Over 1,000 Clawdbot AI Agents Exposed on the Public Internet: A Security Wake-Up Call for Autonomous AI Infrastructure

Breached Company

26 Jan 2026 — 9 min read

Executive Summary

Clawdbot, the rapidly-adopted open-source AI agent gateway, has a significant exposure problem. Our research using Shodan and Censys identified over 1,100 publicly accessible Clawdbot gateway and control instances on the internet. While many deployments have authentication enabled, we discovered numerous instances requiring no authentication whatsoever—leaving API keys, conversation histories, and in some cases, root shell access available to anyone who stumbles across them.

This isn't a vulnerability in Clawdbot itself. It's a predictable pattern that emerges when powerful autonomous systems are deployed without careful security hardening. And given what Clawdbot can access—your messages, your credentials, your filesystem, your browser sessions—the stakes are extraordinarily high.

If you're running Clawdbot, stop reading and run clawdbot security audit immediately. Then come back.

📚 This article is part of our ongoing series on AI Agent Security Risks. As autonomous AI systems proliferate, we're documenting the emerging attack surfaces that security teams need to understand. See the complete series at the end of this article.

What is Clawdbot and Why Should You Care?

Clawdbot has exploded onto the scene as an open-source personal AI assistant that runs locally on your own hardware. Created by Peter Steinberger, it connects frontier AI models like Claude to your messaging platforms—WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams—and gives the AI the ability to actually do things on your behalf.

The appeal is obvious: instead of copy-pasting between apps, you text your AI assistant and it handles everything. It reads your emails, manages your calendar, searches the web, runs shell commands, controls your browser, and maintains long-term memory across sessions. The lobster mascot (🦞) is cute. The capabilities are genuinely impressive.

But here's what the hype cycle misses: Clawdbot is not a productivity app. It's infrastructure.

This is part of a broader pattern we've been tracking. As we covered in our analysis of agentic desktop agents and local file access security, AI systems that operate on your local machine introduce fundamentally different risk profiles than cloud-based assistants.

Specifically, it's an agent gateway that bridges large language models with real execution environments. Once deployed, it becomes part of your attack surface. The Gateway listens on port 18789 by default, handles message routing, manages credentials, and executes tools. The Control UI provides a web-based admin interface for configuration, conversation inspection, and key management.

When that infrastructure is exposed without proper protection, you're not just leaking data—you're handing over the keys to your digital life.

https://www.youtube.com/results?search_query=clawdbot

The Numbers: What We Found

Using internet scanning platforms, we identified Clawdbot instances across the public internet with concerning results:

Tycoon 2FA Phishing Platform Taken Down in Global Law Enforcement Action

One of the most prolific phishing-as-a-service platforms has been disrupted — and it's a big deal for anyone running Microsoft 365 or Gmail. On March 4, 2026, a coordinated public-private action targeting Tycoon 2FA — the most widely used adversary-in-the-middle (AiTM) phishing platform in operation — resulted in infrastructure seizures, domain

Operation Leak: FBI and Global Partners Dismantle LeakBase, One of the World's Largest Cybercriminal Data Forums

March 4, 2025 — In one of the most sweeping international cybercrime enforcement actions of the year, the Federal Bureau of Investigation, Europol, and law enforcement agencies spanning 14 countries have dismantled LeakBase — a massive open-web forum where cybercriminals bought, sold, and traded stolen data from breaches targeting American corporations, individuals,

The Cyber War in the Shadows: How the 2026 Iran–Israel–U.S. Conflict Is Reshaping the Middle East’s Digital Battlefield

As missile tracks and drone footage dominate the headlines from Tehran to Tel Aviv, an equally consequential battle is unfolding in the shadows of the internet. The 2026 U.S.–Israel kinetic campaign against Iran has triggered a hybrid war that blends missile barrages with large‑scale cyber operations, turning

When the Cloud Burns: The AWS UAE Data Center Disaster and the DR/BCP Lessons Everyone Keeps Ignoring

The images coming out of Dubai look like something from a war movie — because they are. Massive columns of black smoke rising over the skyline. Intercepted missiles streaking overhead. And buried in the chaos, something most people aren't talking about: Amazon's primary Middle East cloud infrastructure