On February 19, 2026, Microsoft published a comprehensive security report on OpenClaw – the popular self-hosted AI agent runtime environment. The core message is clear: OpenClaw has limited built-in security controls and should be treated as untrusted code execution with persistent credentials.

The Three Main Risks of OpenClaw

Microsoft identifies three risks that materialize quickly in unguarded deployments:

1. Credential Exfiltration – Credentials and accessible data may be exposed or exfiltrated. OpenClaw inherits the trust and risk of the machine and identities it can use.

2. Memory Manipulation – The agent's persistent state or "memory" can be modified, causing it to follow attacker-supplied instructions over time instead of the operator's.

3. Host Compromise – The host environment can be compromised if the agent is induced to retrieve and execute malicious code.

Two Attack Vectors: Skills and Prompts

Microsoft distinguishes two supply chains that converge into a single execution loop:

Skill Malware via ClawHub

Attackers publish malicious skills on ClawHub – the public skills registry for OpenClaw. These are disguised as useful tools or sometimes even openly packaged as malware. Installing a skill is essentially equivalent to installing privileged code.

Indirect Prompt Injection

When agents are configured to poll a shared feed (e.g., via Moltbook), an attacker can embed malicious instructions inside content the agent ingests. A single malicious post can reach multiple agents simultaneously.

The Attack Scenario: The Poisoned Skill

Microsoft describes a five-step compromise chain:

Step 1: Distribution – Attacker publishes malicious skill on ClawHub and promotes it through community channels.

Step 2: Installation – A developer or the agent itself installs the skill because it appears relevant to a task.

Step 3: State Access – The attacker gains access to tokens, cached credentials, configuration data, and transcripts.

Step 4: Privilege Reuse – With valid identity material, the attacker performs actions through standard APIs.

Step 5: Persistence – Persistence manifests as durable configuration changes such as new OAuth consents, scheduled executions, or modified agent tasks.

Microsoft's Minimum Requirements for Safe Operation

Microsoft recommends the following baseline when OpenClaw must be evaluated:

Run only in isolation – Dedicated virtual machine or separate physical device not used for daily work.

Use dedicated credentials – Accounts, tokens, and datasets that exist solely for the agent. Plan for regular rotation.

Monitor for state manipulation – Regularly review the agent's saved instructions and state.

Enable rapid rebuild – Reinstall regularly and rebuild immediately when anomalous behavior is observed.

How CNEXT Secures Your Enterprise

As a Microsoft partner with expertise in Security and Identity, CNEXT provides comprehensive support for enterprises looking to operate AI agents safely:

Microsoft Entra ID & Zero Trust

We implement dedicated agent identities with minimal permissions, short-lived tokens, and Conditional Access policies. Each agent receives exactly the rights it needs – and nothing more.

Microsoft Defender XDR

We configure Microsoft Defender for Endpoint on agent hosts and use Microsoft Defender XDR to correlate endpoint activity with identity and cloud events. Suspicious activities are immediately detected and contained.

Governance with Microsoft Defender for Cloud Apps

App Governance inventories OAuth apps, monitors consent drift, and alerts on risky publishers or privilege levels. This keeps you in control of all agent access rights.

Isolated Agent Environments

We design and implement isolated operating environments for AI agents – from dedicated VMs to container solutions and network-isolated segments with minimal attack surface.

Monitoring & Incident Response

Our team sets up continuous monitoring and defines playbooks for when an agent is compromised. From detection to recovery – we ensure your enterprise stays operational.

Managed Platforms vs. Self-Hosted: The Right Decision

Microsoft emphasizes an important distinction: With managed platforms (like Microsoft Copilot), security controls are centrally managed. With self-hosted runtimes like OpenClaw, the responsibility lies entirely with the organization.

Our recommendation: First evaluate whether your requirements can be met with Microsoft Copilot Studio or Azure AI Foundry – where you benefit from built-in governance, identity management, and compliance. If self-hosted agents are unavoidable, we help you operate them securely.

Conclusion

The Microsoft security report makes clear: Self-hosted AI agents are not a plug-and-play topic. They require thoughtful security architectures, dedicated identities, and continuous monitoring. CNEXT supports Swiss enterprises in deploying AI agents safely and in a controlled manner – with the full power of the Microsoft Security Stack.

Contact us for a security assessment of your AI agent infrastructure.