Cases › security breach › LR-2026-0385
Clawdbot/Moltbot AI agent gateways exposed on the internet with secrets accessible
Confirmed Why: 2 independent outlets · 2 independent reports
Status: fix reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity moderate: Test: data or systems of others touched with a bounded scope stated. Fact: eight examined instances were open with no authentication, exposing full access to run commands and configuration data.
Clawdbot is an open-source personal AI assistant that can execute commands and read credentials on the user's machine, and its gateway exposes a control panel. Its authentication logic automatically trusts localhost connections, and behind reverse proxies outside traffic can appear local, while the trusted-proxies setting is empty by default. Security researcher Jamieson O'Reilly used Shodan to find hundreds of exposed instances, and eight he examined manually had no authentication at all. Exposed gateways could reveal API keys, bot tokens and chat histories. Some secrets were also stored in plaintext local files. O'Reilly reported the attack model to the developers, and he says it is now fixed. A separate proof-of-concept showed a benign skill could run commands on instances that installed it.
What happened
What was done
“attack model reported to the developers is now fixed”
No later incident for Peter Steinberger under this risk on record.
Risks
Read from the sources; not yet reviewed by a person.
Controls
HarnessNot effective Fail-closed defaults
Not effective Fail-closed defaults
Effective Multi-factor sign-in and password policy
Control failure chain
L1 · ModelPeter SteinbergerModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Least-privilege access for the agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.
L4 · Infrastructure / targetOrganisation hit
Other controls for this risk at this layer, not mentioned in the sources: Secrets scanning.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Fail-closed defaults | L2 Harness | Not effective |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Separate identity for each agent | L3 Application | Not stated in sources |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Secrets kept out of the model's context | L3 Application | Not stated in sources |
| Activity logs | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
| Sensitive-data checks on outbound data | L3 Application | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Effective |
| Secrets scanning | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: what the AI was doing, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 2 items from the primary sources
What happened, in order
- 2026-01-23 Researcher Jamieson O'Reilly detailed the exposure issue in an X thread.
Not dated in the sources:
- The reported attack model was later stated to be fixed. No date is given.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The remediation is reported secondhand by The Register as a fix, and the trusted-proxies docs change is not separately dated. Hudson Rock and SlowMist claims are not recorded as separate controls because the sources do not state whether they held or failed in this incident.
LR-2026-0385 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON