The part nobody mentions when they sell you an AI agent

An AI agent isn't an app on your phone. It's a program that runs as a service, usually with a web interface so you can talk to it, and usually with credentials so it can do useful work: read your files, send email, hit an API, run a command. When that service is reachable from the internet, it's a server, with all the responsibility that word carries. It has to be patched. It has to be kept off the open internet unless it truly needs to be there. And it has to be built so that a stranger who reaches it can't make it act on their behalf.

Most small business owners never see this layer. You asked for an AI assistant, someone stood one up, and it works. That scale is what gets stood up fast, left on a public IP for convenience, and never revisited. The headline figure you'll see quoted is 245,000, the combined Shodan and ZoomEye count, but those two scan sets overlap, so the unique number is lower, near 135,000 in the April tally. Either way the order of magnitude is the point: tens of thousands of AI agents are answering the door for the whole internet, most of them without so much as a password. OpenClaw is the platform in the headline because it's popular and easy to self-host, but the lesson isn't about one product. Any agent you run, or any agent a vendor runs for you, lives somewhere, and that somewhere is either locked down or it isn't.

What the Claw Chain actually does

The four vulnerabilities Cyera disclosed are interesting precisely because none of them is the whole attack. They chain. All four were patched on April 23, 2026, and published to NVD on May 6, 2026:

  • CVE-2026-44112 (CVSS 9.6, published May 6, 2026). A timing flaw (a race condition) in the OpenShell sandbox lets an attacker redirect a write to land outside the sandbox, which means tampering with configuration or dropping a persistent backdoor on the host.
  • CVE-2026-44115 (CVSS 8.8, published May 6, 2026). A gap between how OpenClaw validates a command and how it runs it lets an attacker slip shell expansion past the allowlist, running commands that looked safe at validation time and exposing API keys, tokens, and other credentials the agent can reach.
  • CVE-2026-44118 (CVSS 7.8, published May 6, 2026). OpenClaw trusted a flag the client controls to decide who the owner is, so a local process holding a valid token could promote itself to owner-level control over the gateway's configuration and scheduling.
  • CVE-2026-44113 (CVSS 7.7, published May 6, 2026). A read-side version of the same timing flaw that exposes files outside the sandbox's mount root.

Read those together and the story is the one this site keeps coming back to: the dangerous part was never a single clever bug; it's what an agent can reach once something goes wrong. A credential leak feeds a privilege escalation, which feeds a sandbox escape, which lands on the host with the agent's own access to your systems. These sit underneath two other severe issues from earlier in the year: CVE-2026-32922 (CVSS 9.9, published March 29, 2026), a privilege-escalation flaw now described as the most serious in OpenClaw's history, and CVE-2026-25253 (CVSS 8.8, published February 1, 2026), a one-click remote-code-execution bug. The running CVE tally for the platform is past 138.

Why a 12-person business should care about a server count

Two ways this reaches you, and you may be in either.

You might be running an agent yourself. Plenty of capable owners and the consultants they hire have stood up OpenClaw or a similar agent to handle scheduling, triage, or ops. If that's you, the exposure question is literal: is the gateway on a public IP, is it patched past April 23, and have the credentials it holds been rotated since. Cyera flagged the highest real-world risk in financial services, healthcare, and legal work, anywhere an agent touches customer financial data, health information, or privileged records. A bookkeeping practice or a small clinic running an exposed agent is exactly the profile.

You might be running one without knowing it. The piece on shadow AI in small business covered how often AI shows up in a company that never approved it. An agent a vendor hosts on your behalf is the same risk wearing a contract. When the vendor's gateway is the one on the public internet, the customer records flowing through it are yours, and so is the fallout.

This is the internet-facing cousin of the ClawHavoc supply-chain attack, where the poison came in through the skills marketplace. There the threat arrived through what the agent installed. Here it arrives through what the agent exposes. Same platform, opposite door.

What to actually do this week

If you run an agent, or pay someone who does, this is a short list, and most of it takes one afternoon.

1. Find out if it's on the public internet at all. The honest answer for most small businesses is that the agent never needed to be reachable from outside the building. If so, ask why. A gateway that only your team uses belongs behind a VPN or a private network, not on a public IP. This single change removes most of the exposure problem.

