63% of Publicly Exposed OpenClaw Instances Run Without Any Authentication

A large scan of publicly exposed OpenClaw instances found that 63% were running with no authentication at all, according to research published by Blink. The finding matters because it means anyone who can reach those systems over the internet can interact with them without first proving who they are.

The research covered 135,000 OpenClaw instances that were publicly reachable. Blink’s report says nearly two-thirds of them did not have any authentication layer in place, leaving them open to direct access rather than protecting them behind a login, token, or other access control.

OpenClaw is used to build and run AI automation systems, so an exposed installation can sit in a sensitive position. These systems often connect to internal services, APIs, credentials, data stores, and workflow tools. If authentication is missing, the application itself becomes the first line of exposure.

That risk becomes more serious when software bugs can be triggered remotely. Blink’s report ties the exposure rate to critical April CVEs, which are Common Vulnerabilities and Exposures, the standard identifiers used to track known security flaws. According to the summary, those vulnerabilities are remotely exploitable with zero credentials when an instance is public and unauthenticated.

A remotely exploitable bug is one that can be attacked over the network, without local access to the machine. In practical terms, that means an attacker does not need to log in to the host, plug into the network, or otherwise get physical access. If the vulnerable service is reachable on the internet, the exploit path can begin from anywhere.

The scale of the scan suggests this is not a niche misconfiguration. A finding spread across 135,000 instances implies a broad pattern in how OpenClaw deployments are being set up, especially in self-hosted or test environments that later get exposed publicly. Security teams often see this pattern with new tools that are easy to deploy but are left with default or minimal access controls.

This also highlights a common problem in AI and automation platforms. Teams may focus on what the system can do, such as triggering workflows, calling models, or integrating with other services, and overlook the basic question of who is allowed to reach it. If the answer is “anyone on the internet,” then the rest of the security stack has to absorb far more risk.

For operators, the report is a reminder that internet exposure changes the threat model immediately. A system that was acceptable on a private lab network can become a target as soon as it is exposed on a public IP address or through a proxy without access controls.

Blink’s findings put a number on that gap, and the number is large enough to suggest a widespread operational issue rather than isolated mistakes. The report lands alongside the April CVEs because public exposure and missing authentication can turn a software flaw into a direct attack path, with no login barrier between the attacker and the instance.