Cases › security breach › LR-2026-0373
Critical Clawdbot vulnerabilities found enabling cryptocurrency theft
Preliminary Why: 1 report: ForkLog · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties with a stated count of two or more. Fact: the researcher states hundreds of people configured publicly accessible management servers.
Clawdbot is an open AI assistant developed by entrepreneur Peter Steinberger, and it runs locally on the user's device. It was reported to have full system access, including reading and writing files, executing commands and controlling browsers. A misconfigured reverse proxy allowed the gateway's authentication to be bypassed, and a security researcher reported that hundreds of management servers were publicly accessible. Using an email containing a prompt injection, Archestra AI CEO Matvey Kukuy obtained an OpenSSH private key in five minutes. Researcher Jamison O'Reilly reported access to API keys, bot tokens, OAuth secrets, signing keys and chat histories. SlowMist issued an alert on January 27, 2026 about exposed gateways and possible credential theft and remote code execution, and urged strict IP whitelisting for open ports. The sources do not report confirmed losses from theft.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
HarnessOutside content treated as data, not instructions · Prompt-injection detection · Confirmation after untrusted input · Validation of tool inputs and outputs · Tool allow-list
ApplicationHuman approval for high-impact actions · Least-privilege access for the agent · Segmentation of agent components · Alerts on unusual tool use
Similar incidents
Evidence
- What set it off hidden instructions in its input
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
- January 24-25 Clawdbot went viral over the weekend.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
No confirmed theft or direct financial loss is reported; the Kukuy key retrieval was a demonstration by a researcher and the sources do not say whether real funds were stolen.
LR-2026-0373 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON