Part 7: Security and Cost Control

When people first install OpenClaw, they usually focus on what it can do. In practice, what determines whether you can keep using it safely is whether it stays under control.

01 Security Model

The security posture is best summarized as: default distrust.

DM pairing

Unknown users do not automatically get private access. By default, they receive a pairing code first and must be approved.

That helps defend against:

• unknown users burning your API budget
• unauthorized use of private workflows
• private chat channels turning into anonymous control surfaces

Group isolation

In groups, OpenClaw is more conservative by design:

• separate session per group
• no long-term private memory by default
• mention-triggered responses are the safer default

Tool access controls

Common controls include:

Mandatory authentication

From v2026.3.7, Gateway authentication must be configured explicitly:

{
  "gateway": {
    "auth": {
      "mode": "token",
      "token": "your-secret-token"
    }
  }
}

That is one of the clearest signs that “default open exposure” is no longer treated as acceptable.

02 Security Incidents You Should Know

CVE-2026-25253

The important implication is that this was not a minor information leak. It was a command execution issue.

ClawHavoc

This is the major supply-chain incident discussed earlier in the Skills section. It is still one of the most important examples of why you should not blindly trust marketplace content.

Anthropic OAuth enforcement

This is not a classical software vulnerability, but it is a real operational risk. Users relying on OAuth-style subscription bridging faced warnings or account action, which is why API-key workflows are now the safer recommendation.

Google-related account lockouts

Heavy use of Gmail and Google-linked Skills can interact badly with platform abuse detection. That makes account segmentation and careful rate control important.

Publicly exposed unauthenticated instances

One of the biggest practical dangers was that many instances were simply reachable from the public internet without meaningful access control.

03 Why Costs Can Spiral

OpenClaw does not burn tokens like a normal one-turn chat app. It can:

• reason across multiple turns
• call several tools in one workflow
• keep memory and logs in play
• run continuously in the background
• trigger scheduled tasks

That means apparently small automations can generate surprisingly large model bills.

In the worst cases, users have gone to sleep with everything looking normal and woken up to bills in the four-figure range.

04 Fallback Chains: The Most Important Cost Tool

Fallbacks are one of the best cost levers you have.

{
  "agents": {
    "defaults": {
      "model": {
        "primary": "anthropic/claude-sonnet-4-6",
        "fallbacks": [
          "anthropic/claude-haiku-4-5",
          "deepseek/deepseek-chat"
        ]
      }
    }
  }
}

Relative cost intuition

For many users, Sonnet -> Haiku -> DeepSeek is already a very strong baseline.

05 Budget Caps

Fallbacks help, but budgets are the hard guardrail.

{
  "agents": {
    "defaults": {
      "budget": {
        "maxTokensPerDay": 500000,
        "maxCostPerDay": 5.0
      }
    }
  }
}

Even if your budget is not tight, this protects you from runaway loops and bad automation behavior.

06 Low-Cost and Free Approaches

Local models

If you have enough memory, local models can comfortably handle:

• heartbeat tasks
• scheduled jobs
• lightweight Q&A
• some tool-oriented workflows

Server costs are often secondary

For many users, server cost is now relatively small. The bigger long-term driver is model usage design.

A practical mixed strategy

One solid pattern is:

• hard tasks: Claude Sonnet
• daily work: DeepSeek-V3
• heartbeat / cron: Gemini Flash or local Ollama
• budget caps enabled
• fallbacks configured

07 Minimum Production Checklist

If you want to run OpenClaw seriously, do at least this:

1. expose network access only when necessary
2. enable Gateway authentication
3. keep groups mention-triggered by default
4. restrict high-risk tools
5. review third-party Skills before install
6. configure fallbacks
7. set a daily budget
8. separate critical accounts from experimental automation

OpenClaw can absolutely be useful in production-like workflows, but only if you treat it as a real system with real blast radius.