When Is It Safe to Give an AI Agent Access to Your Computer?
Short answer: once you know where a tool runs, what it can install, and whether it's reachable from outside your machine, you can tell how much risk you're actually taking on. Here's what broke in the worst AI-agent security incident of 2026 — and the three questions that tell you whether a given tool is built to avoid the same mistakes.
Direct answer
It's safe to give an AI agent access to your computer once three things are true: it runs on your machine rather than someone else's server, it can't install third-party "skills" or plugins from an open marketplace, and it isn't reachable from the public internet by default. Get those three right, and you've closed off the mechanisms that actually cause damage — not a vague sense of "AI is risky."
The worst AI-agent security failure of 2026, the OpenClaw incidents, happened because all three were missing at once. That's a useful case study precisely because the failures were so specific and avoidable, not because agents in general are unsafe.
What actually went wrong with OpenClaw
OpenClaw is a free, self-hosted AI agent framework, and between January and April 2026 it had a rough run. It's worth knowing the specifics, because "AI agents can be dangerous" is vague — the actual failure modes are not.
- 135,000+ OpenClaw instances found publicly exposed on the open internet, reachable by anyone
- 341 of 2,857 "skills" in its public plugin marketplace — about 12% — turned out to contain malware like keyloggers and credential stealers
- 8.8 CVSS severity score (out of 10) on a one-click remote-code-execution vulnerability found in the platform, later catalogued as CVE-2026-25253
The most concrete incident, nicknamed the "Moltbook Leak" (February 2026), involved data exfiltrated through exactly this combination: an exposed instance, a malicious skill, and no barrier stopping it from reaching real files. None of these were exotic attacks — they were the predictable result of an agent framework built around a public plugin marketplace and default settings that left instances discoverable online. (For the full mechanics of why the exposure kept recurring even after 40+ patches, see why OpenClaw's agents keep getting hacked — this piece focuses on the general questions any tool should have to answer, not just OpenClaw's specific timeline.)
Most agent security failures aren't exotic hacks — they're an open door left where anyone can find it.
The three questions that tell you when a tool is safe
"Is AI safe?" is too broad to answer — it depends entirely on the tool. Ask these three questions about any specific one instead, and you'll know where you stand:
Where does it run? An agent that runs locally on your machine has no server in the middle that can be breached, scraped, or subpoenaed. One that routes your files through someone else's cloud adds a second place things can go wrong — their infrastructure, not just yours.
Can it install code from strangers? A public plugin or "skill" marketplace is a supply chain, and supply chains get poisoned — that's what happened to 12% of OpenClaw's. If a tool can only do what it's told directly in plain English, there's no marketplace to poison.
Is it reachable from the internet by default? 135,000 exposed OpenClaw instances didn't get found by sophisticated attackers — they got found by routine internet scanning, the same kind that finds any unsecured server. A tool with no listening server to scan has nothing to find.
How bots.team is built differently
We build bots.team as a local orchestrator: each bot is a scheduled session that runs on your own Mac or Windows machine, not a process on a bots.team server watching your files remotely. There's no bots.team-hosted server holding your data, and no public third-party skill or plugin marketplace to install from — a bot does what you described to it in plain English, nothing it downloaded from someone else's listing.
To be direct about what this does and doesn't mean: it doesn't make every use of an AI agent risk-free, and it's not a claim that OpenClaw's specific vulnerabilities exist in our code — they don't, because the architecture is different. It means the three mechanisms above, which caused OpenClaw's actual incidents, aren't present to begin with. Bots still call out to Anthropic's Claude to do their reasoning, the same way OpenClaw calls out to whichever model it's configured for — that outbound connection isn't the thing at risk here. What's different is the inbound side: nothing is listening for someone else to connect in.
| Risk factor | What went wrong at OpenClaw | bots.team's approach |
|---|---|---|
| Where it runs | Self-hosted, often exposed to the public internet by misconfiguration | Runs locally on your machine; no bots.team server holds your files |
| Installing new capability | Public marketplace of 2,857 "skills" from any developer | No third-party plugin marketplace — you describe the job, the bot does it |
| Attack surface | A CVSS-8.8 remote-code-execution bug reachable by anyone who found an instance | No public-facing server component to exploit |
The instruction is the whole interface — no plugin to install, no marketplace to vet.
What to actually check before you say yes to any AI tool
This isn't specific to us — it applies to any agent, assistant, or "AI employee" product you're evaluating:
- Ask what it can reach, not just what it can do. "Reads your email" and "reads your email and can also install anything a plugin author wrote" are very different risk profiles.
- Ask where your data lives while it's working. On your disk, or copied to a server you've never heard of?
- Ask what happens if the vendor's server goes down or gets breached. If the answer is "nothing, because there isn't one," that's a real answer, not marketing.
- Look for a scoped, describe-it-once instruction model over a marketplace model. The more a tool depends on installing code from other people, the more its safety depends on every one of those other people.
None of this means "local" automatically means "safe" — a locally-run agent with careless file permissions can still do damage. The point is narrower: the specific failure that took down OpenClaw (public exposure + poisoned marketplace + exploitable server) requires ingredients that a local, marketplace-free design simply doesn't have.
Quick answers
What is OpenClaw? A free, self-hosted framework for running autonomous AI agents. It had a cluster of serious security failures in early 2026, including mass public exposure of user instances and malware hidden in its plugin marketplace.
Does "AI agent" always mean the same security model? No. "Agent" describes what a tool does (acts autonomously toward a goal), not how it's built. Two agents can have completely different exposure to the risks above depending on whether they run locally, use a plugin marketplace, or expose a public server.
When is it safe to give an AI tool file access? When it passes the same due diligence you'd apply to any software that touches your files: you know where it runs, you know what it can install, and you know whether it's reachable from outside your machine by default. Most mainstream tools clear this bar easily — it's worth checking rather than assuming.
Could something like the OpenClaw incidents happen to a local-only tool? The specific mechanisms — public exposure of a hosted instance, a poisoned public plugin marketplace — require a hosted server and a plugin marketplace to exist in the first place. A tool without either doesn't remove all risk, but it removes those specific ones. bots.team's bots run on your own computer on a schedule you set, with no inbound listener waiting for a connection and no plugin marketplace to poison — the two ingredients that turned OpenClaw's exposure into an actual breach.