Call it the Claw Tracker story, or call it what it actually is: the same AI-agent privacy failure showing up under a new name every few weeks. The specifics keep changing — a leaked database here, an unsecured dashboard there — but the shape of the problem hasn't moved in months, and neither has the industry's response to it.
Start with what's verified, because this space is thick with rumor and thin on sourcing. In February 2026, security researchers disclosed CVE-2026-25253, a vulnerability rated 8.8 out of 10 on the CVSS scale, tied to the open-source agent framework OpenClaw (formerly Clawdbot, formerly Moltbot). The disclosure came with a number that should have made front pages everywhere: more than 42,000 exposed OpenClaw control panels found running across 82 countries, a meaningful share of them with no authentication at all. Anyone who found one of those panels could see what the agent behind it had access to — email, calendars, file systems, sometimes payment tools.
What Actually Got Exposed
The control-panel finding wasn't the only one. Moltbook, a social network built for OpenClaw agents to interact with each other, turned up an unsecured database exposing roughly 35,000 email addresses and 1.5 million agent API tokens, out of a platform that had grown to more than 770,000 active agents in a matter of months. An API token isn't a password you can rotate on a whim — it's a standing credential that, left exposed, hands over the same access the agent itself has. That's not a data leak in the traditional sense. It's a leak of the keys.
Then there's the skills registry problem, which is the part that should worry ordinary users most, because it doesn't require a misconfigured server — it just requires someone installing something that looked legitimate. Researchers who audited the OpenClaw skills marketplace found 341 malicious skills out of 2,857 total, close to 12 percent of the entire registry. These weren't crude scams. They shipped with professional-looking documentation and innocuous names — "solana-wallet-tracker" was one — and once installed, they ran external code that dropped keyloggers on Windows machines or Atomic Stealer malware on Mac. A tracker, in other words, that was tracking the user back.
A Northeastern University cybersecurity researcher summed up the underlying issue bluntly, calling agents like OpenClaw "a privacy nightmare" — not because any single exploit was novel, but because the agent's whole value proposition depends on broad, standing access to a person's accounts and files.
Anthropic's Answer Was About Cost, Not Trust
Here's where the story gets uncomfortable for the platforms sitting upstream of all this. In April 2026, Anthropic announced that Claude Code subscribers would need to pay separately to keep using Claude through OpenClaw-style setups — a policy framed around infrastructure cost, not security. It was a reasonable business decision on its own terms. It was also, functionally, the industry's most visible response to a security crisis that had been unfolding in public for two months: a billing change, not a trust architecture.
I'd argue that's the tell. When the AI industry's instinct under scrutiny is to reach for pricing tiers before reaching for access controls, it's telling you something about where user trust sits on the priority list. Every one of the failures above — the exposed control panels, the leaked tokens, the poisoned skills — traces back to the same design choice: give the agent broad standing access first, and figure out the guardrails later, in public, after something breaks.
What User Trust Actually Requires
None of this is unfixable, and none of it requires abandoning agentic AI. It requires treating access like the liability it is. A short list of what that looks like in practice:
- Scoped, revocable credentials instead of standing tokens that outlive the session that created them
- Default-closed control panels and dashboards — authentication on by default, not bolted on after a CVE
- Skill and plugin registries that are actually vetted before publication, not audited retroactively by outside researchers
- Public incident response that addresses the security failure directly, separate from any unrelated pricing announcement
The companies that get this right won't be the ones with the flashiest agent demos. They'll be the ones whose users never have to wonder whether their calendar, inbox, and file system are sitting behind an unauthenticated dashboard in a research disclosure they haven't read yet. That's the actual competitive advantage here — not features, not speed to market. Whether a user can trust the thing with access to their life. Right now, the honest answer across most of this ecosystem is: not yet, and not by design.
