Tag: AI

What Is Shadow AI and Why Is It Dangerous?

Shadow AI refers to AI tools, agents, and workflows deployed by employees outside of IT’s knowledge or approval. OpenClaw is the poster child: a single npx openclaw@latest command installs a fully capable AI agent with access to messaging, email, filesystem, and APIs.

The risk isn’t just that agents are running—it’s that they operate with more privileges than users themselves have, create new attack surfaces, and bypass all traditional security controls.

Why Employees Deploy OpenClaw Without Approval

• Productivity pressure: “I need to automate this task and IT takes weeks to provision tools.”
• Ease of deployment: One command, no tickets, no bureaucracy
• Lack of awareness: Employees don’t think of AI agents as “infrastructure” requiring review
• Shadow IT culture: Decades of workarounds have normalized unsanctioned tool use
• Hype cycle: Everyone’s talking about AI agents; developers want to experiment

The solution isn’t to ban OpenClaw—that’s impossible. The solution is to bring it into the light with proper governance.

Detection: How to Find Unauthorized OpenClaw Instances

Before you can secure shadow AI, you need to know what’s running. Here’s how to detect OpenClaw across your environment:

1. Network Scanning

OpenClaw’s default gateway port is 18789/tcp. Scan your internal networks:

nmap -p 18789 10.0.0.0/8
masscan -p18789 192.168.0.0/16

Look for hosts with port 18789 open. Even if the gateway binds to localhost, some deployments expose it externally.

2. Endpoint Telemetry

Search managed devices for OpenClaw processes and packages:

# Running processes
ps aux | grep -i openclaw
# NPM packages (global)
npm list -g --depth=0 | grep openclaw
# User home directories
find /home -name ".openclaw" -type d 2>/dev/null

3. DNS Monitoring

Track DNS queries to OpenClaw-related domains:

• openclaw.ai (telemetry, updates)
• clawhub.com (skill marketplace)
• moltbook.com (agent social network, if still active)

4. EASM (External Attack Surface Management)

Use commercial EASM tools to scan for publicly exposed OpenClaw gateways. Many organizations are shocked to find developer laptops with port 18789 open to the internet via port forwarding or cloud VMs.

#!/bin/bash
# Find OpenClaw installations on Linux endpoints
echo "=== Checking for OpenClaw processes ==="
pgrep -fl openclaw 2>/dev/null || echo "None found"
echo ""
echo "=== Checking ~/.openclaw directories ==="
find /home -maxdepth 2 -name ".openclaw" -type d 2>/dev/null | while read dir; do
    echo "Found: $dir (owner: $(stat -c %U $dir))"
done

Risk Assessment: Prioritizing Findings

Not all OpenClaw deployments carry equal risk. Prioritize based on:

Remediation: From Shadow to Governance

Once you’ve identified unauthorized deployments, follow this playbook:

Step 1: Inventory

Document each instance: host, owner, integrations, data accessed. Use automated scanning where possible, then interview users to understand use cases.

Step 2: Risk Triage

Classify as Critical/Medium/Low based on exposure, privileges, and sensitivity of accessed data. Critical instances should be immediately disabled if they pose immediate breach risk.

Step 3: User Education

Explain the risks: “Your OpenClaw instance has SSH keys to our production servers. If compromised, an attacker could delete everything.” Many users simply didn’t realize the implications.

Step 4: Provide an Approved Alternative

Either:

• Bring the deployment under IT control (standardized image, monitoring, access review)
• Offer a managed OpenClaw service with proper safeguards (e.g., MintMCP Gateway, Lyzr Enterprise)
• Provide a different approved tool that meets the same need

Step 5: Enforce Policy

Update acceptable use policies to explicitly cover AI agents. Require security review for any automation tool that accesses corporate systems. Violations should have clear consequences.

Prevention: Stopping Shadow AI Before It Starts

The best defense is making the sanctioned path easier than the shadow path:

• Provide approved templates: Offer pre-hardened OpenClaw configurations for common use cases (email automation, calendar management) that employees can deploy self-service without risk.
• Reduce friction for approvals: Fast-track review for low-risk automation requests. If getting approval takes 2 minutes instead of 2 weeks, shadow IT drops.
• Run awareness campaigns: Share real breach stories involving AI agents. Make the risk tangible.
• Deploy monitoring proactively: Use endpoint detection to alert on new OpenClaw installations, not just reactively.
• Offer centralized AI agent platforms: Products like MintMCP Gateway and Lyzr give IT visibility and control while preserving user productivity.

Technical Deep Dive: Detecting OpenClaw via Telemetry

For teams with SIEM or EDR, create detection rules:

Process Creation Rule (Sigma/SIEDM)

selection:
  Image|endswith: 'openclaw'
  CommandLine|contains: 'openclaw'
  ParentImage|not_endswith: 'defender.exe'  # exclude authorized scanners
  ParentImage|not_endswith: 'vulnerability-scanner'
condition: selection
action: alert

Network Connection Rule

selection:
  DestinationPort: 18789
  ProcessName: 'openclaw' OR 'node'
  RemoteAddress|not_in: ['127.0.0.1', '::1']  # localhost is okay
condition: selection
action: alert

File System Watch

Monitor for creation of .openclaw directories in user home folders. This often indicates initial installation.

Case Study: The Developer Who Almost Lost His SSH Keys

A senior engineer at a fintech startup installed OpenClaw to automate code reviews. The agent was configured with the engineer’s personal SSH key to pull/push to internal repositories.

The engineer visited a compromised tech blog that exploited CVE-2026-25253. Within minutes, the attacker had:

• Dumped the SSH private key from ~/.ssh/id_rsa via the agent
• Accessed the company’s GitHub private repos
• Cloned the infrastructure repository containing AWS credentials

The breach was detected only because the SIEM flagged unusual GitHub API calls from a new location. The company’s EDR had no visibility into OpenClaw’s file operations because the process ran under the user’s account and appeared legitimate.

Aftermath: All SSH keys rotated, the engineer’s account investigated (he hadn’t violated policy, just lacked awareness), and an AI agent governance program was launched.

Conclusion: Bring Shadow AI Into the Light

Shadow AI isn’t going away—the productivity benefits are too compelling. But operating blind is a recipe for breach. The organizations that thrive will be those that:

• Inventory what’s running (automated scanning)
• Assess the risk (exposure, access, patching)
• Govern with policies and monitoring
• Enable with approved, secure alternatives

The CVE-2026-25253 incident proved that even technically sophisticated users can fall victim to trivial exploits when powerful tools operate outside security oversight. Don’t wait for a breach to discover your shadow AI footprint.