Case openclaw-exposed-gatewaysModel & data leakWorldwide
Tens of thousands of OpenClaw agent gateways exposed online leaking API keys and chats
After the viral OpenClaw agent framework spread, researchers found its gateway bound to public interfaces without authentication on tens of thousands of hosts, exposing API keys, credentials and private chat histories.
HighAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 27, 2026
- Location
- Worldwide
- Target
- Self-hosted OpenClaw (Clawdbot/Moltbot) instances
- Severity
- High
- Triggered by
- Misconfigured deployments; multiple opportunistic attackers
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- CVE-2026-25253
What happened
After the viral OpenClaw agent framework spread, researchers found its gateway bound to public interfaces without authentication on tens of thousands of hosts, exposing API keys, credentials and private chat histories.
Impact: Between roughly 21,000 and 42,000 exposed instances depending on scanner; leaked API keys, auth tokens and private messages enabled agent impersonation and account hijacking
Who triggered it
Actor: Misconfigured deployments; multiple opportunistic attackers
Attribution: Exposure measured by SlowMist, Censys, SecurityScorecard and Shodan; attribution of subsequent abuse not established
Motive: Credential theft and abuse of exposed agents
How it happened
Attack vector: Default gateway port 18789 reachable from the internet with weak or no authentication, revealing environment variables, tokens and agent controls
Root cause: Framework listened on all interfaces by default and cloud tutorials told users to open the port; long-lived API keys stored in plaintext configs
Timeline
- SlowMist warns that hundreds of API keys and chat logs are exposed on public Clawdbot gateways
- One-click RCE flaw CVE-2026-25253 fixed in v2026.1.29
- Censys counts 21,639 exposed instances
- JFrog, The Register and others document thousands of exposed agents and malicious ClawHub skills
Response
Project patched the RCE, defaulted TLS 1.3 for the gateway and shipped a security audit command; researchers urged users to keep gateways off the internet
Current status: Ongoing
Sources (open in a new tab)
- The Register theregister.com
- JFrog jfrog.com
- OECD AI Incidents Monitor oecd.ai
Cite this case
Tens of thousands of OpenClaw agent gateways exposed online leaking API keys and chats. AI Threat Watch, case openclaw-exposed-gateways, Jan 27, 2026. https://aithreat.io/cases/openclaw-exposed-gateways/
Permanent link: https://aithreat.io/cases/openclaw-exposed-gateways/