The report
Researchers examining OpenClaw's security discussion screened more than 25,000 Reddit posts and retained 162 security-relevant submissions with 1,787 associated comments. They also analyzed a subset of GitHub security-tagged issues. That approach can map what users report, but a report's presence is not proof that an exploit occurred or that a system is currently vulnerable. Community sample.
From 358 candidate GitHub issues, the team retained 180 and coded 521 weakness instances spanning 59 Common Weakness Enumeration categories. The word instance matters: one report may contain several coded issues, repeat a known vulnerability, or describe a failure that has not been independently reproduced. It is therefore incorrect to present the total as 521 newly discovered zero-days or 521 compromised installations. Issue classifications.
The researchers additionally collected 543 practitioner mitigation suggestions in seven groups. Their illustrative proof used dummy secrets; the paper did not independently replay every complaint. Methods and limits.
This is a different evidence type from the ClawHub malicious-skill scanner, which began with a large artifact corpus and then subjected suspicious skills to additional checking. Neither study should be interpreted as a platform-wide user-victim count. One describes reported problems and coded weaknesses; the other evaluates actual skill files and follow-up specimens. An operational inventory would reconcile reports to advisories, affected versions, reproduction outcomes and current fixes before assigning incident severity. Primary community study.