Full Report
Moltbot, the viral AI agent, offers immense power but is riddled with critical vulnerabilities, including remote code execution (RCE), exposed control interfaces, and malicious extensions. Read on to understand the vulnerabilities associated with Moltbot and the immediate security practices users must prioritize to mitigate this enormous agentic AI security risk.Key takeawaysMoltbot takes an AI agent, gives it access to your computer, your communication streams, your accounts, and much, much more.Given the severe and active threats, including exposed control interfaces, authentication bypasses, and malicious extensions, users must prioritize the security practices outlined below.The convenience of incredible power cannot outweigh the risk that Moltbot’s vulnerabilities create.What is Clawdbot?Clawdbot (recently rebranded as Moltbot and subsequently to OpenClaw due to a trademark dispute with Anthropic) is a viral open-source AI assistant. It has been praised for its ability to autonomously execute tasks on local hardware, exemplifying what modern AI can do to truly help end users. As of January 2026, and coinciding with the application's widespread viral adoption, security researchers have identified multiple significant vulnerabilities that place Moltbot users at risk.What is Moltbot used for?Moltbot is a multi-function AI agent designed to perform many tasks. Indeed, the website claims it “Works With Everything.” Some features include:Setup: Runs on any machine with a choice of models.Integrations: Works with any chat appBrowse the Web: Submit forms on your behalf, find information.Memory: Remembers context about you and your preferencesExtensible: Use or write plugins and skillsAccess: Ability to read and write to disk, execute commands, and more.Sandbox: Tools and agents can run inside Docker containers and require approval.The agent already has an enormous list of official and custom integrations. Given the large feature set, Moltbot must also have a large attack surface. Let’s take a look at Moltbot from an agentic AI security perspective.Is Moltbot safe? Critical agentic AI security vulnerabilitiesRemote code execution (RCE): Coding issues in the gateway could allow attackers to run commands on the host system with the same permissions as the user, potentially leading to full system compromise. A researcher from depthfirst identified CVE-2026-25253, chaining two findings to execute code on the bot. Two more command injection CVEs have been identified (CVE-2026-24763 and CVE-2026-25157).Malicious skills: An OpenClaw bot at Koi identified a few hundred malicious skills in the ClawHub skills repo.Exposed control interfaces: Researchers from SlowMist and other firms found that many users misconfigure their setups, leaving the Clawdbot Control web interface publicly accessible on the internet without password protection.Authentication bypass: A flaw in how the gateway handles localhost connections allows external attackers to bypass login protections when the software is deployed behind a common reverse proxy (like Nginx).Sensitive data leaks: Moltbot stores authentication tokens (API keys), user profiles, and memories in plaintext Markdown and JSON files. Attackers who gain access can steal these keys to take over accounts or conduct Cognitive Context Theft using private conversation histories.Indirect prompt injection: Because the tool can read emails, chat messages, and web pages, malicious actors can send messages that trick the AI into executing unauthorized commands, such as exfiltrating data or deleting files.Recent risks and rebrandingTrademark rebrand: On January 27, 2026, the project was renamed Moltbot following a legal request from Anthropic.Account hijacking: During the name change, the original @clawdbot handles on X and GitHub were immediately snatched by crypto scammers who are now using them to promote fake tokens ($CLAWD) to the project's more than 60,000 followers.Second trademark rebrand: On January 29, the project was renamed OpenClaw.Malicious extensions: Fake "Clawdbot Agent" extensions for VS Code have been discovered. These fake extensions install trojans and remote access malware on users’ machines.Recommended security practices for Moltbot usersIf you choose to run this software, security experts recommend several immediate hardening steps:Strict whitelisting: Use the OpenClaw Security Guide to explicitly whitelist only necessary tools and block dangerous shell execution capabilities.Verify gateway settings: Ensure gateway.auth.password is set and verify that your reverse proxy correctly passes headers so authentication is not bypassed.Use sandboxing: Enable sandbox mode for the AI agent to restrict its access to your filesystem and browser.Run security audits: Use the built-in security audit tool periodically to check for exposed ports or misconfigurations.Restrict token access: Moltbot uses API keys and other tokens to access services. These should all be scoped appropriately to allow just enough access and disallow dangerous actions.Privacy: Moltbot can be added to group channels where it can read and parse untrusted messages. To help mitigate the risk of prompt injection, grant access only to trusted people and channels.Tenable plugins for Moltbot and OpenClawTenable Vulnerability Management has detection plugins for Moltbot. A list of Tenable plugins for this vulnerability can be found on the search page for Moltbot and OpenClaw as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.
