{"schema_version":"0.10.0","id":"LR-2026-0405","record_version":1,"title":"Tens of thousands of OpenClaw systems exposed by misconfigurations and known exploits","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"08aa33e1a28441cb03ffcfcd0718d66adf11c8781980d67551d87fa1b7a1abed"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"agentic AI framework","tools_granted":["execute commands","interact with external services","integrate with messaging platforms"],"permissions_scope":"broad system-level permissions","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"run continuously and act on behalf of users","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-09","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"OpenClaw is an agentic AI framework designed to run continuously and act on behalf of users, with broad system-level permissions. A report from SecurityScorecard's STRIKE team identified 28,663 unique IP addresses hosting exposed OpenClaw control panels across 76 countries. The control interface binds to all network interfaces by default, and many exposed instances ran outdated versions even though patches were available. Researchers flagged 12,812 instances as vulnerable to remote code execution and found 549 exposed instances correlated with prior breach activity. The count of exposed deployments kept growing during the research period, exceeding 40,000. The report describes the exposure as a broader security challenge for agentic AI.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"infrastructure","root_cause_detail":"unsafe defaults and poor deployment hygiene","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK03"],"control_chain":[{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"E3","outcome":"failed","reason":null,"quote":"Out of the box, OpenClaw binds its control interface to all network interfaces, making it accessible from the public internet unless explicitly restricted.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties with a stated count of two or more affected. Fact: 549 exposed instances correlated with prior breach activity, indicating that some affected environments had already been compromised.","harm_class":[],"affected_description":"exposed OpenClaw control panels across 76 countries","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://siliconangle.com/2026/02/09/tens-thousands-openclaw-systems-exposed-due-misconfiguration-known-exploits/","publisher":"SiliconANGLE","date":"2026-02-09","type":"press","title":"Tens of thousands of OpenClaw systems exposed by misconfigurations and known exploits - SiliconANGLE","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.intended_use":"C","system.permissions_scope":"C","system.tools_granted":"C","event.incident_class":"C","event.detection_method":"C","event.root_cause":"C","event.root_cause_detail":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"OpenClaw, formerly known as Clawdbot and Moltbot, is an agentic artificial intelligence framework designed to run continuously and act on behalf of users."}],"system.intended_use":[{"source_index":0,"quote":"OpenClaw, formerly known as Clawdbot and Moltbot, is an agentic artificial intelligence framework designed to run continuously and act on behalf of users."}],"system.permissions_scope":[{"source_index":0,"quote":"The software allows AI agents to execute commands, interact with external services, integrate with messaging platforms and operate with broad system-level permissions."}],"system.tools_granted":[{"source_index":0,"quote":"The software allows AI agents to execute commands, interact with external services, integrate with messaging platforms and operate with broad system-level permissions."}],"event.incident_class":[{"source_index":0,"quote":"A new report out today from security rating firm SecurityScorecard Inc. warns that widespread vulnerabilities in OpenClaw deployments have left tens of thousands of internet-facing instances exposed to takeover through misconfigured access controls and known exploits."}],"event.detection_method":[{"source_index":0,"quote":"The STRIKE researchers identified 28,663 unique IP addresses hosting exposed OpenClaw control panels across 76 countries using live internet-wide reconnaissance."}],"event.root_cause":[{"source_index":0,"quote":"Out of the box, OpenClaw binds its control interface to all network interfaces, making it accessible from the public internet unless explicitly restricted."}],"event.root_cause_detail":[{"source_index":0,"quote":"The report highlights that many OpenClaw deployments are exposed by unsafe defaults and poor deployment hygiene."}],"impact.affected_description":[{"source_index":0,"quote":"The STRIKE researchers identified 28,663 unique IP addresses hosting exposed OpenClaw control panels across 76 countries using live internet-wide reconnaissance."}],"impact.severity":[{"source_index":0,"quote":"The researchers also found that 549 exposed instances correlated with prior breach activity, indicating that some affected environments had already been compromised."}],"impact.severity_because":[{"source_index":0,"quote":"The researchers also found that 549 exposed instances correlated with prior breach activity, indicating that some affected environments had already been compromised."