.2.26 (and later), and users were urged to update immediately.

Bottom line: binding to 127.0.0.1 is necessary, but it’s not sufficient by itself. You also need the patched version and additional controls.

Quick table: binding choices and what they really mean

(Exposure risk patterns have been widely reported for port 18789 and misconfigured bindings.)

Top OpenClaw security risks (listicle)

1. Exposed gateway/UI on a public IP (port scanning finds you fast).
2. Localhost hijack paths (ClawJacked class) if you’re unpatched or missing rate-limits/auth hardening.
3. Supply-chain risk from third-party “skills” / marketplaces, where malicious extensions or instructions can lead to malware or credential theft.
4. Plaintext secrets and token sprawl (API keys, OAuth tokens, config files, logs).
5. Prompt injection via email, web content, or connected channels that causes unsafe actions.
6. Over-permissive OS permissions (running as admin/root, broad file access).  
7. No network segmentation (agent can reach everything on your LAN/VPC).
8. No monitoring/alerting (you find out after data leaves).

Harden OpenClaw: a practical security baseline (step-by-step)

Step 1: Update first (non-negotiable)

Upgrade OpenClaw to 2026.2.26 or later to address the ClawJacked issue reported by multiple outlets.

Step 2: Bind the gateway to localhost

Set your gateway bind to 127.0.0.1 and avoid exposing the management port publicly. The “exposed instances” research repeatedly ties risk to public bindings.

Step 3: Don’t open port 18789 to the internet

Use a host firewall (e.g., UFW) or cloud security group rules to block inbound access to 18789 from anything except localhost (or an internal trusted network).

Rule of thumb: If Shodan can see it, attackers can too.

Step 4: Use safe remote access (SSH tunnel or private VPN)

If you must manage OpenClaw remotely, prefer:

• SSH local forwarding (tunnel localhost to your machine)
• A private mesh VPN (Tailscale/ZeroTier-style approach)
• Avoid “just open the port and add a password” as your only control.

(These approaches are commonly recommended in hardening guides because they avoid exposing the admin surface directly.)

Step 5: Enforce authentication + rate limiting

• Require an auth token/strong password
• Ensure brute-force protections and rate limits are active
• Don’t leave “management UI” unauthenticated, even on internal networks

This matters specifically because ClawJacked-style attacks rely on local access plus weak/abusable auth protections.

Step 6: Add a reverse proxy only if you know why

For enterprise setups, a reverse proxy (NGINX/Caddy) can add:

• Additional authentication layer (SSO / basic auth / mTLS)
• Request filtering, IP allowlists, and rate limits

But: if you misconfigure a reverse proxy and re-expose the gateway publicly, you can make things worse. Keep it private by default.

Step 7: Isolate the runtime (VM/container) and reduce privileges

Multiple security discussions recommend isolation and least privilege for agent-style runtimes because they blur the line between “assistant” and “automation with access.”

Minimum isolation standard

• Run in a dedicated VM or container
• No root/admin unless required
• Restrict filesystem mounts
• Separate secrets from code (vault, env injection, short-lived tokens)

Step 8: Treat “skills” like software installs

If you use skill marketplaces or third-party integrations:

• Review source
• Pin versions/hashes where possible
• Avoid running random shell commands from skill docs
• Prefer allowlisted internal skill repos in teams

This is not theoretical: reporting has highlighted malicious skills and campaigns targeting OpenClaw users.

               Secure egress IPs with LycheeIP

Control map (table): what to implement and why

Secure networking for OpenClaw automation workloads (where LycheeIP fits)

A lot of teams mix two different needs:

1. Protecting OpenClaw’s inbound management surface (gateway/UI)
2. Controlling OpenClaw’s outbound traffic (automation calls to sites/APIs)

Proxies do not replace a firewall, a VPN, or proper gateway binding for inbound security. But proxies can help with outbound control, especially when you want predictable, allowlistable egress IPs for integrations.

Practical outbound patterns (listicle)

• API allowlisting: Lock sensitive third-party dashboards to accept requests only from known egress IPs.
• Separation of duties: Keep “agent runtime IP” distinct from “data collection IP.”
• Geo testing and compliance checks: Validate what users see in different regions without exposing your server’s real IP.
• Rate and reputation management: Reduce blocks by using higher-trust IPs for automation that touches bot-protected targets.

LycheeIP positions itself as a proxy infrastructure provider with HTTP(S)/SOCKS5 support, REST API integration, and residential/static proxy options that teams can use for controlled egress.

A simple “safer stack” example

• Inbound: OpenClaw gateway bound to localhost + firewall + VPN/SSH tunnel
• Outbound: route specific automation tasks through a proxy layer (LycheeIP) so your origin server IP stays private and your integrations can allowlist stable egress

LycheeIP also highlights features like protocol support and API-based proxy management on its product pages.

Monitoring and incident response (don’t skip this)

If OpenClaw is connected to real accounts, assume credential exposure is a “when” not “if” without monitoring.

Minimum monitoring checklist

• Track login attempts and admin actions
• Alert on config changes (bind address, auth settings, exposed ports)
• Rotate tokens/keys on a schedule
• Keep OpenClaw and the host OS patched
• Snapshot backups (encrypted) so recovery is fast

This aligns with broader security guidance for agent runtimes that can retain access and evolve over time.

               Secure egress IPs with LycheeIP

Frequently Asked Questions:

1. Is OpenClaw safe to run on a VPS?

It can be, but only if you treat it like privileged automation software: isolate it, keep the gateway private, patch quickly, and avoid public exposure. Researchers have repeatedly highlighted real-world exposures and takeover risks when misconfigured.

2. What port does OpenClaw use, and why is it risky?

Many reports reference port 18789 as the management/gateway surface that ends up exposed in misconfigurations. If it’s reachable from the internet, it becomes a high-value target.

3. Does binding to 127.0.0.1 fully prevent attacks?

It reduces public exposure, but it does not automatically prevent browser-to-local attack classes like ClawJacked if you’re unpatched or missing additional protections.

4. What is the ClawJacked vulnerability?

ClawJacked is a reported high-severity issue where a malicious website can attempt to hijack a locally running OpenClaw gateway via local WebSocket access patterns and weaknesses in protections (for example, brute-force/rate-limiting gaps). OpenClaw released fixes in 2026.2.26 and later.

5. Which remote access method is safest for the OpenClaw dashboard?

6. Should I put OpenClaw behind NGINX or Caddy?

Only if you keep it private and you’re adding a specific control (SSO, mTLS, rate-limits, WAF rules). A reverse proxy can help, but it can also accidentally re-expose the gateway.

7. Are OpenClaw “skills” a security risk?

They can be. Reporting has highlighted malicious skills and campaigns that trick users into running unsafe commands or installing malware. Treat skills like software dependencies: review, pin versions, and restrict sources.

8. How can LycheeIP help in an OpenClaw setup?

LycheeIP is most relevant for outbound traffic control, not inbound gateway security. If your OpenClaw workflows need stable egress IPs for allowlisting, geo testing, or safer automation routing, LycheeIP’s proxy options and API tooling can fit into that layer.

9. What’s the fastest “do this today” checklist?

• Update to 2026.2.26+  
• Bind to 127.0.0.1
• Block inbound 18789
• Use SSH tunnel or private VPN
• Turn on auth + rate limits