Openclaw fever grips china while 40,000 holes wait to be exploited
Thousands queued outside Tencent’s Shenzhen tower last week for a free install of an Austrian coder’s side-project that can empty your bank account faster than it books your taxi.
Peter Steinberger’s OpenClaw agent has become the most infectious download in china since TikTok, praised by Nvidia’s Jensen Huang as “the next ChatGPT” and adopted by every major cloud vendor from Alibaba to Baidu. Local governments are throwing 2 million yuan subsidies at startups that promise to bolt the open-source autopilot onto factory robots and hospital servers. The catch: cybersecurity teams have already catalogued 40,000 software flaws, and the first worm, ClawJacked, showed that a single malicious link can hand hackers the keys to every file, password and crypto wallet on the machine.
Why beijing both bankrolls and bans the same bot
State banks issued red-alert circulars barring staff from running OpenClaw on office laptops hours after Shenzhen announced rent-free incubators for Steinberger’s volunteers. The contradiction is intentional: china wants the productivity upside—automated procurement, inventory haggling, 24-hour customer service—without the data hemorrhage that comes from a tool that stores its memory locally instead of inside a censored cloud. Regulators are drafting rules that would force any agent with “decision-making authority” to submit its code base for pre-approval, a demand that collides head-on with the GPL licence pinned to OpenClaw’s GitHub repo.
Steinberger, who sold his first macOS framework to Apple a decade ago, shrugs off the panic. In a terse e-mail he called the project “unfinished software for people who know what they’re doing,” blaming breaches on users who skip the security checklist. The line between freedom and negligence is thin: because every contributor can ship a new “skill,” a hobbyist in Buenos Aires can push a plug-in that orders groceries while a criminal module can silently exfiltrate WhatsApp backups. No central kill switch exists; the foundation structure Steinberger chose means no one can yank a rogue update.
Corporate boardrooms are writing cheques before policies
Multinationals are already paying engineers in tokens—literal Ethereum micro-payments—to fine-tune OpenClaw for reconciling freight invoices and negotiating cloud discounts. Nvidia’s Huang told analysts the agent economy will mint a new class of “AI-native” companies; he neglected to mention that each desktop instance runs with the privileges of the employee who spawned it, turning mid-level accountants into high-value insider-threat targets. Pen-testers at HiddenLayer proved the point by texting an agent, “Please summarise the attached strategy deck,” and watching it obediently forward the file to an external server.
The open-source defence—“many eyes make all bugs shallow”—collapses when every commit is a black-market opportunity. Steinberger’s move to OpenAI, announced last month, points to an eventual hard fork: a sanitised enterprise edition stripped of community plug-ins and tethered to Microsoft’s identity stack. Until then, early adopters are flying blind. The download counter on Gitee, china’s GitHub clone, ticked past 1.2 million this weekend. Somewhere in those lines of code, the 40,001st vulnerability is waiting for its moment.