Unauthorized by Design: How OpenClaw Exposes the Gap Between Agentic AI and U.S. Computer Law

By Pranav Verma '29

---

In January 2026, developer Peter Steinberger posted a short video of an AI agent named Clawdbot booking a flight and rearranging files on a computer without human intervention. Within a week, the project had received 85,000 stars on GitHub, the code collaboration platform. (1) Anthropic, the company behind Claude, sent a legal request to Steinberger to change its name, and so it was rebranded as Moltbot, and just two days later, OpenClaw. (2)

In several days, SecurityScorecard, a cybersecurity platform, had discovered over 135,000 OpenClaw instances online, of which over 15,000 had full access to the user’s computer while being vulnerable to Remote Code Execution (RCE), which enables attackers to run arbitrary code on their system and control it. (3) Token Security, another cybersecurity platform, noted that nearly 22% of its enterprise customers had employees run OpenClaw on company machines, most without telling IT. (4)

These employees were not rogue actors. They were simply trying to finish their work faster, using a tool they had found online, on a device their employer owned, and logged into sensitive networks. They did not know how to secure the agent, much less that it was vulnerable by default. And worse, nobody had an answer for what law governed its actions. As it turns out, that is because the relevant statute was written in 1986 with a very different threat in mind. Due to inconsistent doctrines and the rising popularity of autonomous agents such as OpenClaw, Congress needs to develop new, targeted regulations rather than wait for the courts to improvise them.

How OpenClaw Works

OpenClaw is not a chatbot. Rather, it is an application on your desktop with full-system access. When connected to an external large language model (LLM), such as ChatGPT, Claude, or local-hosted options such as Llama, OpenClaw provides specialized tools that allow the LLM to perform effectively any action on your computer. It takes instructions through messaging platforms such as WhatsApp or Telegram and can act upon them without the user re-engaging, leaving the LLM in an active “loop.”

It also retains memory between sessions, from long-term facts to daily notes and (optionally) dreams (summaries), by writing and storing notes as Markdown files on the host’s device. That is where the legal complications begin. A technique called prompt injection works by secretly embedding commands into content the AI would process, such as a webpage. These malicious instructions can sit in an agent’s memory for days and trigger without a cue. While other attacks, such as SQL injection, can be mitigated as they take advantage of bugs in the code, prompt injection is more difficult to manage as large language models cannot reliably separate the content they should read from the instructions they should follow. After all, it is effectively impossible to capture all possible malicious prompts, and the models themselves are nondeterministic. The UK’s National Cybersecurity Centre has stated that prompt injection is a “residual risk” that will probably never be entirely diminished. (5)

Additionally, three vulnerabilities in OpenClaw were documented in early 2026. CVE-2026-25253, the most serious, allowed an attacker to steal an authentication token, a credential that proves to a system who you are, to spoof being the authorized user and run commands remotely on the user’s machine. (6) Security researchers also found CVE-2026-25157, which enabled command injection on macOS through a malformed file path, and CVE-2026-24763, which allowed attackers to break out of the Docker environment, a sandbox meant to isolate the application from the rest of the system. (7) Although patches were shipped on January 29, SecurityScorecard found that most instances were older, unprotected versions. (8) 

So, who is legally responsible when the agent performs a harmful action? The user never approved, nor was even aware of, the act. The attacker is anonymous. The developer had already mitigated the issue to the extent they could. The agent cannot be faulted since it is known to be nondeterministic and prone to adversarial attacks. Tort law demands a traceable act connected to an identifiable party, and prompt injection cases rarely supply either.

The Statute for WarGames

The House Judiciary Committee demanded that Congress pass a federal computer crime statute, pointing to the 1983 film “WarGames.” In the movie, a teenager nearly started a nuclear war by accidentally hacking into a military computer. (9) Thus, the Computer Fraud and Abuse Act (CFAA) became law in 1986.

The CFAA bars accessing a “protected computer” either “without authorization” or in a way that “exceeds authorized access.” (10) A 1996 amendment stretched “protected computer” to cover any device connected to the Internet. (11) Since it now covers virtually all electronics, including those hosting OpenClaw instances, the next step was to define “without authorization.”

