AI Risk Wire

Cases › security breach › LR-2026-0420

15,200 OpenClaw control panels with full system access exposed online

Preliminary Why: 1 report: Cyber Security News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: advice only, no fix reported

Severity major
Reported 10 Feb 2026
Agent tool OpenClaw

No source states: loss or records, developer and model, could do, deployer, industry.

Security researchers at SecurityScorecard STRIKE reported that 15,200 instances of the OpenClaw agent framework, formerly known as Moltbot, were vulnerable to remote code execution, which would let attackers take full control of host machines. The service's default configuration binds to all network interfaces rather than localhost, so control panels for AI agents were reachable from the internet. Reconnaissance identified 42,900 unique IP addresses hosting exposed control panels across 82 countries. Patches were released in version 2026.1.29, yet the researchers' data indicates that 78% of exposed instances still ran older versions. The research also found that 53,300 identified instances correlate with prior breach activity. The research was released on 2026-02-10. The researchers urged users to update to version 2026.2.1 or later, bind to localhost, and rotate credentials.

What happened

1 · What went wrongThe default configuration bound the control panel to all network interfaces instead of localhost, exposing it to the internet.
2 · What it reached or didReconnaissance identified 42,900 unique IP addresses hosting exposed control panels across 82 countries.
3 · How it was caughtThe SecurityScorecard STRIKE Threat Intelligence Team found the exposure through research and published it.

What was done

Patches existed from January 29, but the researchers' data indicates 78% of exposed instances still ran older versions.
Advice in source, not a fix by the party

“The primary mitigation is to update to version 2026.2.1 or later, which addresses the RCE vulnerabilities.”

Known flaws patched

Risks

AI system attacked or breached
Primary23 incidents
Credential and privilege abuse
Also37 incidents
Agent escapes its sandbox
Also19 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Evidence

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 2 items from the primary sources

What happened, in order

  1. 2026-01-29 Patches released in OpenClaw version 2026.1.29.

Not dated in the sources:

  • The researchers recommended updating to version 2026.2.1 or later as the primary mitigation.
Show every field, with its source and grade

The AI system

Software around the model
OpenClaw
C one secondary source states it
What it was allowed to do
access to sensitive directories, cloud credentials and authenticated browser sessions
C one secondary source states it
What it was for
personal automation
C one secondary source states it

What happened

Earliest source we hold
2026-02-10
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
Cause in detail
Default configuration binds the service to 0.0.0.0:18789 on all network interfaces instead of 127.0.0.1
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown
secondary risks
RK03, RK05
D inferred by us from the described behaviour, reason shown
remediations
kind: advice; controls added: J1; quote: The primary mitigation is to update to version 2026.2.1 or later, which addresses the RCE vulnerabilities.; source index: 0
C one secondary source states it

Impact

Severity
major
D inferred by us from the described behaviour, reason shown

Notes on gaps

No date of occurrence, no confirmed exploitation or actual loss, and no count of records or affected third parties was stated. The 42,900 IP addresses and 53,300 correlation figures are not treated as confirmed incidents. Control outcomes for E1, A4 and A1 are inferred from the described CVE and attack behaviour in this incident. Remediation entries are recommendations from the researchers, not changes reported as made by OpenClaw or any deployer.

LR-2026-0420 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON