Critical security flaws in the AI assistant Clawdbot expose sensitive data, prompting urgent calls for improved protection measures.
Security experts have identified serious vulnerabilities within Clawdbot, an AI assistant that could inadvertently compromise personal data and API keys. Reports suggest that numerous instances of the AI assistant are accessible without proper authentication, putting a significant amount of sensitive information at risk.
🚨 SlowMist TI Alert 🚨
Serious exposure of the Clawdbot gateway has been revealed, with hundreds of API keys and private chat logs potentially vulnerable. Several unauthenticated instances can be accessed publicly, and various code flaws may lead to data theft and remote code execution (RCE).
We urge immediate action.
— SlowMist (@SlowMist_Team) January 27, 2026
SlowMist has recommended implementing stringent IP whitelisting measures to secure open ports and prevent unauthorized access.
Security researcher Jamison O'Reilly pointed out that many users have carelessly left their Clawdbot management servers exposed to the public. Using tools like Shodan, he easily located numerous open servers by searching for specific identifiers within the HTML code.
Details of the Vulnerabilities
Clawdbot connects large language models to messaging platforms and operates through a web interface known as Clawdbot Control. The vulnerabilities arise mainly when the gateway is improperly protected by a reverse proxy.
"Finding accessible Clawdbot Control requests took just seconds; I received hundreds of results using basic tools," O'Reilly noted.
He was able to access a wealth of sensitive information, including API keys, bot tokens, and full chat histories, alongside the capability to send messages and execute commands on behalf of users.
"If you're utilizing this AI infrastructure, check your configuration immediately to see what data is exposed online," he cautioned.
Rapid Data Theft Demonstrated
Matvey Kukuy, CEO of Archestra AI, shared an alarming incident where he successfully acquired an OpenSSH key within just five minutes. By employing a prompt injection attack through email, he managed to have Clawdbot retrieve the private key from a compromised machine.
"It took only five minutes to execute this attack, which underscores the need for robust security measures. That's why we focus on building non-probabilistic agentic security at Archestra," Kukuy stated.
Unlike many other AI agents, Clawdbot has full access to a user's computer, allowing it to read and write files, execute commands, and control browsers. In light of these significant security concerns, stakeholders are urged to reassess their use of the AI assistant.
Earlier this month, SlowMist also discovered a "future attack" vulnerability in the Linux store, highlighting ongoing risks in AI infrastructure security.