Analysis Summary
# Vulnerability: Critical Flaws in Agentic AI Agent Moltbot (Clawdbot/OpenClaw)
## CVE Details
- CVE ID: Enumerated CVEs including CVE-2026-25253, CVE-2026-24763, and CVE-2026-25157. (Specific CVSS scores were not provided in the text.)
- CVSS Score: N/A (Specific scores not published in source material)
- CWE: Likely includes CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and potentially others related to access control/configuration.
## Affected Systems
- Products: Moltbot (formerly Clawdbot, now OpenClaw), open-source AI assistant.
- Versions: All widespread versions exhibiting the identified flaws (implied across versions deployed prior to patches).
- Configurations: Any setup where control interfaces are exposed publicly without passwords, or where reverse proxies are misconfigured, allowing authentication bypass.
## Vulnerability Description
Moltbot, an AI agent with extensive local system access, suffers from multiple severe security flaws. Key issues include:
1. **Remote Code Execution (RCE):** Coding mistakes in the gateway allow chaining vulnerabilities (documented as CVE-2026-25253) to execute arbitrary commands on the host system with the user's permissions. Command injection flaws (CVE-2026-24763, CVE-2026-25157) are also present.
2. **Exposed Control Interfaces:** Many user installations misconfigure the Control web interface, leaving it publicly accessible and unauthenticated.
3. **Authentication Bypass:** A flaw in gateway handling for localhost connections allows external attackers to bypass login protections when deployed behind common reverse proxies like Nginx.
4. **Sensitive Data Exposure:** Authentication tokens (API keys), user profiles, and conversational memories are stored in plaintext (Markdown/JSON), leading to Cognitive Context Theft upon access.
5. **Malicious Extensions/Skills:** The agent supports extensible plugins, and hundreds of malicious skills have been identified in the ClawHub skills repo. Furthermore, fake malicious VS Code extensions have been discovered.
6. **Indirect Prompt Injection:** The ability to read emails, chats, and web pages allows malicious actors to embed commands in untrusted data sources to trick the AI into unauthorized actions (e.g., data exfiltration).
## Exploitation
- Status: Critical and actively threatened. RCE exploits are confirmed to be chained (CVE-2026-25253 identified by depthfirst). Unofficial channels (scammers) capitalized on the rebranding to promote malware (fake VS Code extensions).
- Complexity: Variable. RCE requires chaining, while exposed interfaces are trivial to exploit if misconfigured.
- Attack Vector: Network (for exposed interfaces/RCE), Adjacent (via channel access for prompt injection).
## Impact
- Confidentiality: High (Potential theft of API keys, user profiles, conversational history).
- Integrity: Critical (System compromise via RCE/Command Injection).
- Availability: Medium (Denial of service is possible, but data compromise is the primary concern).
## Remediation
### Patches
- The article implies that security guides are available to address configuration issues, but mandatory upgrade patches addressing the core CVEs were not explicitly listed by version number. Users are directed to the OpenClaw Security Guide for guidance.
### Workarounds
Recommended immediate hardening steps for users choosing to continue running the software:
1. **Strict Whitelisting:** Explicitly whitelist only necessary tools and block dangerous shell execution capabilities using the OpenClaw Security Guide.
2. **Verify Gateway Authentication:** Ensure `gateway.auth.password` is set and confirm reverse proxy configurations correctly pass necessary authentication headers.
3. **Enable Sandboxing:** Restrict the agent's access to the filesystem and browser by enabling sandbox mode.
4. **Restrict Token Scope:** API keys/tokens must be scoped minimally—allowing only necessary actions and disallowing dangerous operations.
5. **Privacy Reduction:** Limit access to read untrusted messages by granting the agent access only to trusted people and channels to mitigate prompt injection risks.
## Detection
- **Detection Methods & Tools:** Users should run the built-in security audit tool periodically to check for exposed ports or misconfigurations. Tenable Vulnerability Management has detection plugins available for Moltbot and OpenClaw.
- **Indicators of Compromise:** Look for unexpected command executions traceable to the agent or the presence of trojans/remote access malware installed via fake VS Code extensions.
## References
- Vendor advisories N/A (Open-source project context). Updates distributed via the project's documentation and branding changes.
- Relevant links:
- OpenClaw Security Guide: docs[dot]openclaw[dot]ai/gateway/security
- Tenable Plugin Search (Moltbot): tenable[dot]com/plugins/search?q=moltbot
- Tenable Plugin Search (OpenClaw): tenable[dot]com/plugins/search?q=openclaw