{"schema_version":"0.10.0","id":"LR-2026-0420","record_version":1,"title":"15,200 OpenClaw control panels with full system access exposed online","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Cyber Security News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Cyber Security News · subject to change"}]},"sources_hash":"c836e7db4f06a600cbd4f1fdd722972cfcda69595011c2de39e5b71021b849ac"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"OpenClaw","tools_granted":[],"permissions_scope":"access to sensitive directories, cloud credentials and authenticated browser sessions","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"personal automation","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-10","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Security researchers at SecurityScorecard STRIKE reported that 15,200 instances of the OpenClaw agent framework, formerly known as Moltbot, were vulnerable to remote code execution, which would let attackers take full control of host machines. The service's default configuration binds to all network interfaces rather than localhost, so control panels for AI agents were reachable from the internet. Reconnaissance identified 42,900 unique IP addresses hosting exposed control panels across 82 countries. Patches were released in version 2026.1.29, yet the researchers' data indicates that 78% of exposed instances still ran older versions. The research also found that 53,300 identified instances correlate with prior breach activity. The research was released on 2026-02-10. The researchers urged users to update to version 2026.2.1 or later, bind to localhost, and rotate credentials.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Default configuration binds the service to 0.0.0.0:18789 on all network interfaces instead of 127.0.0.1","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK03","RK05"],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["J1"],"quote":"The primary mitigation is to update to version 2026.2.1 or later, which addresses the RCE vulnerabilities.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/openclaw-control-panels-exposed/","publisher":"CyberSecurityNews","date":"2026-02-10","type":"press","title":"15,200 OpenClaw Control Panels with Full System Access Exposed to the Internet - CyberSecurityNews","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.harness":"C","system.intended_use":"C","system.permissions_scope":"C","event.incident_class":"C","event.agent_involved":"C","event.detection_method":"C","event.root_cause_detail":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"New research released today by the SecurityScorecard STRIKE Threat Intelligence Team reveals that 15,200 instances of the popular OpenClaw framework (formerly known as Moltbot) are vulnerable to Remote Code Execution (RCE), allowing attackers to take full control of the host machines."}],"system.intended_use":[{"source_index":0,"quote":"As a result, users who deployed the tool for personal automation have unknowingly broadcast their control panels to the entire internet."}],"system.permissions_scope":[{"source_index":0,"quote":"A compromised OpenClaw instance provides immediate access to sensitive directories, including ~/.ssh/ keys, AWS/cloud credentials, and authenticated browser sessions."}],"event.incident_class":[{"source_index":0,"quote":"New research released today by the SecurityScorecard STRIKE Threat Intelligence Team reveals that 15,200 instances of the popular OpenClaw framework (formerly known as Moltbot) are vulnerable to Remote Code Execution (RCE), allowing attackers to take full control of the host machines."}],"event.agent_involved":[{"source_index":0,"quote":"Unlike traditional web servers intended for public access, these are often personal workstations or cloud instances running AI agents that were inadvertently exposed due to insecure default settings."}],"event.detection_method":[{"source_index":0,"quote":"New research released today by the SecurityScorecard STRIKE Threat Intelligence Team reveals that 15,200 instances of the popular OpenClaw framework (formerly known as Moltbot) are vulnerable to Remote Code Execution (RCE), allowing attackers to take full control of the host machines."}],"event.root_cause_detail":[{"source_index":0,"quote":"The core issue stems from OpenClaw’s default configuration, which binds the service to 0.0.0.0:18789 listening on all network interfaces rather than the secure 127.0.0.1 (localhost) standard."}],"impact.severity":[{"source_index":0,"quote":"New research released today by the SecurityScorecard STRIKE Threat Intelligence Team reveals that 15,200 instances of the popular OpenClaw framework (formerly known as Moltbot) are vulnerable to Remote Code Execution (RCE), allowing attackers to take full control of the host machines."}],"event.remediations":[{"source_index":0,"quote":"The primary mitigation is to update to version 2026.2.1 or later, which addresses the RCE vulnerabilities."