Ministry of Industry and Information Technology NVDB: "Six Do's and Six Don'ts" Recommendations on Preventing Security Risks of OpenClaw ("Lobster") Open-Source Intelligent Agents

Ministry of Industry and Information Technology: Recommendations for preventing security risks of the OpenClaw (“Lobster”) open-source agent with “Six Dos and Don’ts.” (1) Use the official latest version. Download the latest stable version from official channels and enable automatic update reminders; back up data before upgrading, restart services after upgrading and verify that the patches are effective. Do not use third-party mirror versions or historical versions. (2) Strictly control internet exposure. Regularly self-check for any internet exposure; once discovered, take it offline for rectification immediately. Do not expose “Lobster” agent instances to the internet; if internet access is necessary, use encrypted channels such as SSH, restrict access source addresses, and utilize strong passwords or certificates, hardware keys, and other authentication methods. (3) Adhere to the principle of least privilege. Grant the minimum permissions necessary to complete tasks based on business needs, and require secondary confirmation or manual approval for important operations like deleting files, sending data, or modifying system configurations. Prioritize running in isolated containers or virtual machines to create independent permission zones. Do not use administrator accounts during deployment. (4) Use the skill market cautiously. Be prudent when downloading ClawHub “skill packages,” and review the code of the skill packages before installation. Do not use skill packages that require “download ZIP,” “execute shell scripts,” or “enter passwords.” (5) Prevent social engineering attacks and browser hijacking. Use browser sandboxes, web filters, and other extensions to block suspicious scripts, enable log auditing functions, and disconnect the gateway and reset passwords immediately upon encountering suspicious behavior. Do not browse unfamiliar websites, click on strange web links, or read untrusted documents. (6) Establish a long-term protection mechanism. Regularly check and patch vulnerabilities, and stay updated on risk alerts from OpenClaw’s official security announcements, the Ministry of Industry and Information Technology’s cybersecurity threat and vulnerability information sharing platform, and other vulnerability databases.