Threat Intelligence · March 9, 2026 · 4 min read · Kartik Kumar
OpenClaw: Beyond Endpoint Detection — Think Identity Security
Why EDR alone can't detect AI agent threats, and what actually works.
Background
Of late, there has been a lot of buzz around OpenClaw (formerly Clawdbot or Moltbot), and its game-changing use cases and advantages. Yet, one cannot disregard the security-related issues they bring along. From what OpenClaw can do in terms of capabilities to where and how it stores credentials have been points of discussion for security professionals.
This is sure to fuel a lot of infostealers, who will find it even easier to steal credentials like client secrets and tokens. All they have to do is land on the endpoint. The credentials configured on OpenClaw are then handed on a silver platter, with known locations including ~/.openclaw/credentials/, ~/.openclaw/openclaw.json, environment variables, and client-specific configuration directories.
The OpenClaw skills — both bundled and community-developed — cannot be trusted because they are not built with least-privilege principles in mind. Community-developed skills can even be malicious. It has also been proven that reputation metrics such as stars and installation counts are not trustworthy when choosing options for integration.
Endpoint-Based Detection — And Its Limits
Enterprises that have rolled out EDR solutions have a way to detect potential OpenClaw usage. In the most ideal case, this is a decent starting point. But this approach has critical deficiencies:
- Users running OpenClaw from a personal device
- Users on a remote or unmanaged machine without an EDR agent installed
- A sophisticated user renaming every occurrence of the string "OpenClaw" and running it on a corporate device that has an EDR agent installed
OpenClaw's functionality requires access to enterprise tools, applications, and data — and this is where it leaves identity breadcrumbs. Every meaningful OpenClaw interaction eventually touches enterprise identity systems: OAuth grants, API tokens, service principals, bots, or direct API calls.
From an enterprise perspective, relying solely on endpoint detection is optional at best — and certainly not a guaranteed path to detection.
The rest of this article covers identity-based detection in depth
Learn exactly how OpenClaw leaves identity breadcrumbs across Slack, Google Workspace, Microsoft Outlook, and GitHub — and how to catch it.
- Specific OAuth scopes and audit log signals per platform
- How to detect non-human identity behavioral drift
- Why ITDR is the right framework for AI agent threats
- A detection matrix across enterprise applications