}],"event.control_chain":[{"source_index":0,"quote":"Out of the box, OpenClaw binds its control interface to all network interfaces, making it accessible from the public internet unless explicitly restricted."}],"event.summary":[{"source_index":0,"quote":"OpenClaw, formerly known as Clawdbot and Moltbot, is an agentic artificial intelligence framework designed to run continuously and act on behalf of users."},{"source_index":0,"quote":"The STRIKE researchers identified 28,663 unique IP addresses hosting exposed OpenClaw control panels across 76 countries using live internet-wide reconnaissance."},{"source_index":0,"quote":"Out of the box, OpenClaw binds its control interface to all network interfaces, making it accessible from the public internet unless explicitly restricted."},{"source_index":0,"quote":"A large proportion of exposed instances were also found to be running outdated versions of the software, despite patches being available for several high-severity vulnerabilities."},{"source_index":0,"quote":"Of those, 12,812 instances were flagged as vulnerable to remote code execution, with 63% of observed deployments classified as exploitable."},{"source_index":0,"quote":"The researchers also found that 549 exposed instances correlated with prior breach activity, indicating that some affected environments had already been compromised."},{"source_index":0,"quote":"During the research period, the number of identified internet-facing instances continued to grow, ultimately exceeding 40,000 exposed deployments."},{"source_index":0,"quote":"The report concludes that OpenClaw is not an isolated case but a leading indicator of a broader security challenge facing agentic AI."}]},"notes_on_gaps":"The sources describe exposure of many OpenClaw instances across the internet, not one incident with a single operator, so no single deployer, date of occurrence, or model name, version, or developer is stated. The sources do not state a date of occurrence, so event.date_occurred is omitted. The sources do not name a model; system.model_name and system.model_version are omitted. Agent involvement and failure class were not stated as an autonomous agent acting wrongly, so event.agent_involved and event.failure_class are omitted. No trigger or adversarial actor is stated, so those fields are omitted. Judgements made: root_cause set to infrastructure based on unsafe defaults and unpatched software; responsible_party set to shared based on the report's reference to unsafe defaults and deployment hygiene; detection_method set to third_party based on the SecurityScorecard research; severity set to major because 549 correlated prior-breach environments is a stated count of two or more affected parties. The 40,000 figure counts exposed deployments, not confirmed affected third parties, so impact.third_parties_affected_count is omitted. No remediation by the vendor or operators is reported, so remediations is empty. The source is a single press article and the report itself is not quoted directly. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"OpenClaw is an agentic AI framework built to run continuously and act for users, with broad system-level permissions.","quote":"OpenClaw, formerly known as Clawdbot and Moltbot, is an agentic artificial intelligence framework designed to run continuously and act on behalf of users.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Out of the box, the control interface binds to all network interfaces, so it is reachable from the public internet unless someone restricts it.","quote":"Out of the box, OpenClaw binds its control interface to all network interfaces, making it accessible from the public internet unless explicitly restricted.","source_index":0,"grade":"C"},{"step":"reached","text":"Researchers found 549 exposed instances correlated with prior breach activity.","quote":"The researchers also found that 549 exposed instances correlated with prior breach activity, indicating that some affected environments had already been compromised.","source_index":0,"grade":"C"},{"step":"caught","text":"SecurityScorecard's STRIKE team found the exposed control panels using live internet-wide reconnaissance.","quote":"The STRIKE researchers identified 28,663 unique IP addresses hosting exposed OpenClaw control panels across 76 countries using live internet-wide reconnaissance.","source_index":0,"grade":"C"},{"step":"done","text":"The report concludes OpenClaw is a leading indicator of a broader security challenge for agentic AI.","quote":"The report concludes that OpenClaw is not an isolated case but a leading indicator of a broader security challenge facing agentic AI.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://siliconangle.com/2026/02/09/tens-thousands-openclaw-systems-exposed-due-misconfiguration-known-exploits/"]},"analysis":{"sections":{"timeline":[{"text":"During the research period, the count of identified internet-facing instances grows past 40,000.","quote":"During the research period, the number of identified internet-facing instances continued to grow, ultimately exceeding 40,000 exposed deployments.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://siliconangle.com/2026/02/09/tens-thousands-openclaw-systems-exposed-due-misconfiguration-known-exploits/"]}}