Security crisis, supply-chain attacks, and operational exposure

Malicious skills, exposed panels, credential theft, persistent-memory payloads, agent escapes, browser-session exposure, and unsafe recovery paths continue to indicate systemic OpenClaw risk. New guidance reinforces immutable, identity-bound approvals, reconciliation of unknown outcomes, explicit consent for existing browser sessions, and ownership-aware Gateway recovery; key vulnerability reports remain poorly documented.