{"schema_version":"0.10.0","id":"LR-2026-0373","record_version":1,"title":"Critical Clawdbot vulnerabilities found enabling cryptocurrency theft","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: ForkLog · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: ForkLog · subject to change"}]},"sources_hash":"8bb587e26df004d2ff6970d60725008b6032288d5bfa4dd0d0215da5b1885372"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":"full system access to the user's computer","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-01-27","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Clawdbot is an open AI assistant developed by entrepreneur Peter Steinberger, and it runs locally on the user's device. It was reported to have full system access, including reading and writing files, executing commands and controlling browsers. A misconfigured reverse proxy allowed the gateway's authentication to be bypassed, and a security researcher reported that hundreds of management servers were publicly accessible. Using an email containing a prompt injection, Archestra AI CEO Matvey Kukuy obtained an OpenSSH private key in five minutes. Researcher Jamison O'Reilly reported access to API keys, bot tokens, OAuth secrets, signing keys and chat histories. SlowMist issued an alert on January 27, 2026 about exposed gateways and possible credential theft and remote code execution, and urged strict IP whitelisting for open ports. The sources do not report confirmed losses from theft.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"authentication bypass when the gateway sits behind a misconfigured reverse proxy","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK04","RK08"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties with a stated count of two or more. Fact: the researcher states hundreds of people configured publicly accessible management servers.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://forklog.com/en/critical-vulnerabilities-found-in-clawdbot-ai-agent-for-cryptocurrency-theft/","publisher":"ForkLog","date":"2026-01-27","type":"press","title":"Critical Vulnerabilities Found in Clawdbot AI Agent for Cryptocurrency Theft - ForkLog","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.permissions_scope":"C","event.agent_involved":"C","event.failure_class":"C","event.trigger":"C","event.root_cause_detail":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.permissions_scope":[{"source_index":0,"quote":"Clawdbot differs from other AI agents in that it has full system access to the user’s computer."}],"event.agent_involved":[{"source_index":0,"quote":"Archestra AI CEO Matvey Kukuy was able to obtain an OpenSSH private key “in five minutes.”"}],"event.failure_class":[{"source_index":0,"quote":"Archestra AI CEO Matvey Kukuy was able to obtain an OpenSSH private key “in five minutes.”"}],"event.trigger":[{"source_index":0,"quote":"He sent an email to Clawdbot with a “prompt injection” attack and asked the bot to check the mail."}],"event.root_cause_detail":[{"source_index":0,"quote":"The authentication bypass vulnerability occurs when the gateway is placed behind a misconfigured reverse proxy, explained O’Reilly."}],"event.incident_class":[{"source_index":0,"quote":"Critical Vulnerabilities Found in Clawdbot AI Agent for Cryptocurrency Theft"}],"impact.severity":[{"source_index":0,"quote":"Security researcher Jamison O’Reilly stated that “hundreds of people have configured their Clawdbot management servers to be publicly accessible.”"}],"impact.severity_because":[{"source_index":0,"quote":"Security researcher Jamison O’Reilly stated that “hundreds of people have configured their Clawdbot management servers to be publicly accessible.”"}],"event.summary":[{"source_index":0,"quote":"Clawdbot is an open AI assistant developed by entrepreneur Peter Steinberger."},{"source_index":0,"quote":"Clawdbot differs from other AI agents in that it has full system access to the user’s computer. It can read and write files, execute commands, run scripts, and control browsers."},{"source_index":0,"quote":"The authentication bypass vulnerability occurs when the gateway is placed behind a misconfigured reverse proxy, explained O’Reilly."},{"source_index":0,"quote":"Security researcher Jamison O’Reilly stated that “hundreds of people have configured their Clawdbot management servers to be publicly accessible.”"},{"source_index":0,"quote":"Archestra AI CEO Matvey Kukuy was able to obtain an OpenSSH private key “in five minutes.”"},{"source_index":0,"quote":"He sent an email to Clawdbot with a “prompt injection” attack and asked the bot to check the mail."},{"source_index":0,"quote":"O’Reilly gained access to complete credentials: API keys, bot tokens, secret OAuth keys, signing keys, full chat histories across all platforms, the ability to send messages on behalf of the user, and execute commands."},{"source_index":0,"quote":"The company urged the implementation of strict IP whitelisting for open ports."}]},"notes_on_gaps":"Single press source (ForkLog) relaying SlowMist and researcher statements; no primary SlowMist report or vendor statement was provided. No model name, model version, or LLM provider is stated. No confirmed theft or direct financial loss is reported; the Kukuy key retrieval was a demonstration by a researcher and the sources do not say whether real funds were stolen. Date of occurrence and date of detection are not stated. Severity set to major on the test of a stated count of two or more affected parties (hundreds of people), though this describes exposure rather than confirmed loss. Judgements: E1 marked missing and J2 marked missing are inferred from 'full system access' and 'unauthenticated instances'; J3 and J8 are mapped from the advice text. Root cause set to integration from the misconfigured reverse proxy statement. No responsible party is stated. No fix or change by the developer is reported. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: ForkLog · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Clawdbot went viral over the weekend.","quote":"It operates locally on the user’s device and went viral over the weekend of January 24-25.","source_index":0,"when":"January 24-25"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://forklog.com/en/critical-vulnerabilities-found-in-clawdbot-ai-agent-for-cryptocurrency-theft/"]}}