China cyber emergency center flags security risks in AI agent OpenClaw

Alert

The National Computer Network Emergency Response Technical Team/Coordination Center of China (国家计算机网络应急技术处理协调中心, CNCERT/CC) on Tuesday issued a risk alert about the AI agent software OpenClaw. It has been reported that OpenClaw — a tool that lets users control computers through natural‑language commands — has gained rapid popularity among developers and hobbyists, and CNCERT/CC warned that convenience can come with new attack surfaces.

Risks and guidance

CNCERT/CC reportedly highlighted a range of potential threats: misuse of privileged access, unintended execution of arbitrary commands, data exfiltration, and the possibility of agents being chained for lateral movement inside networks. The agency urged immediate mitigations — run agents in strict sandboxes, restrict network and system privileges, disable remote execution features where unnecessary, maintain up‑to‑date software, and monitor logs for anomalous behavior. How do you trust a piece of software that types for you? The guidance is blunt: treat AI agents like any code that can act on your infrastructure.

Why this matters

CNCERT/CC is China’s national computer emergency response team; it coordinates responses to cyber incidents and issues advisories to enterprises, government bodies and the public. The alert comes amid broader regulatory pressure in China to tighten controls on software, data flows and AI deployment — and against a backdrop of international technology friction, export controls and sanctions that complicate hardware access and increase emphasis on software security. For Western readers: this is not merely a technical bulletin. It signals Beijing’s continuing move to assert control over rapidly proliferating AI tools that touch sensitive data and critical systems.

What next

It has been reported that OpenClaw’s developer has not yet issued a detailed public fix addressing CNCERT/CC’s points, and security teams are being advised to apply the recommended mitigations immediately. Enterprises and developers should assume AI agents could be attack vectors until proven otherwise — and treat them with the same operational rigour they apply to other remote‑execution tools. The debate over convenience versus control in AI is only getting louder.