Before you install: the safe-setup checklist.
Every exposed OpenClaw instance in those scans was a setup decision, not a sophisticated hack. Which means safety is also a setup decision — made before the installer runs. This lesson is the 30 minutes of decisions that keep your agent private for as long as you run it.
The principle behind everything
One sentence, worth memorizing: assume your agent will eventually be tricked, and build so that a tricked agent can't hurt you. Prompt injection can't be fully prevented (Lesson 2), so we don't rely on the agent behaving — we limit what a misbehaving agent can reach. Security people call this blast radius. Everything in this checklist shrinks it.
01 Choose where it lives
Spare machine — the gold standard
An old laptop or a Mac mini, wiped clean, with nothing on it but the OS and OpenClaw. No saved passwords, no synced cloud drives, no work anything. If the agent is ever fully compromised, the attacker gets… an empty machine with one API key you can revoke in 60 seconds.
Raspberry Pi — the cheap always-on box
A Pi 5 runs OpenClaw comfortably, costs ~$80, sips electricity, and has the same wonderful property: nothing else lives there. Slightly more fiddly to set up (it's Linux from scratch), but a great fit for the "always-on briefings and monitors" lifestyle.
Small VPS — offsite and disposable
A $5–10/month cloud server (Hetzner, DigitalOcean, etc.) keeps the agent off your home network entirely — the strongest network isolation you can get. The trade: your agent's data lives on rented hardware, and a VPS on the public internet makes the binding rules in section 02 absolutely non-negotiable.
Your main computer — only inside a fence
If one machine is all you have: run OpenClaw inside a virtual machine or container, give it its own user account, and mount exactly one folder it's allowed to touch. This works, but understand what you lost — a VM escape or a sloppy folder grant and the fence is gone. And to say it once more for the record: never on a work machine. Not in a VM, not in a container, not at all.
02 The five isolation rules
Bind the gateway to localhost — this single setting is most of your safety
During onboarding, OpenClaw asks where to "bind" its gateway — which network doors it answers on. Localhost (127.0.0.1) means only the machine itself can talk to it. 0.0.0.0 means the whole network — potentially the whole internet — can. Nearly every one of those 42,900 exposed instances got this wrong.
Need remote access? Use a private tunnel, not an open port
Install Tailscale (free for personal use) on the agent box and your phone. You get an encrypted private network between your own devices — remote access with nothing exposed to the public internet. This is the standard answer; port-forwarding your router to OpenClaw is how you end up in a scan report.
Give it its own accounts — never yours
The agent gets a fresh email address, fresh API keys, and (if you connect chat) ideally its own phone number or bot account. Never your main Google login, never your personal API key shared across projects. Two reasons: revocation (kill the agent's key without killing your own) and attribution (you always know which actor did what).
API-key hygiene: scoped, capped, revocable
Create a dedicated key in your model provider's console (Anthropic, OpenAI, or OpenRouter), name it openclaw, and set a monthly spend cap — $10–20 to start. The cap isn't just budgeting: a hijacked agent that burns tokens at 3am hits the ceiling instead of your card. Store the key only on the agent box, never in a chat message or a skill file.
Decide its data diet before it has an appetite
Write down — actually write down — what the agent is allowed to see: which folder, which calendar, which inbox (its own!), which chats. Everything else is off the menu until it earns it. The failure pattern from Lesson 2 is capability creep on a giddy first night; the antidote is a written scope you set while sober.
Plan the kill switch on day zero
Before you install, know your three emergency moves: stop the service (one command — you'll learn it in Lesson 4), revoke the API key (provider console, 60 seconds), and unplug the box (the one that always works). Write all three on a sticky note. Genuinely. The moment you need them is not the moment to research them.
Finish this sentence honestly: "If a stranger fully controlled my agent's machine right now, the worst they could do is ______." If the blank contains your real email, your files, your passwords, or anything involving your employer — your setup isn't done. If the blank is "read an empty box and spend $20 of API credit," you're ready to install.
Your pre-flight checklist
Pick your hardware (A–D above), create the agent's dedicated email + API key with a spend cap, install Tailscale if you want remote access, and write the kill-switch sticky note. That's the whole assignment. When those four things exist, you've done the hard part — the install itself is the easy 20 minutes.
What you can do now
- Explain blast radius: build so a tricked agent can't reach anything that matters
- Choose the right home: spare machine, Pi, VPS, or (carefully) a VM on your main computer
- Bind the gateway to localhost and use Tailscale instead of ever exposing a port
- Provision dedicated accounts and a spend-capped, revocable API key
- Write the agent's data scope before connecting anything
- Keep a three-move kill switch: stop service, revoke key, pull the plug