TL;DR: Moltbot/Clawdbot Security Findings Summary
Affected data: OpenAI/Anthropic API keys, SSH private keys, WhatsApp/Telegram/Slack conversations, Discord webhooks, AWS credentials, and complete user chat histories with AI assistants.
Methodology: Scanning Moltbot Gateways and Exposed Admin Ports
Our investigation began with a simple Shodan query targeting Moltbot and Clawdbot gateway signatures. The results revealed a widespread exposure problem affecting servers across 13+ countries.
The high concentration in certain hosting providers (Hetzner: 593, DigitalOcean: 217) suggests many deployments are developer/hobbyist setups following tutorials without security hardening.
The Localhost Bypass Vulnerability in Moltbot/Clawdbot
The root cause is elegant in its simplicity and devastating in its impact. We analyzed the npm package source code and found the exact vulnerable logic:
Assumption: "If you can reach localhost, you're already on the machine."
Reality: Docker networks, reverse proxies (nginx, Cloudflare, Caddy), and cloud deployments routinely make "localhost" reachable from the internet.
┌──────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Attacker │ ──► │ nginx/Cloudflare│ ──► │ Moltbot Gateway │
│ (Internet) │ │ (Reverse Proxy) │ │ (Port 18789) │
└──────────────┘ └─────────────────┘ └─────────────────┘
│
clientIp = 127.0.0.1
isLocalClient = true
nonceRequired = false
│
┌─────────▼─────────┐
│ FULL ACCESS │
│ No auth needed │
└───────────────────┘Findings: 55 JSON-RPC Methods Exposed in Moltbot Gateways
We extracted and enumerated all exposed JSON-RPC methods from the gateway's JavaScript bundle. The attack surface is extensive, with methods enabling everything from credential theft to remote code execution.
system.runArbitrary shell command executionconfig.getFull configuration with API keysskills.installInstall arbitrary code (RCE vector)cron.addSchedule persistent backdoorsexec.approval.approveBypass execution approvalschat.historyRead all private conversationschat.sendSend messages as the usersessions.listEnumerate active sessionslogs.tailRead system and application logsagents.listList configured AI agentsAdditional methods discovered include session management, channel operations, node administration, and operator permissions - totaling 55 distinct attack vectors.
Live Testing: Verifying Moltbot Server Exposures
We tested 4 servers that appeared active on Shodan, connecting via WebSocket to verify the exposure. All accepted connections and responded with challenge-response authentication prompts.
| Server | Port | Location | Finding |
|---|---|---|---|
| 107.174.96.242 | 18789 | 🇺🇸US | WebSocket active, challenge-response enabled |
| 139.198.181.234 | 9002 | 🇨🇳CN | WebSocket active, accepts connections |
| 175.24.206.252 | 8081 | 🇨🇳CN | WebSocket active, RPC enumerable |
| 175.24.206.252 | 18789 | 🇨🇳CN | WebSocket active, multi-port exposure |
Our testing was limited to connection verification and method enumeration. No user data was accessed, exfiltrated, or stored.
Attack Techniques Tested Against Moltbot Servers
We systematically tested multiple attack vectors to understand what works and what doesn't. This helps defenders prioritize mitigations.
Impact: Data Leaks from AI Agent Gateways
When a Moltbot/Clawdbot server is compromised, attackers gain access to sensitive data stored in configuration files, chat histories, and connected integrations.
- OpenAI API keys (sk-...)
- Anthropic API keys (sk-ant-...)
- AWS credentials
- SSH private keys
- WhatsApp chat history
- Telegram messages
- Slack channels & DMs
- Discord server messages
- Signal pairing credentials
- Telegram bot tokens
- Slack OAuth credentials
- Discord webhooks
- Custom integrations
- Shell command execution
- Cron job manipulation
- File system access
- Root privileges (some cases)
CVE-2025-49596, CVE-2025-6514 and CVE-2025-52882 in Moltbot Ecosystems
CVE-2025-6514The system.run RPC method allows arbitrary command execution. Combined with the localhost bypass, an attacker can achieve root-level access in a single unauthenticated request.
CVE-2025-49596WebSocket API exposed without network-level restrictions. Default configurations allow remote connections, and the localhost trust assumption is bypassed via reverse proxy.
CVE-2025-52882Configuration files readable via config.get expose API keys and tokens. Combined with skills.install, attackers can achieve persistent code execution.
Findings: 1,673 Exposed Moltbot Servers - Geographic Distribution
By Country
By Hosting Provider
High concentration in Hetzner suggests developer/hobbyist deployments without security review.
Mitigation: How to Secure Moltbot and Similar AI Gateways
If you run Moltbot/Clawdbot, take these steps immediately to secure your deployment:
shodan search "clawdbot-gw" --fields ip_str,port | grep YOUR_IP
export REQUIRE_AUTH=true export AUTH_TOKEN=$(openssl rand -hex 32)
# In config gateway: host: 127.0.0.1 # NOT 0.0.0.0 port: 18789
# If using reverse proxy
gateway:
trustedProxies:
- 10.0.0.0/8
- 172.16.0.0/12# Immediately rotate: - All LLM API keys - Bot tokens - OAuth credentials - SSH keys if exposed
Disclosure Timeline
Is Your AI Gateway Secure?
We found these vulnerabilities through systematic research. The same methodology can audit your specific deployment before attackers find it.
This research was conducted following responsible disclosure practices. All testing was limited to benign enumeration. No user data was accessed or stored.