Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Hundreds of Exposed Clawdbot Gateways Leave API Keys and Private Chats Vulnerable

## Cybersecurity: Clawdbot Security Concerns

GBy Grace BennettJan 26, 20261 min read

Cybersecurity: Clawdbot Security Concerns

Clawdbot, an open-source AI agent gateway, is encountering significant security challenges. Over 900 unauthenticated instances have been exposed online, revealing vulnerabilities that could lead to credential theft and remote code execution.

Clawdbot functions as a personal AI assistant, compatible with messaging platforms such as WhatsApp, Telegram, Slack, Discord, Signal, and iMessage. It includes a Gateway for managing WebSocket handling, tool execution, and credential management, alongside a web-based Control UI for configuration, conversation history, and API key management.

Deployed via npm on Node.js version 22 or higher, Clawdbot defaults to loopback binding on port 18789. It can be accessed remotely using Tailscale or reverse proxies like nginx and Caddy.

Research by Jamieson O'Reilly, highlighted on January 23, 2026, identified misconfigurations in the Clawdbot gateway. Utilizing Shodan , O'Reilly found hundreds of public instances shortly after deployment. Unauthenticated Gateways were discovered on port 18789, some exposing configurations, API keys, and chat histories.

Clawdbot, an open-source AI agent gateway, is encountering significant security challenges.
Grace Bennett · Thehackingpost

Clawdbot's authorization logic allows localhost auto-approval, intended for local development. This can be exploited when used with reverse proxies that forward traffic via 127.0.0.1, bypassing security checks. The setting gateway.trustedProxies defaults to empty, ignoring X-Forwarded-For headers, which O'Reilly confirmed through source code analysis.

To mitigate risks, the Clawdbot documentation suggests performing a clawdbot security audit –deep to identify exposures and adjust policies. It is recommended to set trustedProxies: [“127.0.0.1”] and configure proxy headers to prevent spoofing. Users should consider using Tailscale Serve/Funnel or Cloudflare Tunnels instead of direct binds.

Exposed servers can lead to severe security compromises, including credential theft and unauthorized command execution. It is advised to rotate secrets following exposure and apply security measures for proxy hardening and least-privilege defaults. The latest Clawdbot release (2026.1.14-1, Jan 15) predates these reports, so users should run clawdbot doctor for necessary migrations.

Advertisement

Immediate audits are essential to prevent unauthorized access and protect high-value assets managed by AI agents. Implementing recommended security configurations will help safeguard against potential threats.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026