Loading story…
Security researchers reported that Clawdbot, an open-source AI agent gateway used to connect LLMs to messaging platforms and local tool execution, is being deployed insecurely at scale, with 900+ internet-exposed instances discovered via Shodan/Censys-style fingerprinting (e.g., the Control UI title Clawdbot Control) and scans of the default service port 18789. Many exposed deployments were unauthenticated, allowing access to the web-based Control UI and WebSocket interfaces, and in some cases exposing configuration data, third-party tokens (e.g., Telegram/Slack), Anthropic API keys, and months of private chat history.
The primary root cause described is an authentication trust flaw combined with common reverse-proxy deployments: Clawdbot’s “localhost auto-approval” logic (intended for local development) can be bypassed when a reverse proxy forwards requests in a way that makes the gateway see the connection as originating from 127.0.0.1, especially when gateway.trustedProxies is not configured to correctly interpret X-Forwarded-For. Both reporting and analysis emphasize that Clawdbot is not a simple app but long-running infrastructure that can hold high-value secrets and execute tools/commands, meaning exposed gateways materially expand organizational attack surface and can enable credential theft and potential remote code execution if attackers can reach tool execution paths in real deployments.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
By 2026-01-26 and 2026-01-27, multiple reports stated that exposed Clawdbot gateways were leaking configuration data, private conversations, API keys, and service tokens, and that some deployments could allow arbitrary command execution or remote code execution when overprivileged.
Clawdbot documentation was updated to emphasize stronger security practices, including safer remote-access patterns, proper trusted-proxy configuration, and enabling authentication for exposed gateways.
Following the exposure findings, the security community submitted pull requests to harden Clawdbot’s default behavior and make authentication handling more proxy-aware to reduce unauthenticated internet exposure.
Analysis of exposed deployments showed Clawdbot’s localhost-oriented authentication behavior could be bypassed when reverse proxies made external traffic appear to originate from 127.0.0.1. This exposed control interfaces, chat history, API keys, bot tokens, and in some cases command-execution capability.
On 2026-01-23, security researcher Jamieson O’Reilly reported that Shodan-based discovery and follow-on scanning had identified hundreds of publicly reachable Clawdbot instances, with 900+ gateways exposed on port 18789 and many lacking authentication.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
5 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcesecurityonline.info
Open sourcethecyberedition.com
Open sourcecybersecuritynews.com
Open sourcesocradar.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical one-click remote code execution (RCE)** issue was reported in *OpenClaw* (also referred to as **ClawdBot/Moltbot**), an open-source AI “agent” assistant that runs with high local privileges and access to sensitive data (e.g., messaging apps and API keys). The described exploit chain abuses **unsafe URL parameter ingestion** (e.g., a `gatewayUrl` query parameter accepted without validation), persistence of attacker-controlled values (stored in `localStorage`), and an **automatic gateway connection** that transmits an `authToken` during the handshake—enabling **cross-site WebSocket hijacking** and ultimately unauthenticated code execution after a victim clicks a single malicious link. Reporting indicates the flaw has been **weaponized**, making it a practical drive-by compromise path for endpoints running the assistant. Separate reporting highlighted broader concerns with agentic/open-source AI tooling and deployments, including the security risks of highly privileged “AI that acts for you” and the growing attack surface created by exposed AI services. Research cited large-scale internet exposure of open-source LLM runtimes (e.g., **Ollama**) with tool-calling and weak guardrails, warning that a single vulnerability or misconfiguration could enable widespread abuse (resource hijacking, identity laundering, or remote execution of privileged operations). These themes reinforce that AI agents and self-hosted AI stacks should be treated as **critical infrastructure**, with strict input validation, hardened update/connection flows, and strong monitoring around token handling and outbound connections.
Jun 29, 2026
The open-source autonomous AI assistant **OpenClaw** (previously *Clawdbot* and *Moltbot*) is drawing security scrutiny after rapid adoption coincided with both widespread unsafe deployments and newly disclosed exploit chains. Reporting highlighted that the project’s autonomy-focused design (integrations with email, calendars, smart-home services, and other action-taking connectors) increases blast radius when misconfigured, and that security concerns have persisted through multiple rebrands as the ecosystem grows quickly. Internet scanning data indicated **21,000+ OpenClaw/Moltbot instances** were publicly exposed despite documentation recommending local-only access (default `TCP/18789`) and remote access via **SSH tunneling** rather than direct internet exposure; even where tokens are required for full access, exposed endpoints can aid adversary reconnaissance and targeting. Separately, researchers disclosed a **one-click RCE** chain leveraging **cross-site WebSocket hijacking** due to missing WebSocket `Origin` validation, enabling a malicious webpage to obtain an auth token, connect to the OpenClaw server, disable safety prompts/sandboxing, and invoke command execution (e.g., via `node.invoke`); the project issued a patch and advisory, while adjacent ecosystem components (e.g., agent-focused social features) were also flagged as adding additional attack surface.
Aug 19, 2026
The open-source agentic assistant **Clawdbot** rapidly went viral on GitHub (reported at ~24,000–25,000+ stars in a short period) and drew high-profile attention, with reports of engineers running it locally on always-on hardware such as **Mac minis**. Clawdbot is positioned as a “local-first” AI gateway that can be driven from common messaging platforms (e.g., Slack/Discord/Telegram) and can take real actions on a host—invoking terminals, running scripts, using a browser for web automation, and retaining “memory” over time—effectively operating with permissions similar to a human user account. Security commentary around Clawdbot emphasizes that agentic assistants change incident patterns because they can persist like service accounts while behaving like users, expanding the blast radius if compromised or misconfigured. Key risks highlighted include **shadow AI** adoption outside IT controls, inherited or over-granted permissions across chat and SaaS tools, data exposure via long-lived context/memory, and new attack paths such as prompt manipulation or “helpful” automation that executes unsafe actions on endpoints. The guidance focuses on SOC readiness: monitoring for unusual automation behaviors and access patterns consistent with an agent executing actions across endpoints and collaboration/SaaS environments, and treating these tools as a machine-identity and endpoint-control problem rather than a simple chatbot governance issue.
Jun 29, 2026