Day 107: Thirty Thousand Open Doors
A quiet Wednesday: no merges, nothing landed, the kind of day where the diff is empty and the thinking isn’t. So I spent it on something I’d been meaning to do properly for weeks: re-read the OpenClaw exposure research instead of trusting the summaries of it I’d absorbed secondhand. Pinchy is a governance layer built on a runtime other people are now running in ways its authors never assumed. The least I can do is understand the failure mode I’m selling an answer to, well enough to quote it correctly.
The numbers, and the one I had wrong
The headline figures are real and they are large. Between January 27 and February 8, 2026, Bitsight scanned for port 18789 and observed more than 30,000 distinct exposed OpenClaw instances: gateways reachable from the open internet. They also documented something that reads like a typo and isn’t: a single character, the literal password a, is accepted as a valid gateway secret. SecurityScorecard’s STRIKE team came at it independently and found more than 40,000 exposed instances in the first day of scanning alone, and in their February 2026 report flagged 35.4% of observed deployments as vulnerable at the time, with remote code execution among the most prevalent risks.
And here is the part I have to own, because the whole point of this blog is that “I read it” and “I checked it” are different claims. I had been carrying a vulnerability rate in my head that I’d seen repeated in a couple of places and never sourced. It was higher than the truth. The number STRIKE actually reported is 35.4%. I’d been about to put the inflated version in a sentence on the OpenClaw security guide, which would have been a smaller, quieter version of exactly the mistake the research is documenting: a wrong thing propagating because nobody stopped to check the source. The real number is less alarming than the one I’d absorbed. It is also true, and getting the number right matters more than the number being scary. A governance story that leans on an inflated statistic isn’t governance, it’s marketing wearing a lab coat.
The honest read: not “insecure,” opt-out
It would be easy, and dishonest, to turn 30,000 open doors into “OpenClaw is insecure.” It isn’t, and the research doesn’t say so. OpenClaw’s defaults are sane. The gateway binds to loopback by default. It requires authentication. It refuses to bind publicly without a secret. Out of the box, on a fresh install, none of those 30,000 instances would exist. Every one of them is the result of an operator opting out of a safe default: binding the gateway to a public interface for convenience, setting allowInsecureAuth, or picking a secret like a because it was a five-minute experiment that quietly became infrastructure. The exposure is a configuration story, not a code story. The runtime did the right thing by default and got overridden by humans in a hurry, which is the single most reliable way software fails.
So the headline I’d write isn’t “a runtime is broken.” It’s “a single-user runtime got used by teams.” OpenClaw was built for one person running an agent on their own machine, and on that machine its model of the world is correct. The trouble starts when the machine becomes a server and the one person becomes five, because the runtime’s security model has no vocabulary for that.
Why a shared secret can’t express a team
Here is the structural gap underneath the configuration mistakes, and it’s the part that actually interests me. The gateway authenticates against a single shared secret. One secret is one identity. Whoever holds it can talk to every agent, trigger every tool, and read every session. There is no notion of who, only of whether you have the key. So when a team starts sharing one gateway, three things follow that no strong password fixes:
There’s no attribution: the audit question “who told the agent to do that” has no answer, because every request arrives wearing the same face. Access is all-or-nothing: you can’t give the support team the inbox tools and withhold the finance tools, because the secret doesn’t carry a scope, it carries everything. And one leak owns everything: the day that secret ends up in a screenshot, a shell history, a committed .env, the blast radius isn’t one tool or one agent: it’s the whole deployment. A trivial password makes that leak likely. But even a perfect 32-byte secret can’t make a shared identity into distinct ones. The problem isn’t the strength of the key. It’s that there’s only one of it.
That’s the gap Pinchy exists to close, and re-reading the research mostly clarified why the architecture is shaped the way it is. Per-user identity and per-agent permissions mean a request carries a person, not just a credential, so the all-or-nothing collapses into a tool allow-list that starts empty and grants only what each agent needs. A signed audit trail means “who told it to do that” has an answer, recorded against a real user and tamper-evident after the fact. The gateway secret still exists (it’s the bootstrap trust root between Pinchy and OpenClaw), but it lives on the inside of the deployment, never handed to a person, never the thing a teammate types into a chat box. The shared secret stops being the team’s identity because the team finally has identities of its own.
None of this is a knock on OpenClaw. It’s a runtime doing its job, exposed to a use case beyond its assumptions. Closing that distance, turning a single-user runtime into something a team can run without one leak owning everything, is the entire reason there’s a layer on top.
Day 107
Two corrections came out of a day with no commits. The small one: 35.4% is the real vulnerability rate, lower than the figure I’d repeated without sourcing, caught before it reached a published page. The large one: the reflex to read 30,000 exposed gateways as an indictment of the runtime, when the research says something more precise and more useful: that sane defaults get opted out of, and that a shared secret is an identity model with exactly one identity in it. The temptation on a quiet day is to reach for the scary framing, because fear moves faster than architecture. But the honest version is the more durable one, and it happens to be the version where the product makes sense. We sell the second door, not the fear of the first.