OpenClaw is the fastest-growing AI agent framework in GitHub history — and it's actively compromised. A CVSS 8.8 vulnerability allows one-click remote code execution with no authentication required. Over 40,000 instances are exposed to the public internet, 35.4% are flagged vulnerable, and 12% of the ClawHub skill registry was weaponized with keyloggers and credential stealers. Authentication is disabled by default. If you deployed OpenClaw in the last three months, this guide tells you exactly what to check before it's too late.