How to Stop Your AI Agent From Leaking Customer Data
In January 2026, a security scan found over 42,000 OpenClaw instances exposed on the public internet. No passwords. No encryption. API keys in plaintext. Dashboards open to anyone with a browser.
That's not a theoretical risk. That's a Shodan query anyone can run right now.
OWASP added a Top 10 list specifically for LLM applications because the attack surface is that new and that dangerous. Prompt injection — where hidden instructions trick your agent into leaking data — is listed as the #1 risk.
If you're running an AI agent in production with customer data, this post is for you.
Why This Keeps Happening
Here's the uncomfortable truth about AI agents in production:
They have god-mode access to everything.
Your OpenClaw instance can read your database. Hit your APIs. Send emails on your behalf. Access files on the host machine. Most people set it up on a weekend, get excited that it works, and never think about permissions.
Three things go wrong:
-
No tenant isolation. The agent sees all customer data, not just the relevant record. One prompt mixup = cross-contamination. OWASP calls this "Insecure Output Handling" — the agent processes untrusted input and acts on it without boundaries.
-
Plaintext credentials. The 42,000 exposed instances from January? Many had API keys visible directly in browser-accessible dashboards. Not buried in config files. In dashboards anyone could visit.
-
No audit trail. When something goes wrong (and it will), you can't tell what the agent did, when, or why. You're flying blind. IBM's Cost of a Data Breach 2024 report found that organizations took an average of 292 days to identify and contain a breach — largely because they lacked proper logging.
How to Actually Fix It
You have two paths. I'll give you both.
Path 1: DIY (The Hard Way)
If you want to lock down OpenClaw yourself, here's the minimum:
Isolate execution. Run your agent in a container with no host access. No shared volumes. No network access to your production database. The agent gets a scoped API token that can only touch what it needs.
Encrypt everything at rest. API keys, user tokens, credentials — none of it should be in plaintext. Use a secrets manager. Rotate keys on a schedule. If you're storing keys in a .env file on a VPS, you're one cat command away from disaster.
Add approval gates. Before the agent sends an email, modifies data, or hits an external API — a human should approve it. Yes, it slows things down. No, you can't skip this if you handle customer data. OWASP lists "Excessive Agency" as a top LLM risk for exactly this reason — agents that can take actions without oversight.
Log everything. Every action. Every API call. Every prompt and response. Store it somewhere the agent can't modify. When regulators or customers ask "what happened?" — you need a real answer.
Scope permissions per user. The agent working on Customer A's data should never see Customer B's data. Period. This means building proper auth context into every single agent interaction.
That's weeks of engineering work. Minimum. And you'll still miss something.
Path 2: Use Clawctl (The Fast Way)
We built all of this into the platform because we watched too many smart people skip it.
- Sandboxed execution — your agent runs in complete isolation
- Encrypted credential storage — API keys encrypted at rest, never exposed in logs
- Audit logging — every action your agent takes, timestamped and immutable
- Human-in-the-loop approvals — configurable gates before sensitive actions
- Tenant isolation — each customer's data stays in its own lane
60 seconds to deploy. Zero config files. No "I'll add security later" — it's baked in from the start.
The Real Cost of Doing Nothing
IBM's Cost of a Data Breach 2024 report puts the global average at $4.88 million per breach. But that's the enterprise number. For startups, the cost is existential — not the fine, but the fallout.
Here's what actually happens to a small company:
- One customer finds out. They tweet about it.
- Three more customers leave.
- Your enterprise prospect who was about to sign? Gone.
- You spend the next month on damage control instead of building.
Bruce Schneier, one of the most respected voices in security, puts it simply: "Security is not a product. It's a process." You don't bolt it on after launch. You build it in from day one or you pay for it later.
What to Do Right Now
If you're running OpenClaw in production today:
- Check if your agent has unrestricted network access. (If you didn't explicitly restrict it, it does.)
- Check if your API keys are in plaintext. (Search your config files and environment variables.)
- Check if you have audit logs. (If you didn't set them up, you don't.)
If any of those are true, you're exposed.
Lock it down with Clawctl — or DM us @clawctl and we'll walk you through what needs to change.
Either way, do something. Today. Not next sprint. Today.