}],"event.summary":[{"source_index":0,"quote":"New research released today by the SecurityScorecard STRIKE Threat Intelligence Team reveals that 15,200 instances of the popular OpenClaw framework (formerly known as Moltbot) are vulnerable to Remote Code Execution (RCE), allowing attackers to take full control of the host machines."},{"source_index":0,"quote":"The core issue stems from OpenClaw’s default configuration, which binds the service to 0.0.0.0:18789 listening on all network interfaces rather than the secure 127.0.0.1 (localhost) standard."},{"source_index":0,"quote":"The STRIKE team’s reconnaissance identified 42,900 unique IP addresses hosting exposed OpenClaw control panels across 82 countries."},{"source_index":0,"quote":"While patches were released in version 2026.1.29 on January 29, STRIKE’s data indicates that 78% of exposed instances are still running older versions branded as “Clawdbot” or “Moltbot,” leaving them defenseless against these exploits."},{"source_index":0,"quote":"The exposure is compounded by the fact that 53,300 of the identified instances correlate with prior breach activity, suggesting that many of these agents are running in environments that have already been compromised or flagged for high-risk behavior."},{"source_index":0,"quote":"The primary mitigation is to update to version 2026.2.1 or later, which addresses the RCE vulnerabilities."}]},"notes_on_gaps":"Single secondary source: a press article reporting third-party research by SecurityScorecard STRIKE; no primary report or government evaluator was provided. No date of occurrence, no confirmed exploitation or actual loss, and no count of records or affected third parties was stated. The 15,200 figure is a count of vulnerable instances, not confirmed affected parties; treating it as a stated count of affected parties for the major tier is my judgement. The 42,900 IP addresses and 53,300 correlation figures are not treated as confirmed incidents. The APT and threat-actor correlations are described as proximity or correlation, not as confirmed attacks, so no adversarial_actor or failure_class is recorded. No autonomous agent action is described, so no failure_class is given. No trigger, responsible party, deployment context, lifecycle stage, autonomy level, guardrails, developer, model name or version were stated for this incident. The 2026-02-10 disclosure date is taken from the article date and the 'released today' wording. The harm_class entry describes what attackers could do with access, not a confirmed harm. Control outcomes for E1, A4 and A1 are inferred from the described CVE and attack behaviour in this incident. Remediation entries are recommendations from the researchers, not changes reported as made by OpenClaw or any deployer. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Cyber Security News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The default configuration bound the control panel to all network interfaces instead of localhost, exposing it to the internet.","quote":"The core issue stems from OpenClaw’s default configuration, which binds the service to 0.0.0.0:18789 listening on all network interfaces rather than the secure 127.0.0.1 (localhost) standard.","source_index":0,"grade":"C"},{"step":"reached","text":"Reconnaissance identified 42,900 unique IP addresses hosting exposed control panels across 82 countries.","quote":"The STRIKE team’s reconnaissance identified 42,900 unique IP addresses hosting exposed OpenClaw control panels across 82 countries.","source_index":0,"grade":"C"},{"step":"caught","text":"The SecurityScorecard STRIKE Threat Intelligence Team found the exposure through research and published it.","quote":"New research released today by the SecurityScorecard STRIKE Threat Intelligence Team reveals that 15,200 instances of the popular OpenClaw framework (formerly known as Moltbot) are vulnerable to Remote Code Execution (RCE), allowing attackers to take full control of the host machines.","source_index":0,"grade":"C"},{"step":"done","text":"Patches existed from January 29, but the researchers' data indicates 78% of exposed instances still ran older versions.","quote":"While patches were released in version 2026.1.29 on January 29, STRIKE’s data indicates that 78% of exposed instances are still running older versions branded as “Clawdbot” or “Moltbot,” leaving them defenseless against these exploits.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/openclaw-control-panels-exposed/"]},"analysis":{"sections":{"timeline":[{"text":"Patches released in OpenClaw version 2026.1.29.","quote":"While patches were released in version 2026.1.29 on January 29, STRIKE’s data indicates that 78% of exposed instances are still running older versions branded as “Clawdbot” or “Moltbot,” leaving them defenseless against these exploits.","source_index":0,"when":"2026-01-29"},{"text":"The researchers recommended updating to version 2026.2.1 or later as the primary mitigation.","quote":"The primary mitigation is to update to version 2026.2.1 or later, which addresses the RCE vulnerabilities.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/openclaw-control-panels-exposed/"]}}