2. Confirm it's patched past April 23, 2026. Whoever runs the agent should be able to tell you the version and confirm the Claw Chain fixes (and the 32922 and 25253 patches) are applied. If they can't tell you the version, that's the finding.

3. Rotate the credentials the agent holds. CVE-2026-44115 leaked exactly these. Any API key, token, or password the agent has touched since the spring should be rotated, on the assumption it may have walked. This is cheap insurance and you should do it whether or not you think you were hit.

4. Ask what the agent can reach if it's taken over. This is the question that outlasts any one CVE. If a stranger drove your agent for an hour, what's the worst they could read, send, or delete? The smaller that answer, the safer you are. Narrowing it is the core of the AI agent security review I do with clients, and it's the same discipline whether the platform is OpenClaw, a vendor's product, or whatever replaces both next year.

The earlier piece on OpenClaw security goes deeper on the platform specifics. This one is the narrower, more urgent question: is your agent a private tool or a public server, and do you actually know which.

The Bottom Line

  • Public scans this spring found tens of thousands of OpenClaw gateways exposed on the internet: about 65,000 via Shodan and 180,000 via ZoomEye (a combined 245,000 that overlaps), with unique instances nearer 135,000 and roughly 63% running no authentication at all. Most are still exposed.
  • Cyera's "Claw Chain" (CVE-2026-44112 / 44115 / 44118 / 44113, patched April 23, 2026) chains a credential leak, a privilege escalation, and a sandbox escape into a foothold on the host. They sit alongside CVE-2026-32922 (9.9) and CVE-2026-25253; the platform's CVE tally is past 138.
  • An AI agent is a server. The risk isn't the model. It's whether the service is patched, kept off the open internet, and limited in what it can reach when something goes wrong.
  • The highest real-world exposure is in financial, healthcare, and legal work, where the agent touches money, health data, or privileged records.
  • Four steps this week: take it off the public internet if it doesn't need to be there, confirm it's patched past April 23, rotate any credentials it holds, and write down what it could reach if it were taken over.

If you run an AI agent, or a vendor runs one for you, the four steps above answer the question that matters: is it a private tool or a public server, and what can it reach if it's taken over. Walking that against your actual setup is an afternoon of work I do with clients, and it produces a written record you can act on. Connect on LinkedIn.

Keep reading: OpenClaw Security: What CTOs Need to Know covers the platform in depth. ClawHavoc covers the supply-chain side. Your Small Business Is Already Running AI You Don't Know About covers the inventory step.

Sources

  1. OpenClaw internet exposure. Public scans found about 65,000 instances via Shodan and 180,000 via ZoomEye, a combined figure widely cited as roughly 245,000; the scan sets overlap, and a separate April 2026 count put unique exposed instances near 135,000 across 82 countries, about 63% with no authentication. Per Cybersecurity News and Cyera's "Claw Chain" research.
  2. The Claw Chain (Cyera), all patched April 23, 2026 and published on NVD May 6, 2026: CVE-2026-44112 (9.6, sandbox-escape race condition), CVE-2026-44115 (8.8, exec-allowlist bypass via heredoc shell expansion), CVE-2026-44118 (7.8, senderIsOwner privilege escalation), CVE-2026-44113 (7.7, read-side race exposing files outside the mount root). GitHub advisories GHSA-5h3g-6xhh-rg6p, GHSA-wppj-c6mr-83jj, GHSA-r6xh-pqhr-v4xh, GHSA-x3h8-jrgh-p8jx.
  3. CVE-2026-32922 (CVSS 9.9, published March 29, 2026, privilege escalation in device.token.rotate, fixed in 2026.3.11) and CVE-2026-25253 (CVSS 8.8, published February 1, 2026, one-click RCE, fixed in 2026.1.29). The platform CVE tally is past 138. Per ARMO, NVD, and OpenClaw CVE trackers.
  4. Highest real-world risk in financial services, healthcare, and legal sectors processing PII, PHI, or privileged credentials. Per Cyera's risk assessment.