530 vulnerabilities. 600+ malicious skills. 1.5 million leaked API tokens. These are not the metrics of a fledgling project; they are the forensic footprint of OpenClaw, the open-source AI agent that amassed 386,000 GitHub stars before the hyperscalers pulled the plug. The blockchain remembers what the press forgets—and in this case, the codebase's security ledger is a cascade of red flags. When Meta, Google, Microsoft, and Amazon blacklisted OpenClaw and its sibling Hermes after the Summer Yue incident—a 2026 context-compression failure that stripped security instructions mid-execution—they left a gaping market void. Enterprises wanted the power of these agents without the risk. Cloudways, a DigitalOcean subsidiary, saw an opportunity to charge for trust. But a closer look at their offering reveals a system that transfers risk rather than eliminates it.
Cloudways launched its managed AI agent hosting on August 17, promising a sanitized environment for the very agents the hyperscalers banned. The pricing ladder—$4.99/month promotional to $79.99/month standard—is a classic freemium hook, but the real cost is the promise of safety. The package includes three controls: isolation environments, update verification, and one-click MCP (Model Context Protocol) integration. The business model is a textbook case of trust outsourcing. Enterprises are not paying for the agent's intelligence; they are paying for Cloudways to act as a security arbiter, a middleman that vouches for the code. The BYOK (bring-your-own-key) model shifts the GPU inference cost back to the customer, meaning Cloudways avoids the highest infrastructure expense. Their marginal cost is low, but their liability is enormous.
The core of the analysis lies in dissecting these three controls. Isolation environments are a standard sandboxing technique—spin up a container, restrict network access, and hope the agent doesn't find a way out. But sandboxing does not patch the 530 vulnerabilities Kaspersky identified. It only limits the blast radius. The update verification process is opaque. Based on my experience auditing smart contract upgrade mechanisms, most verification systems check cryptographic signatures or version hashes, not behavioral integrity. They can confirm that the code is the same as the upstream repository, but they cannot detect subtle logic flaws like the one that caused the Summer Yue incident. In that event, the context window compression algorithm—a common optimization trick—merged security instructions with normal user context and then selectively discarded them. The system lacked a hard-coded separation between privileged instructions and malleable data. No signature check can catch that. The MCP integration is similarly a double-edged sword. Yes, it standardizes tool access, but it also opens a new attack surface. If the agent can call external APIs, the isolation environment must filter every call. Cloudways has not published details on how MCP calls are audited or rate-limited.
The data from Kaspersky's investigation is the smoking gun. Over 600 malicious skills were found in the OpenClaw marketplace. These are not theoretical proofs-of-concept; they are Shodan-searchable modules that can steal credentials, send spam, or pivot to internal networks. The 1.5 million API tokens likely belong to developers who integrated the agent into their workflows. A single token leak in a sandbox environment can still be catastrophic if the token has access to a production database. Cloudways' isolation does not revoke those tokens; it only prevents the agent from communicating directly with the internet. But if the agent's MCP connector is allowed to reach an external service—and it must be, to function—then the token is still exposed. The trust model collapses when you realize that the security perimeter is porous by design.
The contrarian angle is uncomfortable but necessary: Cloudways might actually increase systemic risk. By providing a "safe" deployment option, they encourage enterprises to use agents that remain fundamentally unstable. The hyperscalers banned these agents not out of caprice, but because they calculated that the security overhead outweighed the productivity gains. Cloudways is betting they can do better with less resources. Their historical safety record is unproven—no independent audit, no public incident response playbook, no SOC 2 certification. The 530 vulnerabilities are not being fixed; they are being contained. This is the equivalent of storing radioactive waste in a lead box without ever treating the source. The enterprise that buys this service is accepting a liability that is not clearly defined. The article itself notes that the responsibility gap for enterprise users remains largely unresolved. If a Cloudways-hosted agent executes a malicious skill that deletes a customer's database, who is liable? The open-source maintainer? Cloudways? The enterprise? The law is silent, and the contract is likely one-sided.
The takeaway is a forward-looking signal. The next few months will determine whether Cloudways' experiment becomes a template or a warning. If they publish a third-party penetration test showing that their isolation holds against a skilled attacker, trust might build. If they disclose a zero-day incident with a transparent post-mortem, they could set a standard. But the odds are against them. The blockchain of security accountability is empty. The data shows that the agents themselves are not ready for prime time, and no amount of sandboxing can fix a broken foundation. The market will vote with its wallet—and its lawyers. Watch for the first class-action lawsuit against a hosted AI agent; it will define the liability landscape for a generation. The blockchain remembers, but the code forgets its own flaws.
