{"schema_version":"0.10.0","id":"LR-2026-0385","record_version":1,"title":"Clawdbot/Moltbot AI agent gateways exposed on the internet with secrets accessible","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":62.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.12,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":3,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"a3211673aa8df9eb75af2d7a49a92db1a3320979f12683a31db613c485081c22"},"system":{"model_name":null,"model_version":null,"developer":"Peter Steinberger","harness":null,"tools_granted":[],"permissions_scope":"complete system access on user machines","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"personal AI assistant installed locally on users' own devices","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-01-23","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Clawdbot is an open-source personal AI assistant that can execute commands and read credentials on the user's machine, and its gateway exposes a control panel. Its authentication logic automatically trusts localhost connections, and behind reverse proxies outside traffic can appear local, while the trusted-proxies setting is empty by default. Security researcher Jamieson O'Reilly used Shodan to find hundreds of exposed instances, and eight he examined manually had no authentication at all. Exposed gateways could reveal API keys, bot tokens and chat histories. Some secrets were also stored in plaintext local files. O'Reilly reported the attack model to the developers, and he says it is now fixed. A separate proof-of-concept showed a benign skill could run commands on instances that installed it.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"attack model reported to the developers is now fixed","precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK04"],"control_chain":[{"layer":"L4","party":"target","party_name":null,"control_id":"J2","outcome":"held","reason":null,"quote":"Forty-seven had working authentication, which I manually confirmed was secure.","source_index":1,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"E3","outcome":"failed","reason":null,"quote":"While the system has cryptographic device identity with challenge-response protocol, it automatically grants localhost connections without authentication.","source_index":2,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"E3","outcome":"failed","reason":null,"quote":"A configuration option for trusted proxies exists, but remains empty by default, causing the gateway to ignore X-Forwarded-For headers and use only the socket address.","source_index":2,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched with a bounded scope stated. Fact: eight examined instances were open with no authentication, exposing full access to run commands and configuration data.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["credentials","chat histories"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/clawdbot-chats-exposed/","publisher":"CyberSecurityNews","date":"2026-01-26","type":"press","title":"Hundreds of Exposed Clawdbot Gateways Leave API Keys and Private Chats Vulnerable - CyberSecurityNews","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.theregister.com/special-features/2026/01/27/clawdbot-becomes-moltbot-but-cant-shed-security-concerns/5190124","publisher":"The Register","date":"2026-01-27","type":"press","title":"Clawdbot sheds skin to become Moltbot, can't slough off security issues - The Register","archived_url":null,"independence":"independent"},{"url":"https://www.trendingtopics.eu/clawbot-hyped-ai-agent-risks-leaking-personal-data-security-experts-warn/","publisher":"www.trendingtopics.eu","date":"2026-01-27","type":"press","title":"Clawdbot: Hyped AI agent risks leaking personal data, security experts warn - www.trendingtopics.eu","archived_url":null}],"per_field_confidence":{"system.developer":"C","system.permissions_scope":"C","system.intended_use":"C","event.agent_involved":"C","event.date_disclosed":"C","event.incident_class":"C","event.detection_method":"C","event.remediation":"C","impact.data_categories_exposed":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":2,"quote":"This is an AI assistant created by Austrian founder and developer Peter Steinberger, which is intended to serve as a personal virtual butler installed locally on users’ own devices."}],"system.permissions_scope":[{"source_index":2,"quote":"Clawdbot differs from other AI assistants through complete system access on user machines, including the ability to read and write files, execute commands, launch scripts, and control browsers."}],"system.intended_use":[{"source_index":2,"quote":"This is an AI assistant created by Austrian founder and developer Peter Steinberger, which is intended to serve as a personal virtual butler installed locally on users’ own devices."}],"event.agent_involved":[{"source_index":0,"quote":"Clawdbot, the surging open-source AI agent gateway, faces escalating security concerns, with 900+ unauthenticated instances exposed online and multiple code flaws that enable credential theft and remote code execution."}],"event.date_disclosed":[{"source_index":0,"quote":"Security researcher Jamieson O’Reilly detailed the issue in a January 23, 2026, X thread, highlighting misconfigurations in this popular open-source AI agent gateway."}],"event.incident_class":[{"source_index":0,"quote":"Clawdbot, the surging open-source AI agent gateway, faces escalating security concerns, with 900+ unauthenticated instances exposed online and multiple code flaws that enable credential theft and remote code execution."}],"event.detection_method":[{"source_index":1,"quote":"Jamieson O'Reilly, founder of red-teaming company Dvuln, was among the first to draw attention to the issue, saying that he saw hundreds of Clawdbot instances exposed to the web, potentially leaking secrets."