In this guide · 8 sections
- 01What CSA's OpenClaw advisory says
- 02What OpenClaw is and why agents differ from chatbots
- 03The five agent risks, in plain English
- 04CSA's recommended safeguards for businesses
- 05A staff rule for installing AI agents
- 06Where this fits with IMDA's agentic AI framework
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
CSA advises not installing OpenClaw in its open-source form on devices with sensitive data, running agents under least-privilege accounts, installing only trusted skills, and requiring human approval for payments, deletions and external messages. Businesses should also log every agent action.
What CSA's OpenClaw advisory says
CSA's Advisory on Cybersecurity Risks of OpenClaw (AD-2026-005, 28 May 2026) describes autonomous AI agents as systems that can understand context, plan and take independent actions using tools such as web browsers, code executors and APIs. It says agents like OpenClaw offer real productivity benefits but introduce serious cybersecurity risks.
The advisory highlights five risk areas from IMDA's case study on the responsible deployment of OpenClaw: unpatched vulnerabilities, weak access controls, sensitive data exposure, malicious third-party skills and memory poisoning. Left unaddressed, CSA says these can lead to agent hijacking, unauthorised actions through tool or API abuse, and unauthorised access to systems or data.
What OpenClaw is and why agents differ from chatbots
IMDA describes OpenClaw as an open-source AI agent platform that acts as an autonomous personal assistant through chat apps such as WhatsApp, Telegram, Discord and Slack. Released in November 2025, it became popular because it works out of the box with access to local files and systems, messaging integrations, long-term memory and add-on skills.
A chatbot answers a question and stops. An agent keeps going: it reads your files, opens websites, runs commands and sends messages to finish a task. That is the productivity gain and the risk. Whatever the agent can touch, an attacker who tricks it can touch too.
| Chatbot (ChatGPT, Claude, Gemini in a browser) | Autonomous agent (OpenClaw and similar) | |
|---|---|---|
| Access | What you paste or upload | Files, shell, browser, apps, messages |
| Actions | Writes text for you to use | Acts on its own: sends, deletes, buys, runs code |
| Memory | Per chat, or limited memory | Long-term memory across sessions |
| Main risk | Data you paste leaving the company | Hijacked agent acting with your permissions |
Most mainstream AI tools now offer agent features too, often through connectors built on the Model Context Protocol. Our MCP explainer covers how those connections work and what to ask before switching one on.
The five agent risks, in plain English
IMDA's case study is specific about how things go wrong. In everyday terms:
- Unpatched vulnerabilities: IMDA notes that OpenClaw began as a hobbyist project and that, as of late April 2026, the OpenCVE platform listed over 400 CVEs related to it, more than 10 rated critical.
- Weak access controls: by default the agent inherits the privileges of the account that installed it, so it can read any file that user can, including the API keys and tokens it stores. In shared Slack or chat channels it may accept instructions from anyone in the channel.
- Sensitive data exposure: messages, files and emails the agent can see may be sent to an external AI model as context, without the user noticing.
- Malicious skills: skills from public marketplaces such as ClawHub are often user-submitted. IMDA cites security researchers who found over 800 malicious skills by February 2026, including info-stealing malware disguised as useful tools.
- Memory poisoning: hidden instructions in an email, web page or document can be saved into the agent's long-term memory and triggered later, for example to copy a finance report to an outside location.
The last one is a form of prompt injection: the agent cannot reliably tell the difference between your instructions and instructions hidden in content it reads. OWASP lists prompt injection as the top risk in its LLM Top 10, alongside excessive agency, which is giving a model more permissions than it needs.
CSA's recommended safeguards for businesses
For organisations, CSA says stronger safeguards are essential. Its list, drawn from Section 3 of the IMDA case study, translates into these steps for a small business.
Decide where agents are allowed at all
Keep open-source agents off laptops and servers with customer, finance or HR data. If you want to experiment, use a separate device or cloud instance with no access to company files.
Use narrow agents, not one all-powerful one
CSA recommends multiple narrowly scoped agents to limit the blast radius. A scheduling agent should not also have access to your accounting system.
Give agents their own least-privilege credentials
Create dedicated accounts and tokens for the agent, never the owner's admin login. Rotate them regularly and immediately after anything suspicious.
Require human approval through system controls
Payments, deleting data, running code in production and sending external messages need an approval step enforced outside the agent, not just a line in its instructions.
Log every action and control outbound traffic
Keep logs in a persistent location (CSA notes OpenClaw logs to /tmp by default) and route the agent's web requests through a proxy you control.
Test the guardrails before going live
Try to make the agent do things it should not, and confirm it is blocked and asks for approval when it should.
If compromised, rebuild rather than restart
Restore from a known-good setup, and clean its memory and any connected stores, because poisoned memory survives restarts.
A staff rule for installing AI agents
Most small businesses do not need an agent policy document. They need a short rule everyone understands, added to your existing AI or IT policy. Our ChatGPT at work policy guide has a template to attach it to.
AI agent rule for staff
Endpoint protection helps here too. A managed antivirus with application control can flag or block unapproved agent installs on company laptops.
Where this fits with IMDA's agentic AI framework
The advisory sits within a wider set of Singapore guidance. IMDA launched the Model AI Governance Framework for Agentic AI on 22 January 2026, and CSA has published an addendum on securing agentic AI to its guidelines on securing AI systems. The IMDA case study applies that framework to one popular tool.
CSA also notes that variants such as NanoClaw and Nvidia's NemoClaw have appeared since OpenClaw's launch, and that organisations should verify whether these meet their security needs, because safeguards for agentic AI are still maturing. For testing an agent before you rely on it, see our guide to IMDA's agentic AI testing starter kit. For costs of a properly built agent, see what AI agents cost a small business.
Do it yourself or get help?
Writing the staff rule and checking which laptops have agent software installed is a job most owners can do this week. Ask staff directly; many installs are well-intentioned experiments.
If you want an outside check, our Security Health Check (S$290) reviews devices, admin accounts and AI tool access, including unapproved agents. Our Antivirus & Endpoint Protection Rollout (S$390) puts managed protection on every laptop so unapproved software is visible and can be blocked.
Frequently asked questions
It is advisory AD-2026-005, published by the Cyber Security Agency of Singapore on 28 May 2026. It warns that autonomous AI agents such as OpenClaw introduce serious cybersecurity risks, draws on IMDA's case study on the responsible deployment of OpenClaw, and lists best practices for individuals and organisations, including least privilege, trusted skills only, human approval for high-stakes actions and full logging.
No. CSA's advisory does not ban it. It recommends avoiding OpenClaw in its open-source form on devices with sensitive data and in mission-critical systems, and says accepting the risks of broader capabilities should be a deliberate decision rather than the result of overlooked default settings. Businesses decide for themselves, but should treat agent installs as a security matter.
Only with clear limits. Following CSA's advice, agents should run under a least-privileged account, without access to customer, payroll or financial data, with skills from trusted sources only, and with human approval for payments, deletions and external messages. Many businesses simply require owner or IT approval before any agent that can access files or the browser is installed.
It is when hidden instructions in content the agent reads, such as an email or web page, are stored in its long-term memory and acted on later. IMDA gives the example of two harmless-looking instructions that combine to send a financial report to an outside location. Because memory persists, restarting the agent does not remove the problem.
The principles apply to any AI agent that can take actions with your data, including agent features in mainstream tools. Enterprise products usually add identity controls, admin settings and logging that open-source agents lack, but you should still limit what connectors can access, review permissions, and require approval for actions such as sending email or changing records.