TL;DR: OpenClaw = Moltbot = Clawdbot (Same Vulnerabilities)
Key finding: OpenClaw is the third name for the same codebase. All vulnerabilities we reported in Moltbot remain present. The rebrand was for trademark reasons, not security.
The Rebrand Timeline: Clawdbot to Moltbot to OpenClaw
Three names in three months. Each rebrand was triggered by external pressure - never by security concerns:
Peter Steinberger acknowledged the name changes were due to trademark concerns from Anthropic. The security vulnerabilities that expose 900+ instances remain unchanged across all versions.
Industry Expert Warnings About OpenClaw/Moltbot
Don't run Clawdbot.
How could someone trust that thing with full system access?
8 Critical Vulnerabilities in OpenClaw (Unchanged from Moltbot)
The Argus Security audit identified 512 findings. These 8 critical vulnerabilities enable full system compromise from the network without authentication:
CVE-2025-49596Reverse proxy makes all connections appear as localhost
CVE-2025-6514Command injection via OAuth endpoint in MCP servers
Tokens stored unencrypted at ~/.openclaw/credentials/
skipVerification option allows complete bypass
Base64-encoded client secrets in source code
Agent directory paths not validated
State validation uses flawed nullish coalescing
File-based locking fails causing race conditions
CVE-2025-49596: The Localhost Trust Assumption
The root cause remains the same flawed assumption: "If you can reach localhost, you're already on the machine." In reality, Docker networks, reverse proxies, and cloud deployments routinely expose localhost to the internet.
┌──────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Attacker │ ──► │ nginx/Caddy │ ──► │ OpenClaw Gateway│
│ (Internet) │ │ (Reverse Proxy) │ │ (Port 8080) │
└──────────────┘ └─────────────────┘ └─────────────────┘
│
clientIp = 127.0.0.1
isLocalClient = true
nonceRequired = false
│
┌─────────▼─────────┐
│ FULL ACCESS │
│ No auth needed │
└───────────────────┘Exposed API Endpoints in OpenClaw Instances
When authentication is bypassed, these endpoints become accessible to any attacker:
| Endpoint | Risk | Exposed Data |
|---|---|---|
| /api/config | CRITICAL | Full configuration with API keys, tokens, secrets |
| /api/agents | CRITICAL | Agent list, settings, and auth profiles |
| /api/tools | HIGH | Available tools and execution permissions |
| /gateway/status | HIGH | Gateway status and authentication tokens |
| /api/sessions | HIGH | Session transcripts and conversation logs |
Plaintext Credential Storage Locations
OpenClaw stores all credentials in plaintext JSON files. 181 unique secrets have leaked to public repositories, with 65 still valid at time of detection:
~/.openclaw/clawdbot.json~/.openclaw/credentials/oauth.json~/.openclaw/identity/device-auth.json~/.openclaw/credentials/whatsapp/*/creds.json~/.openclaw/agents/*/agent/auth-profiles.json~/.openclaw/agents/*/sessions/*.jsonlInfostealers Now Targeting OpenClaw Installations
Major malware families updated their targeting within 24 hours of OpenClaw's release:
Added OpenClaw directory enumeration
Targeting credential JSON files
Harvesting conversation logs
MITRE ATT&CK Mapping
| Technique | Name | OpenClaw Relevance |
|---|---|---|
| T1133 | External Remote Services | Exposed gateway instances |
| T1210 | Exploitation of Remote Services | CVE-2025-49596 auth bypass |
| T1552.001 | Credentials In Files | Plaintext credential storage |
| T1574 | Hijack Execution Flow | Skill/plugin poisoning |
| T1659 | Content Injection | Prompt injection attacks |
| T1195.002 | Supply Chain Compromise | ClawdHub malicious skills |
Minimum Secure Configuration for OpenClaw
If you must run OpenClaw, this is the minimum configuration to prevent unauthenticated access:
gateway:
bind: "127.0.0.1:8080"
auth:
token: "${OPENCLAW_AUTH_TOKEN}"
trustedProxies:
- "10.0.0.0/8"
agents:
defaults:
sandbox:
enabled: true
scope: "session"
dm:
policy: "pairing"
tools:
elevated:
allowFrom: []Immediate Remediation Steps
If you run OpenClaw, Moltbot, or Clawdbot, take these steps immediately:
# 181 secrets leaked - 65 still valid # Rotate immediately: - LLM API keys (OpenAI, Anthropic) - OAuth tokens (Google, Slack, Discord) - Bot tokens (Telegram, WhatsApp) - SSH keys if exposed
gateway:
auth:
token: "$(openssl rand -hex 32)"gateway:
trustedProxies:
- "10.0.0.0/8"
- "172.16.0.0/12"
- "192.168.0.0/16"npm update mcp-remote@latest # Fixes CVE-2025-6514 (CVSS 9.6)
# Fixes: # CVE-2025-59466 (async_hooks DoS) # CVE-2026-21636 (permission bypass)
Related Research
Our original research on Moltbot/Clawdbot that documented the same vulnerabilities before the OpenClaw rebrand.
CVE-2026-22778 (CVSS 9.8). 175,000+ exposed servers across 130 countries. Heap overflow via malicious video enables RCE.
Is Your AI Infrastructure Secure?
OpenClaw is just one of many AI tools with security issues. We audit AI agent deployments, LLM integrations, and agentic infrastructure before attackers find your vulnerabilities.
This research was conducted following responsible disclosure practices. All testing was limited to benign enumeration. No user data was accessed or stored.