}],"event.remediation":[{"source_index":1,"quote":"He told The Register that the attack model he reported to Moltbot's developers, which involved proxy misconfigurations and localhost connections auto-authenticating, is now fixed."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Exposed servers enable severe compromise. Read access dumps credentials (API keys, OAuth secrets) and full histories with attachments."}],"impact.severity":[{"source_index":1,"quote":"Of the instances I've examined manually, eight were open with no authentication at all and exposing full access to run commands and view configuration data,"}],"impact.severity_because":[{"source_index":1,"quote":"Of the instances I've examined manually, eight were open with no authentication at all and exposing full access to run commands and view configuration data,"}],"event.control_chain":[{"source_index":1,"quote":"Forty-seven had working authentication, which I manually confirmed was secure."},{"source_index":2,"quote":"While the system has cryptographic device identity with challenge-response protocol, it automatically grants localhost connections without authentication."},{"source_index":2,"quote":"A configuration option for trusted proxies exists, but remains empty by default, causing the gateway to ignore X-Forwarded-For headers and use only the socket address."}],"event.summary":[{"source_index":0,"quote":"Clawdbot is an open-source personal AI assistant that integrates with messaging platforms like WhatsApp, Telegram, Slack, Discord, Signal, and iMessage."},{"source_index":2,"quote":"A configuration option for trusted proxies exists, but remains empty by default, causing the gateway to ignore X-Forwarded-For headers and use only the socket address."},{"source_index":1,"quote":"Of the instances I've examined manually, eight were open with no authentication at all and exposing full access to run commands and view configuration data,"},{"source_index":0,"quote":"While some had authentication, others left configs, Anthropic API keys, Telegram/Slack tokens, and months of chat histories fully accessible."},{"source_index":1,"quote":"Its researchers said they looked at Moltbot's code and found that some of the secrets shared with the assistant by users were stored in plaintext Markdown and JSON files on the user's local filesystem."},{"source_index":1,"quote":"He told The Register that the attack model he reported to Moltbot's developers, which involved proxy misconfigurations and localhost connections auto-authenticating, is now fixed."},{"source_index":1,"quote":"He was able to upload a publicly available skill, artificially inflate the download count to more than 4,000, and watch as developers from seven countries downloaded the poisoned package."}]},"notes_on_gaps":"Sources do not name the underlying AI model, model version, lifecycle stage, deployment context or autonomy level, so those fields are omitted. No exact date of occurrence or detection is stated; the 2026-01-23 date is the disclosure thread date. Sources do not confirm that any attacker exploited exposed instances; the proof-of-concept was benign and researcher-run, so no adversarial actor is recorded. Responsible party and root cause are judgements: the flaw is a default authentication behaviour in the developer's design combined with user proxy configuration. The severity tier 'moderate' is my judgement based on the stated count of eight fully open instances; the 900+ and hundreds figures are exposure counts, not confirmed affected parties. The remediation is reported secondhand by The Register as a fix, and the trusted-proxies docs change is not separately dated. The Register's 'Tuesday' blog date is not resolved to a calendar date. Hudson Rock and SlowMist claims are not recorded as separate controls because the sources do not state whether they held or failed in this incident. The controls mapping for the trusted-proxies setting reuses E3 as the closest fail-closed default. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The gateway automatically trusted localhost connections, and reverse-proxied deployments made outside connections look local.","quote":"While the system has cryptographic device identity with challenge-response protocol, it automatically grants localhost connections without authentication.","source_index":2,"grade":"C"},{"step":"done","text":"O'Reilly reported the attack model to the developers, who he says have now fixed it.","quote":"He told The Register that the attack model he reported to Moltbot's developers, which involved proxy misconfigurations and localhost connections auto-authenticating, is now fixed.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/clawdbot-chats-exposed/","https://www.theregister.com/special-features/2026/01/27/clawdbot-becomes-moltbot-but-cant-shed-security-concerns/5190124","https://www.trendingtopics.eu/clawbot-hyped-ai-agent-risks-leaking-personal-data-security-experts-warn/"]},"analysis":{"sections":{"timeline":[{"text":"Researcher Jamieson O'Reilly detailed the exposure issue in an X thread.","quote":"Security researcher Jamieson O’Reilly detailed the issue in a January 23, 2026, X thread, highlighting misconfigurations in this popular open-source AI agent gateway.","source_index":0,"when":"2026-01-23"},{"text":"The reported attack model was later stated to be fixed. No date is given.","quote":"He told The Register that the attack model he reported to Moltbot's developers, which involved proxy misconfigurations and localhost connections auto-authenticating, is now fixed.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/clawdbot-chats-exposed/","https://www.theregister.com/special-features/2026/01/27/clawdbot-becomes-moltbot-but-cant-shed-security-concerns/5190124","https://www.trendingtopics.eu/clawbot-hyped-ai-agent-risks-leaking-personal-data-security-experts-warn/"]}}