Clawdbot, an open-source personal AI assistant that connects with apps like WhatsApp and Telegram, has drawn heavy attention this week. The attention shifted quickly after Dvuln founder Jamieson O’Reilly warned that a bad gateway setup could create a severe security hole, allowing attackers to bypass authentication and obtain root access.
Trusted localhost logic breaks behind reverse proxies
The issue comes from the system’s default trust in connections from 127.0.0.1. When users place Clawdbot behind reverse proxies such as Nginx or Caddy, outside traffic can be treated as trusted local traffic. That collapses the authentication barrier. An attacker could then read configuration files containing API keys and OAuth secrets.
The exposure goes beyond credentials. According to the warning, attackers may also access months of private chat history stored from Slack, Telegram, Discord, Signal, and WhatsApp, turning a deployment mistake into a broad privacy and account security problem.
Reported case links the flaw to crypto wallet losses
The risk becomes much more serious once root access is in hand. Attackers may execute shell commands on the underlying system, or use prompt injection to push the AI agent into harmful actions. On X, a cryptocurrency user reported that after installing Clawdbot, the crypto wallets on their computer were emptied. That places the flaw in a category that can affect not only data, but also funds.
Researchers urge whitelisting and isolated deployment
The advice from security specialists is immediate: public-facing deployments should apply port whitelisting without delay. They also recommend running Clawdbot on a dedicated VPS or virtual machine instead of a daily-use device that stores private keys. For access, Tailscale Serve or SSH tunneling is preferred over direct public internet exposure.
They also said the AI agent’s scope should be constrained to specific folders rather than the root directory. For users already connecting Clawdbot to Claude or using it for automation tasks, server configuration has become the central point of risk control.