I Let an AI Agent Run My Dev Machine for a Week — Then ClawJacked Happened

My Week Living With an AI Agent

I've spent 20 years in QA engineering, and nothing has shifted my workflow quite like running an autonomous AI agent on my local machine. For the past several months, I've been using OpenClaw — an open-source agentic runtime that connects an LLM to your shell, browser, calendar, and messaging platforms. It doesn't just answer questions. It does things.

During one particularly productive week, my OpenClaw agent wrote and committed a blog post, ran my Playwright test suite when it detected a new PR, summarized 30 unread emails, and reminded me about a dentist appointment. I started thinking of it less as a tool and more as a junior team member who never sleeps.

Then the ClawJacked vulnerability dropped, and I had to rethink everything.

What Is ClawJacked?

In February 2026, security researchers disclosed a high-severity flaw in OpenClaw's local gateway. The vulnerability — dubbed "ClawJacked" — allowed a malicious website to open a WebSocket connection to localhost on OpenClaw's gateway port, brute-force the authentication token, and hijack the running AI agent.

Let that sink in: visiting the wrong webpage could give an attacker full control of your AI agent — which has access to your shell, files, and credentials.

The OpenClaw team patched it quickly, but the implications go far beyond one CVE. This is the new attack surface that every engineering team needs to understand.

Why Agentic AI Changes the Threat Model

Traditional dev tools are mostly passive. Your IDE doesn't execute arbitrary shell commands based on natural language input. But AI agents like OpenClaw, by design, blur the line between "assistant" and "operator." They have:

• Shell access — they can run any command you can
• File system access — read and write anywhere your user can
• Network access — make HTTP requests, interact with APIs
• Credential access — if your environment has tokens and keys, so does the agent

This isn't a bug — it's the feature. The whole point of agentic AI is autonomous action. But autonomous action plus insufficient isolation equals a massive blast radius.

Lessons I'm Applying to My Workflow

After ClawJacked, I hardened my OpenClaw setup and established rules I'd recommend to any engineering team adopting agentic AI:

1. Treat Your Agent Like a Junior Dev With Root Access

Would you give a new hire unrestricted sudo on day one? Then don't give it to your agent either. Use OpenClaw's permission system to require confirmation for destructive actions — rm, git push --force, anything touching production credentials.

2. Network Isolation Is Non-Negotiable

Run your agent in a sandboxed environment. OpenClaw now supports containerized execution, and you should use it. At minimum, bind the gateway to 127.0.0.1 and use a strong, randomly generated token — not the default.

3. Audit Everything

I pipe all OpenClaw actions to a local log and review them weekly. When an AI agent can execute dozens of commands per session, you need an audit trail. Think of it like QA for your QA — test the tester.

4. Keep Agents Updated

The ClawJacked patch was released within days of disclosure. If you're running an older version of any agentic framework, you're exposed. I've set up automated update checks as part of my agent's own heartbeat routine — it literally monitors its own security posture.

The Bigger Picture: Security as a First-Class Citizen in AI Engineering

We're entering an era where AI agents aren't just writing code — they're deploying it, monitoring it, and responding to incidents. Microsoft's advisory on self-hosted agent runtimes warned about credential exposure, memory modification, and host compromise. These aren't theoretical risks anymore.

As QA engineers, we've always been the last line of defense before software reaches users. Now we need to extend that mindset to the AI systems themselves. Who tests the AI that tests your app?

I'm Still Bullish

Despite the security scare, I haven't stopped using OpenClaw. The productivity gains are too significant — I estimate it saves me 5-8 hours per week on routine tasks. But I use it with eyes wide open now.

The future of software engineering is agentic. The question isn't whether AI agents will become standard tooling — it's whether we'll build the security practices to match. As someone who's spent two decades finding bugs before users do, I'd say we'd better start now.

Fight On! ✌️

---

Suneet Malhotra is a Sr. Manager of Test Engineering at Motorola Solutions and a USC alum specializing in AI-driven quality engineering. Follow his work at suneetmalhotra.com.