When attackers run arbitrary code on your systems
AI agents that can execute code are powerful but dangerous. Without proper sandboxing, attackers can run malicious code with full system privileges.
Remote Code Execution (RCE) is when an attacker can run arbitrary code on your systems. For AI agents like OpenClaw, which are specifically designed to write and execute code, RCE isn't a bug—it's a feature that can be exploited.
The danger lies in the scope of execution. When OpenClaw runs on a self-hosted server, code it executes typically runs with the same privileges as the server process. This often means full access to the file system, network, environment variables, and potentially root access.
A single successful attack can give adversaries complete control of your server, allowing them to install backdoors, steal data, pivot to other systems, or use your infrastructure for malicious purposes.
Tricking the AI into writing and executing malicious code through crafted prompts.
Installing malicious packages that execute code during installation.
Breaking out of intended execution context to run shell commands.
Establishing a connection back to the attacker for persistent access.
Using initial code execution to gain higher privileges on the system.
In a documented attack against an AI coding assistant:
1. An attacker submitted a prompt asking for help with a "Python script" 2. The prompt contained obfuscated instructions to execute shell commands 3. The AI generated code that, when run, downloaded and executed a payload 4. The payload established a reverse shell to the attacker's server 5. The attacker now had full shell access to the victim's development machine
The entire attack took seconds and required no special technical skills—just a carefully crafted prompt.
When you self-host your OpenClaw, you're responsible for addressing these risks:
Clawctl includes built-in protection against remote code execution:
All code runs in isolated containers with strict resource limits. No access to host system or other tenants.
Dangerous system calls are blocked. No shell escapes, no privilege escalation, no unauthorized network access.
Reverse shells can't connect out. All network traffic must go through allowlisted endpoints.
Instantly terminate suspicious execution. One-click shutdown of compromised sessions.
Real-time monitoring of all executed code. Unusual patterns trigger alerts and automatic suspension.
Whether you use Clawctl or not, follow these best practices:
Clawctl includes enterprise-grade protection against this threat and many others. Deploy your OpenClaw securely in 60 seconds.