What Does the Claw Tracker AI Surveillance Scandal Mean for User Trust?

Call it the Claw Tracker story, or call it what it actually is: the same AI-agent privacy failure showing up under a new name every few weeks. The specifics keep changing, a leaked database here, an unsecured dashboard there; but the shape of the problem hasn't moved in months, and neither has the industry's response to it.

Start with what is verified. CVE-2026-25253 affected OpenClaw versions before 2026.1.29 and carried a vendor/CNA CVSS score of 8.8. Exploitation required an already-authenticated user to open attacker-controlled content; it was not a passive attack against every internet-exposed panel. Separately, a February 2026 SecurityScorecard scan reported approximately 42,900 internet-reachable OpenClaw control panels across 82 countries, with about 15,200 appearing vulnerable to remote code execution. Exposed, vulnerable, and compromised are not interchangeable categories.¹²³

What actually got exposed

The control-panel scan was not the only incident. In a separate disclosure, Wiz reported that Moltbook, a social platform in the wider agent ecosystem, exposed a misconfigured database containing approximately 35,000 email addresses, private messages, and 1.5 million API-token records. The disclosure did not establish that every token was unique, current, and exploitable. Platform agent counts circulating at the time were self-reported and should not be treated as audited breach statistics.⁴

The skills registry was a third distinct incident. Koi Security reported that a one-time audit in early February 2026 found 341 malicious skills among 2,857 on ClawHub, most tied to a single campaign. That is a dated marketplace snapshot using the researcher's classification method, not the current proportion of every available skill.⁵

A Northeastern University cybersecurity researcher summed up the underlying issue bluntly, calling agents like OpenClaw "a privacy nightmare"; not because any single exploit was novel, but because the agent's whole value proposition depends on broad, standing access to a person's accounts and files.

Anthropic's answer was about cost, not trust

Secondary reports describe an April 2026 Anthropic change that moved third-party harness use, including OpenClaw, outside Claude subscription limits and into metered billing. I did not locate an official Anthropic notice confirming the exact date and mechanics, and no primary source connected that billing change to the OpenClaw security incidents. It should be treated as a separately reported cost-policy issue, not the industry's security response.

I'd argue that's the tell. When the AI industry's instinct under scrutiny is to reach for pricing tiers before reaching for access controls, it's telling you something about where user trust sits on the priority list. Every one of the failures above, the exposed control panels, the leaked tokens, the poisoned skills; traces back to the same design choice: give the agent broad standing access first, and figure out the guardrails later, in public, after something breaks.

What user trust actually requires

None of this is unfixable, and none of it requires abandoning agentic AI. It requires treating access like the liability it is. A short list of what that looks like in practice:

• Scoped, revocable credentials instead of standing tokens that outlive the session that created them
• Default-closed control panels and dashboards; authentication on by default, not bolted on after a CVE
• Skill and plugin registries that are actually vetted before publication, not audited retroactively by outside researchers
• Public incident response that addresses the security failure directly, separate from any unrelated pricing announcement

The companies that get this right won't be the ones with the flashiest agent demos. They'll be the ones whose users never have to wonder whether their calendar, inbox, and file system are sitting behind an unauthenticated dashboard in a research disclosure they haven't read yet. That's the actual competitive advantage here, not features, not speed to market. Whether a user can trust the thing with access to their life. Right now, the honest answer across most of this ecosystem is: not yet, and not by design.