Security firm SlowMist has issued a warning that numerous Clawdbot instances are exposed online due to misconfigured gateways and admin panels, putting hundreds of API keys, bot tokens, OAuth secrets, and months of private chat logs at risk. The issue stems from Clawdbot's architecture: its gateway handles AI agent logic (message routing, tool execution, credential management), while the web-based Control interface manages integrations, conversation histories, and API keys. When left misconfigured or publicly accessible, attackers gain full system access.
Exposed Gateways & Control Interfaces: What Attackers Can Do
Researcher Jamieson O'Reilly described the severity with a blunt analogy: "Imagine you come home and find the front door wide open, your butler cheerfully serving tea to whoever wandered in off the street." Attackers with access to the Control interface can read full configurations and conversation histories, impersonate operators across Telegram, Discord, Slack, Signal, and WhatsApp, modify messages, exfiltrate data, and execute commands remotely. Several publicly exposed instances required no authentication at all for root access.
O'Reilly noted: "Full credential theft, complete conversation history, active impersonation capabilities… you can maintain access indefinitely without the operator ever knowing." Worse still, many deployments had default authentication but contained a key flaw: the system auto-approves localhost connections, which reverse proxies often misinterpret as local. This lets even supposedly "secure" setups leak data to the internet.
Developers & AI Engineers Must Act Now
Affected groups include developers, AI engineers, and organizations running Clawdbot. Researchers urge: IP whitelisting must be strictly enforced; the gateway.auth.password should always be configured; and trusted proxies must be explicitly set to prevent unauthorized reverse proxies from bypassing authentication. No official patch has been released yet — users must secure their deployments manually.