Yesterday in AI: 19 April 2026 — AI Agents Are Broken: 360K Stars, 138 CVEs

Silicon Valley’s hottest AI agent framework has 360,683 GitHub stars and 138 known security vulnerabilities—and on Sunday, CNBC reported that even its biggest enterprise fans call it “definitely not enterprise-level.” OpenClaw’s Security Meltdown Hits the Front Page On April 19, CNBC published a ground-level report from two Silicon Valley AI events where engineers and executives admitted that OpenClaw—the open-source AI agent framework that grew from 9,000 to 360,000+ stars faster than any project in GitHub history—is fundamentally unsafe for enterprise use. The framework lets AI models execute shell commands, browse the web, and manage files autonomously. It has accumulated 138 CVEs in five months, including 7 critical flaws. Censys identified 21,639 publicly exposed OpenClaw instances, many leaking API keys, OAuth tokens, and plaintext credentials. A supply-chain attack called ClawHavoc planted 341 malicious “skills” in the ClawHub marketplace, delivering AMOS malware. Despite the hype, attendees at both events described current AI agent systems as “rickety”—prone to burning cash rather than saving it. Why it matters: OpenClaw is the fastest-growing repository in GitHub history, and its security crisis is a preview of enterprise AI agent adoption at scale. The gap between viral stars and production-grade security is wide and widening. Source: CNBC, April 19https://www.cnbc.com/2026/04/19/siiicon-valley-ai-agent-openclaw-problems.html | Reco.aihttps://www.reco.ai/blog/openclaw-the-ai-agent-security-crisis-unfolding-right-now Cloudflare Shrinks a 1.17 Million-Token API to 1,000 Tokens During Cloudflare Agents Week April 13–17, Cloudflare shipped Code Mode for MCP—a new approach to letting AI agents interact with large APIs. The old approach: one MCP tool per API endpoint. For the Cloudflare API, that meant 2,500+ tools and 1.17 million tokens just to describe them, exceeding the context window of most frontier models. Code Mode collapses this to two tools—sea