The Supreme Court would have an opportunity to interpret “without authorization” in Van Buren v. United States (2021). A Georgia police sergeant was bribed to search for a license plate in the police database and was apprehended by the FBI. The prosecution argued that the sergeant should not be allowed to utilize his employer’s system for personal gain. However, the defense noted that breaking any Terms of Service or employer policy would then be a federal crime. Thus, the Court held, 6-3, that exceeding authorized access meant entering an off-limit system, not misusing legitimate access. (12) Justice Barrett referred to this as the “gates-up-or-down” test. (13) 

This ruling left the “without authorization” prong untouched, which OpenClaw raises. When a user installs OpenClaw and provides complete access, was the agent authorized? Or is authorization also dependent on the accessed platform?

The Amazon Ruling

Amazon v. Perplexity AI directly addressed this question. Perplexity’s Comet agent disguised itself as a standard browser and was logging onto Amazon accounts on behalf of the user to browse and purchase items, despite a cease-and-desist letter sent in October 2025.

Comet had accessed Amazon’s systems “with the Amazon user’s permission, but without authorization by Amazon,” and the court treated those as legally separate. (14) Drawing from Facebook, Inc. v. Power Ventures, Inc., which permitted platforms to revoke third-party access despite user consent and treated continued access after a formal cease-and-desist as unauthorized under the CFAA, Judge Chesney granted Amazon a preliminary injunction on March 9, 2026. (15)

Perplexity appealed to the Ninth Circuit immediately. Mozilla and the Electronic Frontier Foundation filed amicus briefs warning that upholding the ruling would expose browser extension and automated tool developers to CFAA liability. (16) Oral arguments were heard on June 11, 2026, and no decision has been made.

While OpenClaw and its users have not received any cease-and-desist letters yet, there have been terms-of-service prohibitions primarily from major AI platforms and employers, and companies and governments have begun to consider restrictions on usage and access. This case could establish the relationship between autonomous AI agents and the Internet.

Who Gets Sued?

Even if the authorization question is resolved, a difficult problem remains.

Standard AI liability assumes the following chain: one company builds the system, another deploys it, and the user utilizes it. However, OpenClaw’s codebase is part of a distributed open-source community with no legal identity, and the deployer and user are the same individual. Furthermore, California AB 316, which took effect on January 1, 2026, invalidated the defense that the AIs act independently and are responsible for their harmful actions. (17)

Picture the prompt injection scenario again. An anonymous attacker hides malicious instructions inside a webpage. OpenClaw processes the page during a routine task and stores the instruction in its memory. Four days later, it carries out the instruction. The user was unaware of this action, the attacker cannot be easily traced, and the developer community cannot patch every injection attempt. There is no corporate deployer in the picture. As the University of Chicago Law Review observed, these systems are troublesome for tort doctrine to handle since they were “designed to act without constant human input,” and no existing liability framework assigns responsibility for such harm. (18)

Singapore released a governance framework for AI agents in January 2026, and NIST launched its AI Agent Standards Initiative the following month. (19) Yet these assume that the organization to be held accountable deployed the system, not an individual on their personal device.

What Needs to Change

The Van Buren case warned of the damage a broad interpretation of the CDAA could have on ordinary conduct, while the Perplexity litigation shows the struggle courts face when forced to improvise around ill-assorted statutes. (20) New regulations are necessary to handle these new developments in artificial intelligence.

The authorization framework needs to account for the new delegation structure, reconsider the relationship between user consent and agent authorization, and ensure that AI agents cannot mask their identity from web platforms. Platforms should have the right to exclude agents, as if they were third-party access, but this should occur through a standardized, machine-readable channel instead of being buried in a terms of service page. The industry is already designing such protocols, such as Google’s Universal Commerce Protocol and OpenAI’s Agentic Commerce Protocol, but legal enforcement is necessary.

As for traceability, all autonomous AI agents with access to third-party systems should keep tamper-resistant logs of their actions that are producible for litigation. Such logs should also be reviewed by their human counterparts, ensuring they are aware of their agent’s actions and can dampen the damage from malicious activity by responding quickly. Disseminating information on how these agents are fallible and attackable is also crucial.

The EU Product Liability Directive already treats software as a product subject to defect liability; the U.S. has not gone there. (21) Justice Traynor’s concurrence in Escola v. Coca Cola Bottling Co.(1944) argued that strict liability is effective when the manufacturer can best prevent harm. (22) The only parallel would be developers who ship known remote code execution flaws in their tooling. It cannot apply to issues inherent to the design of large language models.

