Research explained

Bitsight’s OpenClaw scan measured exposure, not tens of thousands of proven breaches

The February 2026 analysis found more than 30,000 observable instances during its measurement window.

Published 29 Oct 2026 · Material update 9 Feb 2026 — last time the underlying evidence changed · Evidence: high

What happened

Bitsight reported observing more than 30,000 OpenClaw instances between January 27 and February 8, 2026. Its analysis connected rapid adoption with the risks of exposing a powerful personal agent to the internet.

An observable service count is not the same as a count of successfully compromised systems. Authentication, software version, enabled tools and connected credentials determine what an attacker could do in an individual deployment.

Check whether your agent gateway needs to be reachable externally at all. Restrict access, apply maintained updates and minimize connected account permissions. Review exposure using your own asset inventory rather than treating a historical internet-wide count as a current measurement.

Read the original source.

Next step

Verify gateway exposure, authentication and connected credentials for your deployment.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references