The history of technology regulation reveals one pattern: the law arrives late. As of June 2026, nearly 100,000 OpenClaw instances are vulnerable to RCE (23); meanwhile, Amazon and Perplexity are still feuding in court. The CFAA was designed for a world where humans either had access to a computer or did not, and tort doctrine was built for harms traceable to a human. Neither can handle autonomous, fallible agents that cannot be held responsible. Judicial interpretation will not close these gaps by itself. Congress needs to write precise rules based on how self-hosted agentic AI behaves.

Endnotes

1. Palo Alto Networks Blog, "OpenClaw (formerly Moltbot, Clawdbot) May Signal the Next AI Security Crisis," February 4, 2026, https://www.paloaltonetworks.com/blog/network-security/why-moltbot-may-signal-ai-crisis/.

2. Security Boulevard, "From Clawdbot to Moltbot to OpenClaw: Security Experts Detail Critical Vulnerabilities," February 3, 2026, https://securityboulevard.com/2026/02/from-clawdbot-to-moltbot-to-openclaw-security-experts-detail-critical-vulnerabilities/.

3. SecurityScorecard STRIKE Team, "Beyond the Hype: Moltbot's Real Risk Is Exposed Infrastructure, Not AI Superintelligence," February 9, 2026, https://securityscorecard.com/blog/beyond-the-hype-moltbots-real-risk-is-exposed-infrastructure-not-ai-superintelligence/.

4. Axios, "Silicon Valley's Latest AI Agent Obsession Is Riddled with Security Risks," January 29, 2026, https://www.axios.com/2026/01/29/moltbot-cybersecurity-ai-agent-risks.

5. National Cyber Security Centre, "Prompt Injection Is Not SQL Injection (It May Be Worse)," 2025, https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection.

6. Adversa AI, "OpenClaw Security 101: Vulnerabilities & Hardening (2026)," February 15, 2026, https://adversa.ai/blog/openclaw-security-101-vulnerabilities-hardening-2026/.

7. SecurityScorecard STRIKE Team, supra note 3.

8. Ibid.

9. Computer Fraud and Abuse Act of 1986, Pub. L. No. 99-474, 100 Stat. 1213 (Oct. 16, 1986).

10. 18 U.S.C. sections 1030(a)(2), 1030(e)(6).

11. National Information Infrastructure Protection Act of 1996, Pub. L. No. 104-294, Tit. II, 110 Stat. 3491.

12. Van Buren v. United States, 593 U.S. 374, 396 (2021).

13. Van Buren v. United States, 593 U.S. 388 (2021).

14. Cooley LLP, "Court Finds AI Agent May Violate State, Federal Law by Accessing Amazon Accounts Without Authorization," March 17, 2026, https://www.cooley.com/news/insight/2026/2026-03-17-court-finds-ai-agent-may-violate-state-federal-law-by-accessing-amazon-accounts-without-authorization.

15. Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067-68 (9th Cir. 2016).

16. Let's Data Science, "Amazon Files CFAA Lawsuit Against Perplexity's Comet Agent," https://letsdatascience.com/news/amazon-files-cfaa-lawsuit-against-perplexitys-comet-agent-9ce17598.

17. The Lyon Firm, "Who Is Legally Responsible When an AI Agent Makes a Mistake?," April 29, 2026, https://thelyonfirm.com/blog/agentic-ai-liability-legal-responsibility-autonomous-ai-agents/.

18. University of Chicago Law Review, "The Law of AI is the Law of Risky Agents Without Intentions," https://lawreview.uchicago.edu/online-archive/law-ai-law-risky-agents-without-intentions.

19. Infocomm Media Development Authority [IMDA], Model AI Governance Framework for Agentic AI (Jan. 2026), https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf; Nat’l Inst. of Standards and Tech. [NIST], Announcing the “AI Agent Standards Initiative” for Interoperable and Secure Innovation (Feb. 17, 2026), https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure.

20. Van Buren, 593 U.S. at 391-92.

21. ERP Today, "Court Ruling in Amazon-Perplexity Case Raises New Questions for Agentic AI in Enterprise Systems," April 20, 2026, https://erp.today/amazon-perplexity-ai-agents-ruling-enterprise-systems/ (citing EU Product Liability Directive).

22. Escola v. Coca Cola Bottling Co. of Fresno, 24 Cal. 2d 453, 461-68 (1944) (Traynor, J., concurring).

23. SecurityScorecard STRIKE Team, "DECLAWED.io: A Live View of OpenClaw Instances," https://declawed.io.